Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30/07/2024, 15:12
Behavioral task
behavioral1
Sample
769415a5529bd3a6d5e34205b4d52f53_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
769415a5529bd3a6d5e34205b4d52f53_JaffaCakes118.exe
-
Size
45KB
-
MD5
769415a5529bd3a6d5e34205b4d52f53
-
SHA1
8611bb29c54a62be2b80ea88eb0213ebe22b3e23
-
SHA256
1f48d54ad69726c01a7ae1e7ceff7ae6093005be1e100a75968476d72d75cf06
-
SHA512
728d6507352c49bfc3e2d56db848aef6dfb006b78eb6326eb484e2c9d8c1d9b828c8e0a5de6e8144e0aa0419014fa0d130fb7b3aecb5be6f1fae97e8a2b5405f
-
SSDEEP
768:Pu/CZTgoiziWUUM9rmo2qrE/rs4JZOPIc4zjb7gXOiVNtrZ8KK4tBDZrx:Pu/CZTgle2JwY3c43bEX3VnGKK2drx
Malware Config
Extracted
asyncrat
0.5.7B
Default
101.179.85.220:6606
101.179.85.220:7707
101.179.85.220:8808
101.179.85.220:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 769415a5529bd3a6d5e34205b4d52f53_JaffaCakes118.exe