Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe
-
Size
100KB
-
MD5
8a608b11480d769e5da31e59c01e0bf0
-
SHA1
76b4c36ca7cd34879f9ee206decea42e26915056
-
SHA256
1cf19e0e864c80d8dc4218f0a43669a0b117f07069a23ba851a038de627a62ef
-
SHA512
616afb2fb6b0cb326059b2afafb0c4190e701d3ef16b37945a7117112c9bb166d5471e562c43a694862ace6c8e21b11834463f13bf73615fd319c2c9e8dba0b7
-
SSDEEP
1536:5DTsxF8xjcQeP2cnOgoG8raa8ZT6g+w8+:UC1cQeepprSZWglj
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2536 2524 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2536 2524 8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2536 2524 8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2536 2524 8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2536 2524 8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a608b11480d769e5da31e59c01e0bf0_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 362⤵
- Program crash
PID:2536
-