Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28/01/2025, 01:43
General
-
Target
JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe
-
Size
174KB
-
MD5
4595f21f613264e6a80f30f7a1f782ac
-
SHA1
caf0da1cc92da20867dcb1c154176b763e1649ba
-
SHA256
685118a0503d34102c2d1e9ae408a24fe9eb061a8fe509ec91cd7226ea1b90f6
-
SHA512
8a52c73989becb138a5976bba541065fb164af69c1690ce3322bb804319a68201b5db128f2e6b10aa5705134f9b08dd36afc7e89090c29b482bb0b72bd0986ad
-
SSDEEP
3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28edeP/deUv8M
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4595f21f613264e6a80f30f7a1f782ac.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-