Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe
-
Size
522KB
-
MD5
c10471a6c3cc88e02a0c9ad57f34b0c9
-
SHA1
c92f2c0e8bdf1b4d45791d43fdd653f90e53e802
-
SHA256
4a3a1e7a5ad5939921e21d59d223463660d3cdb1f2c2ec6fbace745f886b3391
-
SHA512
3b57c93e0a451035dbcbe6f8844a0fa17c23786b577bdfd880269b77c3572b763622c7bf785570d1487321f9d45f7e69814a7642ae468ce768e8be3e38f249fb
-
SSDEEP
12288:sw6s2VWEHMvjIhW3kkN1diSUj04SumNm+C:sw6s2oXvjIhW0kN1dl8LmdC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2756 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2756 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2756 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2756 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2760 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 31 PID 2648 wrote to memory of 2760 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 31 PID 2648 wrote to memory of 2760 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 31 PID 2648 wrote to memory of 2760 2648 c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exestart2⤵
- System Location Discovery: System Language Discovery
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\c10471a6c3cc88e02a0c9ad57f34b0c9_JaffaCakes118.exewatch2⤵
- System Location Discovery: System Language Discovery
PID:2760
-