Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe
-
Size
6KB
-
MD5
eab3344ad3d46944ab81483d2c8302cf
-
SHA1
4bafb6c678fef35fbee7a40cbf9b835085aa77a9
-
SHA256
6580f0c266499d36fbd949ef13b5e2948fcdc16a433902642b1768bb62af88a2
-
SHA512
e4bdda861c0b3879177c22e17b7e699917e83ec7e09385b6b829b48a5863bd1020986331abaf416d62499d1b1a702388f0b8b48b62726eb179ba2c741ca0664c
-
SSDEEP
96:Z1GSIkhRIFj0uM5KsI+cjFvp4OrllP0Tpnxwh/jQjwOQ0fQZU5MMz1xCO5:GkhRId0uM5KlJCOrENnijQjw/wQdy1x
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2036 2968 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2036 2968 eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2036 2968 eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2036 2968 eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2036 2968 eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab3344ad3d46944ab81483d2c8302cf_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 362⤵
- Program crash
PID:2036
-