Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 10:20
Behavioral task
behavioral1
Sample
fa3953b20ae9f9f886648ff0d8840ff2_JaffaCakes118.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa3953b20ae9f9f886648ff0d8840ff2_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
General
-
Target
fa3953b20ae9f9f886648ff0d8840ff2_JaffaCakes118.pdf
-
Size
105KB
-
MD5
fa3953b20ae9f9f886648ff0d8840ff2
-
SHA1
ba226c9185d9ee7a37bffe9123044938e2a8cd06
-
SHA256
8eb962b31bdf8f55e9cbac117cbe20d75cab67323866dee4ac2465e2144d159b
-
SHA512
c9eeb63a79e573a3c7c0b7152ae80ff8b5e53a7476940563c44a5669401782e9e5b79af266d36e365533db604042f51e0c94d55b9caf9c78ee5c4180f597687b
-
SSDEEP
384:bONbedw+lJ59QYJ0PmZfomWmvmT0l0ZmLqpe3Rw8w4mCErm76uV2ibT70b/Cyqm+:z
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2644 2276 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2276 AcroRd32.exe 2276 AcroRd32.exe 2276 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2644 2276 AcroRd32.exe 29 PID 2276 wrote to memory of 2644 2276 AcroRd32.exe 29 PID 2276 wrote to memory of 2644 2276 AcroRd32.exe 29 PID 2276 wrote to memory of 2644 2276 AcroRd32.exe 29
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fa3953b20ae9f9f886648ff0d8840ff2_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 7562⤵
- Program crash
PID:2644
-