Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
ac45bd3d70feaf56def8156b43e530b8_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ac45bd3d70feaf56def8156b43e530b8_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
ac45bd3d70feaf56def8156b43e530b8
-
SHA1
9b1a1cab4a7e8d3dacc5551972e056d06897a012
-
SHA256
dfd9724b9eeac4032d04ad366ad598f21f5ad2b1cad27e35ee68bddf188f704c
-
SHA512
15a2b3dab7b24f5ee71e2593e31b4aafc7fb02d99ac7e5fcdc83d7e5a93c39d7c229639f8242ddc43641759f138f97d4971197adf461c11b62980ce01e1bf952
-
SSDEEP
24576:rURctsArWayDpldVS6uL9spbITAc7/3Ppb9zK:rUiil5xm08TAA/hA
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000023458-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 3188 ac45bd3d70feaf56def8156b43e530b8_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x0009000000023458-2.dat upx behavioral2/memory/3188-5-0x0000000010000000-0x000000001007E000-memory.dmp upx behavioral2/memory/3188-15-0x0000000010000000-0x000000001007E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac45bd3d70feaf56def8156b43e530b8_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146KB
MD53d4839228c7ee77e28832879eeb17340
SHA1ebe4a6388c8c6831837e232b48b8f4266b7f711e
SHA2565d6ff8a11cda6d5b1e6d8a5562594379a082cee18f402a8a0a26b8cabe428954
SHA512f3c534524eaa4b51ee44a6c1d05a142c0d10d9c1c48db79b60903dd948d5712b367479b82cd85fa8ee094dcd2569c0fd85a36c10c97deab59e49e1f1f4da6c56