Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 11:22
General
-
Target
572a76a37bb01b10ea70742ff6999e52_JaffaCakes118.exe
-
Size
135KB
-
MD5
572a76a37bb01b10ea70742ff6999e52
-
SHA1
76b2fad530b5b7b7ae0292e221494ec202f5c5ae
-
SHA256
97d06c37da826ec9744b30d8e2a961a19597ebcc73408bc275c84a2b42191fa0
-
SHA512
67fe5ad4fc50fc4f16a31f958da0246aad99e58190ab782ddcfa215644ddc32ac44edc32b52d34855d892811c8d8c9220d143b0101263aa1bb906014469e5fbf
-
SSDEEP
1536:R1MYOnZApGVsJ+3pxuCcjpgv4vKJ0pcnSANSSsWjcdSp2Re+BizJgVmzbxd5+:RrSULypxXcR00OSVdSme+BizJ5zbxdQ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\572a76a37bb01b10ea70742ff6999e52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\572a76a37bb01b10ea70742ff6999e52_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx