Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 10:19

General

  • Target

    b313dbd6f5d7a1c6c363564eb9ccec6f_JaffaCakes118.exe

  • Size

    436KB

  • MD5

    b313dbd6f5d7a1c6c363564eb9ccec6f

  • SHA1

    6d25a9afa3a1a76b4bb7685d298fc5707736d859

  • SHA256

    e37cfc052153fe564c96a7c1c7515f052b45188541d3c2144970930df7826161

  • SHA512

    96345f48c6f4ff1c4237e9d1cd9afc7efcec8aa0700191c97e674965ed650ae0ecca11c81c87940d44669d2f57b77c72497470049500c1ea05fd9fb79a666d9d

  • SSDEEP

    6144:96pbDgfKqWV42Tzliljy+CGuWlxB95T42Xx76DSM+TykvmDZru5FX4A:9sqK1V4uzliphPB95TmDS72ZYx

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b313dbd6f5d7a1c6c363564eb9ccec6f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b313dbd6f5d7a1c6c363564eb9ccec6f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2952
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 528
      2⤵
      • Program crash
      PID:3188
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2952 -ip 2952
    1⤵
      PID:1984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2952-0-0x0000000000690000-0x0000000000691000-memory.dmp

      Filesize

      4KB

    • memory/2952-1-0x0000000000410000-0x00000000004EA000-memory.dmp

      Filesize

      872KB