Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe
-
Size
106KB
-
MD5
143c4d2cdbb349d34e19d6257a285e58
-
SHA1
697d78e9293e8764fa8978056f18c2f6e7883589
-
SHA256
18c01d09ff6d7cb6347e32076b6aaaad0af7f5c51ad1e3694f0fb48a939c18e0
-
SHA512
14bc2da16e5bcbb5189c3f3fad762ed960b8bfbba2f58f1cf8bf5456d1ee62e2e395276bdfb43640eaca67a953facc0f4f9ef265a3ce0ba8a260696514e45540
-
SSDEEP
1536:i+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZG:i+FDzK71QkbstyJjCKICpC72s/mlaXG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3056 300 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 300 wrote to memory of 3056 300 JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe 30 PID 300 wrote to memory of 3056 300 JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe 30 PID 300 wrote to memory of 3056 300 JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe 30 PID 300 wrote to memory of 3056 300 JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_143c4d2cdbb349d34e19d6257a285e58.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 1282⤵
- Program crash
PID:3056
-