Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 20:41
Behavioral task
behavioral1
Sample
f0929f96f2d3478be3e84b2d1b5bbe16_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f0929f96f2d3478be3e84b2d1b5bbe16_JaffaCakes118.exe
-
Size
452KB
-
MD5
f0929f96f2d3478be3e84b2d1b5bbe16
-
SHA1
faba3eb66328143b62908cbb2db094c9b2882e97
-
SHA256
b6fe3cb20b1d9eef46af50d0389421c5d6078153b81b4ce243868cdc86f3de78
-
SHA512
8ddb28388a42ce8af37a8d8f0d5f8f9e91fb7d7a3263b6ea22a8bdb81f6ea65bd561f68f4021b85f78661c61d1371a6359fa6a9791471a308fcfdad4e1b57bf4
-
SSDEEP
12288:LSbmq1LtqYshtlT/yirkBP8odq9u33muvF9xoS0:LSxPqYo/ryiABPx4umC9I
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine f0929f96f2d3478be3e84b2d1b5bbe16_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3368-0-0x0000000020000000-0x00000000200B7000-memory.dmp upx behavioral2/memory/3368-2-0x0000000020000000-0x00000000200B7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0929f96f2d3478be3e84b2d1b5bbe16_JaffaCakes118.exe