Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 01:43
Behavioral task
behavioral1
Sample
JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe
-
Size
174KB
-
MD5
4595f21f613264e6a80f30f7a1f782ac
-
SHA1
caf0da1cc92da20867dcb1c154176b763e1649ba
-
SHA256
685118a0503d34102c2d1e9ae408a24fe9eb061a8fe509ec91cd7226ea1b90f6
-
SHA512
8a52c73989becb138a5976bba541065fb164af69c1690ce3322bb804319a68201b5db128f2e6b10aa5705134f9b08dd36afc7e89090c29b482bb0b72bd0986ad
-
SSDEEP
3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28edeP/deUv8M
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2380 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe 30 PID 1732 wrote to memory of 2380 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe 30 PID 1732 wrote to memory of 2380 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe 30 PID 1732 wrote to memory of 2380 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe 30 PID 1732 wrote to memory of 2380 1732 JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2380
-