Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
878520140188b4a45c8a6fdd085b6ec1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
878520140188b4a45c8a6fdd085b6ec1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
878520140188b4a45c8a6fdd085b6ec1_JaffaCakes118.exe
-
Size
20KB
-
MD5
878520140188b4a45c8a6fdd085b6ec1
-
SHA1
de7ffc35aa83f90e679730e95b64f463c8620536
-
SHA256
de763ff7f1791c31b3fab92174ceba3dee4e35a0ba18cc49bbafda72a112ec9b
-
SHA512
0ac7aa05b79132b727e4b7628e5a94f46d1a57041e2345deb4222f9490cd9dbfddd24298d913e2ba18bd17f992f7ed4b19fa37b19b2eb43eb7b1540b1032d2a9
-
SSDEEP
384:/jD4F7AevqPODZ/I9/37XCjmsTpenMKPn0nxfgacFdTE95eaMQPmrYVM3oJ:/jEFUVOO9/rXyHEMg0xfgVFdTgezQOko
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3820 4576 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878520140188b4a45c8a6fdd085b6ec1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\878520140188b4a45c8a6fdd085b6ec1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\878520140188b4a45c8a6fdd085b6ec1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 2682⤵
- Program crash
PID:3820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4576 -ip 45761⤵PID:3860