Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
8addb348a870c330437e315b6a41e5c0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8addb348a870c330437e315b6a41e5c0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8addb348a870c330437e315b6a41e5c0_JaffaCakes118.exe
-
Size
578KB
-
MD5
8addb348a870c330437e315b6a41e5c0
-
SHA1
57a2fb228a9ad4981e9ec16866248ca96acd8d93
-
SHA256
36a8e90cbc5dbea47c125d467b3cf9e2697a939c3e954ec0ef6d00c28f5c92eb
-
SHA512
a7ee47ac81536abf7597dc3d65325870d24de364c844a79fabe6c78407ec10bee2235513b229619b3bb5c016e1c365060598ded939cd2cf9346458c0db5ce7f9
-
SSDEEP
12288:ylm1Mkcy8ZwAemur0rPpvzCh2nHuej5hWgYFc4vgjfjcVh:ICMjy8qANur0tvOUHRDuu4vAIVh
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 3696 2984 WerFault.exe 83 4840 2984 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8addb348a870c330437e315b6a41e5c0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8addb348a870c330437e315b6a41e5c0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8addb348a870c330437e315b6a41e5c0_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 3882⤵
- Program crash
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 8562⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 29841⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2984 -ip 29841⤵PID:3336