Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
f060c92d180f63b4a60156b924f2e4ef_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f060c92d180f63b4a60156b924f2e4ef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f060c92d180f63b4a60156b924f2e4ef_JaffaCakes118.exe
-
Size
344KB
-
MD5
f060c92d180f63b4a60156b924f2e4ef
-
SHA1
fc103aa88c07f4a7fed4d9d09454da2c32d63bf3
-
SHA256
a3ab5e0e5305f48d1d004fb3d52fa81bf24d65756b9768efdbbbd9a4193d94a9
-
SHA512
0a849e94d736e026208490b639c760632cc52894b8f764c5e6b10acbbe16bb3bfb26579b4276f6cda21ed7f94036c592ac641b50dbaffbb724cd24204ba0f0ce
-
SSDEEP
6144:GGzmuWyUufA1BXT/Jmt1WvhdKgvmH0v8LwTjJZscy0/p20UVwMcitXZOERs4vOy:LNUuYz/JDUgvmm8Sscy0sVw/GZOELvO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2548 3988 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f060c92d180f63b4a60156b924f2e4ef_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f060c92d180f63b4a60156b924f2e4ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f060c92d180f63b4a60156b924f2e4ef_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 5162⤵
- Program crash
PID:2548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3988 -ip 39881⤵PID:4332