Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 23:17

General

  • Target

    acfbec9cf1cd25ee91fb9f65afac5a15_JaffaCakes118.exe

  • Size

    452KB

  • MD5

    acfbec9cf1cd25ee91fb9f65afac5a15

  • SHA1

    afc4dbb07141568b4ef957af38fbd01c2db741ca

  • SHA256

    140383981e755d667cd379dde6168b9232d7664eaae1e196c1995972fdbf3193

  • SHA512

    9b10c2b75d7319c4a1d360b2cf181f4f7aaa112e2a68e4b03f8d7d3f33d3842ada432726a0a7255349d13b531a95d56adb092e761972caa67cd9ab016e694024

  • SSDEEP

    6144:TMJAx/t9srfk2m9sl9fevykltEIBOaIlw2MEHvUnbR8sgKQzwAkIFLqoy:TXt9gfk2asl9gcs2Mku8sgRpkIRqo

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\acfbec9cf1cd25ee91fb9f65afac5a15_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\acfbec9cf1cd25ee91fb9f65afac5a15_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 516
      2⤵
      • Program crash
      PID:3456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2872 -ip 2872
    1⤵
      PID:840

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2872-0-0x0000000002260000-0x0000000002261000-memory.dmp

      Filesize

      4KB

    • memory/2872-1-0x0000000000410000-0x00000000004E1000-memory.dmp

      Filesize

      836KB