Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 05:13
Behavioral task
behavioral1
Sample
a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe
-
Size
441KB
-
MD5
a9b97192e204d68537e975e4dbf01492
-
SHA1
e7bfae60dabc9fb9bf8457ee9ffb17bd13722218
-
SHA256
efc403c16f2f1bf84bde777395e3dd042ea04922308123a329902897b104bff5
-
SHA512
5a75515bea9dab48afbebcc7fc816de316c5ce225a0220707282bc7c900e900c3a936307a1988ee217f929447ee236fc57509aa667b149ee1dca49a5606457d1
-
SSDEEP
12288:W9EapqDRHs1+1pNDc8/BDoAmKDmlDjX3D:WqnG2TDond1/
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 556 a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1820 556 WerFault.exe 83 2156 556 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a9b97192e204d68537e975e4dbf01492_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 2202⤵
- Program crash
PID:1820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 1522⤵
- Program crash
PID:2156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 556 -ip 5561⤵PID:4016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 556 -ip 5561⤵PID:1200