Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
740c3ca0e882f5714e97c30355ef1b4c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
740c3ca0e882f5714e97c30355ef1b4c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
740c3ca0e882f5714e97c30355ef1b4c_JaffaCakes118.exe
-
Size
94KB
-
MD5
740c3ca0e882f5714e97c30355ef1b4c
-
SHA1
187e20bc4d480c452779b94f92451aae3db220f5
-
SHA256
7b790493c140fe7a0505a03ae17da12d179cc61283a8d503d5bc387423ffa9ec
-
SHA512
521174d1139ba6285b3fddfa7177730167d1241fbea3cd1a327ab3ec2656fe8d0383c28d6f80d0f32f3ea7f7455855c500ca753f29e6ce5efdd02cc187fc8da1
-
SSDEEP
1536:hAGwNtMQrceN04TF3db5mLBx1i/tnQeekBg3Hdp9y6/zLAx1HD7:qGwNtvrce1F3tkLBO/9eIg3Hd26/XW1H
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1684 1156 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740c3ca0e882f5714e97c30355ef1b4c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\740c3ca0e882f5714e97c30355ef1b4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\740c3ca0e882f5714e97c30355ef1b4c_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 2642⤵
- Program crash
PID:1684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1156 -ip 11561⤵PID:2264