Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe
-
Size
599KB
-
MD5
8c4412769f0267cb5626553dacaadd11
-
SHA1
4872d0f0bd6b574f868b552dc4499d704eec08c2
-
SHA256
88fbc45a2562e0c78e08a38f1a9746429fde5033c308e4b8655cf2b4aa351e17
-
SHA512
e55d2587e1b70e6d56c22bfe30f01496ae249b0fdd9e6160c346bfec7f1d272ad12fc59462b7284f0e515bf2c5984075ae71f07f8593f092408e277a9387e43f
-
SSDEEP
12288:A9VRvLG2Pm0Wtu3j5XJC3Mv7ta4+O85jUsIGEgAbsAu4We:gqh83j5ZRqJZ6sxe
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 828 wrote to memory of 924 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 30 PID 828 wrote to memory of 924 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 30 PID 828 wrote to memory of 924 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 30 PID 828 wrote to memory of 924 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 30 PID 828 wrote to memory of 3044 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 31 PID 828 wrote to memory of 3044 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 31 PID 828 wrote to memory of 3044 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 31 PID 828 wrote to memory of 3044 828 8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exestart2⤵
- System Location Discovery: System Language Discovery
PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\8c4412769f0267cb5626553dacaadd11_JaffaCakes118.exewatch2⤵
- System Location Discovery: System Language Discovery
PID:3044
-