Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
f0677f00086ca0913456c48f12117741_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f0677f00086ca0913456c48f12117741_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f0677f00086ca0913456c48f12117741_JaffaCakes118.exe
-
Size
44KB
-
MD5
f0677f00086ca0913456c48f12117741
-
SHA1
a12e70481c2d550fcedfeef41c7d8a0cf573576f
-
SHA256
fc4dae95f67c77518912e35d2deb720d3b087896a6ad132c77a9dfd10cf41b8c
-
SHA512
67b55e040181f5a53df64bc60166bbc1332778c9705b9615497241445ca55be9ee04e9c2639365031e53471c1e595b7113d57703a73c3548087a26b166637882
-
SSDEEP
384:l/EfbzHkYV2V3qWRtMv4aQNcZ1JSPwqxzeLIYbQRpJhi+c4Nz1PGTLuaybCf5hbl:q8c856QfwqxzeLtERPr5PGTCzbCfXtdp
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3572 2688 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0677f00086ca0913456c48f12117741_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0677f00086ca0913456c48f12117741_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0677f00086ca0913456c48f12117741_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 3802⤵
- Program crash
PID:3572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2688 -ip 26881⤵PID:1948