Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
eaa9f5e7ac69609ad1d415d3369139d7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eaa9f5e7ac69609ad1d415d3369139d7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eaa9f5e7ac69609ad1d415d3369139d7_JaffaCakes118.exe
-
Size
27KB
-
MD5
eaa9f5e7ac69609ad1d415d3369139d7
-
SHA1
9b359f71bf5591e52bcc0718ddf5479bdee363df
-
SHA256
4cb9c5a84be14174a86caeda9f0a843813b16544c852fec7e821963c01748332
-
SHA512
7dab0f5595d2a946fe2f5538e2fdab94e17573e9e69be44b0482543f1bda33b48a51b38113bc10acffbfd91e297044a4808f8b3c6971f68d7595754c992a18a4
-
SSDEEP
384:i0lIQxn49FS1psn4UR3kYgbfZgJiz8G9a8UqNHoWe4ogQrjWrj:i0Kg4WG0HbfaYoGg8UkIP4lKqr
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1452 2256 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eaa9f5e7ac69609ad1d415d3369139d7_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaa9f5e7ac69609ad1d415d3369139d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaa9f5e7ac69609ad1d415d3369139d7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2722⤵
- Program crash
PID:1452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 22561⤵PID:1180