Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe
-
Size
111KB
-
MD5
ae4ab972fed327107a1fe148ee92f847
-
SHA1
f8160cfdbd7f8d0a7f96c16cf9841a3318b22e13
-
SHA256
9eef1d86c0c5fd491ac467c19a3a0b9a8b1b93e7ace94f5256b41e7b35cfff10
-
SHA512
5377ce81dd0ffc4f4ba85bd97a537d3f9707d0b1167781654c21717487c2ad17b319bc57d29b3d89f1a789077f16c7f9bc3ef812fb55cf2dabef4479a0d8a041
-
SSDEEP
1536:1dmKiLx2YX5dFrA9B+k6t5vYvKfconwhXDJxlptbNswGfVl6Qp/MI51NWK:1diLx1C+5vjconwN7lptBs/3Uy1NW
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2116 ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1196 2116 ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe 20 PID 2116 wrote to memory of 1196 2116 ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae4ab972fed327107a1fe148ee92f847_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2116
-