Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/08/2024, 22:04
Behavioral task
behavioral1
Sample
94ea259f8122dbf02c5cee76bddf372a_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
94ea259f8122dbf02c5cee76bddf372a_JaffaCakes118.exe
-
Size
197KB
-
MD5
94ea259f8122dbf02c5cee76bddf372a
-
SHA1
d7c831a090dcfc7f5ee1a2fc980a18c11bddd8bb
-
SHA256
ca778c0c6c180f7555adea2fab78626304a0835cb1f0b0c939fdc2f9e1bbae42
-
SHA512
de7a152cd303a3cacebdb147cd8808fd09d1908d114dd5d6d77038af89cb416ca67b72597987a942c5d90866e0eb4ce6468961b3e2b5e790868d4aff9f07a0fb
-
SSDEEP
6144:zVZH7SFuVy6JmeKoZ12b+e72OLnDmwPsXpoSq:zr7SFuE6FKoL2aHKDE5oSq
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 94ea259f8122dbf02c5cee76bddf372a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 94ea259f8122dbf02c5cee76bddf372a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94ea259f8122dbf02c5cee76bddf372a_JaffaCakes118.exe