Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
eacdea3d209b1d64079cfb38c934ede5
-
SHA1
49449c59e6b8bbdfd84b77d485073ab145b3be17
-
SHA256
cd8732850e11bc0c429afb317a3102c290522ef940bd442e57758328c5f36aaf
-
SHA512
35690e203ddc7d2f4174247dd26d74980ea89f1ef32c3a4aee6582cfe12f0e4de8ad79a7605cb61e43031344b025203fc66ee83af4f15bf249d94d2d2cb626fb
-
SSDEEP
24576:PmfAX0mfAXr57XVav9MkLaewsAj9Dt3YZ3y7/H8b0:W2Hv9MLlj9DtoZEj
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hh.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2856 2432 eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe 32 PID 2432 wrote to memory of 2856 2432 eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe 32 PID 2432 wrote to memory of 2856 2432 eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe 32 PID 2432 wrote to memory of 2856 2432 eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eacdea3d209b1d64079cfb38c934ede5_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\hh.exehh secedit.chm2⤵
- System Location Discovery: System Language Discovery
PID:2856
-