Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
720846ca21d7e7ed5d81375fc79fe0d3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
720846ca21d7e7ed5d81375fc79fe0d3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
720846ca21d7e7ed5d81375fc79fe0d3_JaffaCakes118.exe
-
Size
93KB
-
MD5
720846ca21d7e7ed5d81375fc79fe0d3
-
SHA1
a4e33766b7b1769b593342042d3a143c796e022e
-
SHA256
0b3d457ae0f0ffe2c58142256c2706bf4b78324aaf71d630cb431427ef7d6ffc
-
SHA512
be8e13ca6ca32f156d0d4dcfe0a29bc3cff5ff42618e5ea034e34cd169f578522642595e3921895da4d48e1b39197bb5f7a0c611b26c94e81a9dccc303ed5901
-
SSDEEP
1536:DcibeTxYTIlJr8mQnUCUPrGPHQlw9TXkQJS8G7lAqrXj/modPuQv8dsyly7g:DcQemY8mEUOwlwtyj/m0TvusjM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3144 556 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 720846ca21d7e7ed5d81375fc79fe0d3_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\720846ca21d7e7ed5d81375fc79fe0d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\720846ca21d7e7ed5d81375fc79fe0d3_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 4682⤵
- Program crash
PID:3144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 556 -ip 5561⤵PID:2728