Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
36d712f6aebb9c7776e608706c7b6d38_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
36d712f6aebb9c7776e608706c7b6d38_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
36d712f6aebb9c7776e608706c7b6d38_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
36d712f6aebb9c7776e608706c7b6d38
-
SHA1
feb25a120c331d18a6e677ecbc94fb59046bdbb0
-
SHA256
d73c94e0b2d2a712a2109d2bca8348b127b4e24b72fe82f65cef823b8d3707d0
-
SHA512
d2240cc4bea909c26e33cad7737fa2d597201a79b74a86b71aa8c14c4b628950ac934dbdbf945f93072396a73bc0937ade5723d804bcee9e1e822e3d0242eaca
-
SSDEEP
49152:NOywlj4hKPgssSt2gboJdXN0BMOwLloBrugV:zlhv7StiJdXN0B7+sf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36d712f6aebb9c7776e608706c7b6d38_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 976 36d712f6aebb9c7776e608706c7b6d38_JaffaCakes118.exe