Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 00:06

General

  • Target

    ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe

  • Size

    390KB

  • MD5

    ce35da1a407c4141d585ba36c6e9f6ba

  • SHA1

    aa0264e52d729c795db55cb56e5bddb6dca7c2fa

  • SHA256

    90bb58bf8296e8f7a6cdce628c92199d8f1fab9c71274b7b744329403986763d

  • SHA512

    c51ba060c7bab13c92f22d9c4bcb9cd9db9a0de0bc6356366a8f4d52c39227f44c5ef197588d73020e57ccea4c83464eff3a78e2b8b9514a52b8f9f017d59077

  • SSDEEP

    6144:OS6pEDNztbRJpGEa3oYj4nfA9S+EmGG82o4GCCdKjBOyaRawf7qUlO9e7JyX4BcO:OS3NhIPYYE49Se82bBFbwfeboJyouO

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4928-0-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/4928-2-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/4928-1-0x0000000000400000-0x00000000004AC000-memory.dmp

    Filesize

    688KB