Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    81s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 16:41 UTC

General

  • Target

    bc845cad41af276ab2d41dfa2b97cf7c_JaffaCakes118.exe

  • Size

    3KB

  • MD5

    bc845cad41af276ab2d41dfa2b97cf7c

  • SHA1

    cf78f4710a129f0be910a21387578bb57a169054

  • SHA256

    0bacdf835aa437d37622b9b817fd10a42ece8aea0dfd75184a6f1320290ab6d1

  • SHA512

    d2218a5fbbc02031ad029208dcaeddc3d3592e074fc27998f6b3d4648b1dd8c63e2e8af6c6eab70083c799367f740429aeb57e422cef48955635d092782bab73

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc845cad41af276ab2d41dfa2b97cf7c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bc845cad41af276ab2d41dfa2b97cf7c_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 92
      2⤵
      • Program crash
      PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1036-0-0x0000000013140000-0x0000000013142000-memory.dmp

    Filesize

    8KB

  • memory/1036-1-0x0000000013140000-0x0000000013142000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.