Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 14:00

General

  • Target

    ab4d833a5c7f108def4e9941ff83afd8_JaffaCakes118.exe

  • Size

    340KB

  • MD5

    ab4d833a5c7f108def4e9941ff83afd8

  • SHA1

    e5fd158b8d465a724780a55500924d7ef9523886

  • SHA256

    1dc4ef329d539938019dbecc78fc36b579973a96aab76993a33748254e479b5f

  • SHA512

    b5ad8f3af174aed4b618dd3ae7f4b81123150ee95ec435b8fcbd274c322621dcec615d0c1eb3fee00cbbcda149425fa9d58aebb7f9f6c2a1295a285ec5173324

  • SSDEEP

    6144:2imsmvNEJ7p6HUxNMYAcRqyBodDAPcmt5hW5fsDMJ4m3:2ims0NEJoyMYA2BRPtVmfsDMJn

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab4d833a5c7f108def4e9941ff83afd8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ab4d833a5c7f108def4e9941ff83afd8_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 176
      2⤵
      • Program crash
      PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2412-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB