Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe
-
Size
97KB
-
MD5
fa926e73b9e5d4bb792c096ae12b1370
-
SHA1
2d760185c74f1634e20bf5672c48ccd786ad2300
-
SHA256
d4552d07f7f179c860b0074cf5e311cc4ec826d1d4bb3e266f39d03264a4fa21
-
SHA512
668a88ac6c48dc2a048b37597b191a13381993c05dc7cbb5c18bafde706565aa5e762788eef421b97f825912a6587010cae99dd8c224e42b065803b8ef9b8534
-
SSDEEP
3072:2X7rxJC/5/NVAfD9vmf3p63ek/qSxKuFE53AAwX:2XnxJC/5/NO/qSxKuFi3AAwX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2696 ~__UNINST.EXE -
Loads dropped DLL 7 IoCs
pid Process 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 2696 ~__UNINST.EXE 2696 ~__UNINST.EXE 2696 ~__UNINST.EXE 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2800 2696 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~__UNINST.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2696 2424 fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31 PID 2696 wrote to memory of 2800 2696 ~__UNINST.EXE 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE"C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE" C:\Users\Admin\AppData\Local\Temp\fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2723⤵
- Loads dropped DLL
- Program crash
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5fa926e73b9e5d4bb792c096ae12b1370
SHA12d760185c74f1634e20bf5672c48ccd786ad2300
SHA256d4552d07f7f179c860b0074cf5e311cc4ec826d1d4bb3e266f39d03264a4fa21
SHA512668a88ac6c48dc2a048b37597b191a13381993c05dc7cbb5c18bafde706565aa5e762788eef421b97f825912a6587010cae99dd8c224e42b065803b8ef9b8534