Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2025, 06:49

General

  • Target

    JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe

  • Size

    271KB

  • MD5

    f9f96ce631b7e442af90334a7d362525

  • SHA1

    cd687a557f710552222989713a93316a5657adf4

  • SHA256

    c40d4bea682186b7adf6828f71685c7039719a343f2c48f1240fab3f442a2b4f

  • SHA512

    66558a64a9d86f47b9c753e69e161184f449d840179b1becdb23b0fab4fe9cace7e0e3b48404740a8bb4530f8a82b96ab39855df02585dd4003e5cfa3baef60e

  • SSDEEP

    6144:q+FNvDu5NMsd+mF9gNMrhsgRx2aHNs8DtD1SpUx+:lFxDAdMmF94KZJ+L

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 20 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\AppData\Local\Temp\32dee2ac5bf3c47e.exe
      :*C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe *
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Users\Admin\AppData\Local\Temp\32dee2ac5bf3c47e.exe
        a ZZZZZZXSRRG
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2160
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 616
          4⤵
          • Program crash
          PID:4068
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 616
          4⤵
          • Program crash
          PID:1868
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 660
        3⤵
        • Program crash
        PID:4248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 860
        3⤵
        • Program crash
        PID:3844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 900
        3⤵
        • Program crash
        PID:664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 920
        3⤵
        • Program crash
        PID:1140
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 912
        3⤵
        • Program crash
        PID:4048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 992
        3⤵
        • Program crash
        PID:856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1100
        3⤵
        • Program crash
        PID:4008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1204
        3⤵
        • Program crash
        PID:2648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1528
        3⤵
        • Program crash
        PID:1708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1588
        3⤵
        • Program crash
        PID:4216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1604
        3⤵
        • Program crash
        PID:1480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1648
        3⤵
        • Program crash
        PID:1908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1620
        3⤵
        • Program crash
        PID:1596
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1300
        3⤵
        • Program crash
        PID:1708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1776
        3⤵
        • Program crash
        PID:1832
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1852
        3⤵
        • Program crash
        PID:5044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 140
      2⤵
      • Program crash
      PID:4992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 152
      2⤵
      • Program crash
      PID:5060
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4032 -ip 4032
    1⤵
      PID:2984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4032 -ip 4032
      1⤵
        PID:4668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2788 -ip 2788
        1⤵
          PID:2604
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2160 -ip 2160
          1⤵
            PID:3588
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 2788
            1⤵
              PID:2856
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2788 -ip 2788
              1⤵
                PID:4500
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2788 -ip 2788
                1⤵
                  PID:4468
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 2788
                  1⤵
                    PID:1576
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2788 -ip 2788
                    1⤵
                      PID:1780
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2788 -ip 2788
                      1⤵
                        PID:4072
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2788 -ip 2788
                        1⤵
                          PID:1920
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2788 -ip 2788
                          1⤵
                            PID:1312
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2788 -ip 2788
                            1⤵
                              PID:4492
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2788 -ip 2788
                              1⤵
                                PID:2464
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2788 -ip 2788
                                1⤵
                                  PID:4496
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2788 -ip 2788
                                  1⤵
                                    PID:980
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 2788
                                    1⤵
                                      PID:2572
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2160 -ip 2160
                                      1⤵
                                        PID:3628
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2788 -ip 2788
                                        1⤵
                                          PID:3632
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2788 -ip 2788
                                          1⤵
                                            PID:1732

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\32dee2ac5bf3c47e.exe

                                            Filesize

                                            271KB

                                            MD5

                                            65f2bea4a88eb19f511054eeabfc518e

                                            SHA1

                                            3fa095424ff06d828793927481f26369a645040f

                                            SHA256

                                            dd7f90575b484311c54ad7917707251eb24c65aa49016f59e5e213f750bbef46

                                            SHA512

                                            d4f63d57806151420a8d3a7baf974d8cd05e8c5606bcc6f9d03519a2a92c8719d69eda641885b048871d1d1235ccb0589fde94557ece9ce5994634b2b529a283

                                          • memory/2160-37-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-20-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-47-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-45-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-43-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-11-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-49-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-39-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-35-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-27-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-21-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-33-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-23-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-31-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-25-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2160-29-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-19-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-38-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-26-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-30-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-24-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-32-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-22-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-34-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-48-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-36-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-18-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-28-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-12-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-42-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-6-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-44-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-7-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/2788-46-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/4032-9-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/4032-0-0x0000000000F10000-0x0000000000F3D000-memory.dmp

                                            Filesize

                                            180KB

                                          • memory/4032-1-0x0000000000400000-0x0000000000541000-memory.dmp

                                            Filesize

                                            1.3MB