Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
-
Size
228KB
-
MD5
de63d60aa21b2999571b29b4c83ed250
-
SHA1
f4fa5b76bc4c48fb8f93a3c7e9b76abcbd351b0b
-
SHA256
c03e5d09aa61dae4cda64c648d48cb79b76aa8ca9ea783017ef517a7a46e5b17
-
SHA512
6f7a97c9fcb866a47c53aa33e5f345e481e27e6bdf81e77be742775e663ca1e3bb5805ad01289909aada9a9f5057427674ba4a86b71844c802269c9bd4a221e8
-
SSDEEP
6144:+6JCT3oGg8kwzk9QfotMtq8rdAUk7kO8FZC9zU:+64UGgGzAYoKRrdnO8XCa
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4064 de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe 4064 de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5d940a92cbf39db90e2623c2003f782d2
SHA144bdee39e9c2c94ec5a19b5508a962f95bc7cb09
SHA256ad6df95ec18742bec5d2a923c07129d9e241e2b680453893045e74b65a21ee7f
SHA512d4270215f21dac853758b6b2fb8ff73f5a15a32a8bcc6f26f7742c3a1d313500d2065270be827856e5fcf4c3e13c830c80ce164c504a3c3bdb13f9c21284d6ad