Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
b0e384ee2abdb5029ae26e56a5601154_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b0e384ee2abdb5029ae26e56a5601154_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b0e384ee2abdb5029ae26e56a5601154_JaffaCakes118.exe
-
Size
81KB
-
MD5
b0e384ee2abdb5029ae26e56a5601154
-
SHA1
142cb043a614a058df886046c2724158d3b1d049
-
SHA256
11f0d776a9f2af5482aedb73681f0e3ad5ef0dd657028ebb483bf89ada7a3fcb
-
SHA512
33db5a02f9986d22906a280d0529fa5fa97b9581d13d03304523cc9ea116e38dfb93206e43c8463ee955e90d413c6e9ad01fc6ce702a478ab2e3dbf75e91a3e7
-
SSDEEP
768:yIxJZbxR2OjXwSP7btrKYKRb7YELnupXt9XzxfTF:yaZRXw27UYWb7jLwjVr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation b0e384ee2abdb5029ae26e56a5601154_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0e384ee2abdb5029ae26e56a5601154_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5a69e1be5ac74d5a73e7950ee2b3f53c1
SHA15664a22a285fe0faafb8aaf9c391b3f93c8dfade
SHA256e849441c46894e383cb2a2f24a36d9944cae8eb860d715894c5108002a54e1bf
SHA5128ec7dbf26745282a7b5cb592398c41503c686ab436e2d32d6e6fbb0b9399813a816b652cc6a7ff0c1c32cf1637f22da43f7615247c65498d9290ca31999c73ff
-
Filesize
16KB
MD5b6f99d401327eb5b8bb0fbfdcf41f62a
SHA1a329b514ea05321110c385daa1703a96a9ceac56
SHA25640f52d3120e2bcad32be7327adb4faf9dc3c0d750a577afb766a41e6ca9fd41a
SHA512380e63544258079a8a27bbe06298f0decc03c407b4374809a2ce85baf2ea253fd6134efe46bda8163baf7e7ed37fcff6e894496a45c3094bdbc93137e5b510b7