Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe
-
Size
766KB
-
MD5
50ae704cafeba5b700d5fbb6dc68f262
-
SHA1
4fde265276a804e09a9888de211f070c41146ca3
-
SHA256
81136dca1d7943435b75e587b5d5855a83dd2a58e639c059aed0fe15e3f49b2d
-
SHA512
2d5ff42ae151412e17fdf0217ca6b23632a10c62857ae81baf76ed8855f447ac21313c135f6c2f69952e9f3524e20398fcb2e6e4db9ef00b06d35e6355cee4b1
-
SSDEEP
12288:DlA/9z2Jtv21nf3ELaUqjXn3YLkkmO8tXsOhdY5fhbJJ5X+ZwAieDqjdROcuFAqL:DOzQ81/oaUQXnoLkk81i5f7fwqjPOcs
Malware Config
Extracted
vidar
41.5
865
https://mas.to/@xeroxxx
-
profile_id
865
Signatures
-
Vidar family
-
Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/1052-2-0x0000000000D60000-0x0000000000E36000-memory.dmp family_vidar behavioral2/memory/1052-3-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar behavioral2/memory/1052-11-0x0000000000D60000-0x0000000000E36000-memory.dmp family_vidar behavioral2/memory/1052-12-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar behavioral2/memory/1052-10-0x0000000000400000-0x00000000008EE000-memory.dmp family_vidar -
Program crash 1 IoCs
pid pid_target Process procid_target 2592 1052 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_50ae704cafeba5b700d5fbb6dc68f262.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 16162⤵
- Program crash
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1052 -ip 10521⤵PID:4940