Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
eab690969181f30311dce693e91f83a9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eab690969181f30311dce693e91f83a9_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
eab690969181f30311dce693e91f83a9_JaffaCakes118.exe
-
Size
593KB
-
MD5
eab690969181f30311dce693e91f83a9
-
SHA1
3a2a3cbda783d6c9cb192a3ecc09ed6a53b88bc3
-
SHA256
23d66edd1ab1d04a9a84a980d0dd5316707963a7683a2799580d8673e9658b6f
-
SHA512
e32049cd0601cd6348df6bb62155972d0f0b30cf9358b9b309254a585dd9fbe198ffb99ae3bdc548534e8e59346e3b4932e90dfbd47e72a5a796f4f419f9546a
-
SSDEEP
12288:R0aly+BZc2oIRbccjbX7UDmPGMZD3d12zOZ7OapUBdjnxW:Vy+BLRgAPxJ3v2iZ7lpOdjxW
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3352 3500 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eab690969181f30311dce693e91f83a9_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3500 eab690969181f30311dce693e91f83a9_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab690969181f30311dce693e91f83a9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab690969181f30311dce693e91f83a9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:3500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 5282⤵
- Program crash
PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3500 -ip 35001⤵PID:4384