Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
09/04/2024, 05:57
General
-
Target
e961af210377cab2983914fbb111f3bc_JaffaCakes118.exe
-
Size
469KB
-
MD5
e961af210377cab2983914fbb111f3bc
-
SHA1
1b33d9dccd2e074380fea43b30356b206a575cc4
-
SHA256
5e5ac8cfc837f39fb6eb6e9a2177d688acd5454a84456a7faff349ca5a3b0eb0
-
SHA512
670865875e8962833ffb91cd3a17bec39c999fc903bdde67eba373a655c5aeee2c32c695690db74129a0754bb0125f981e7d0e8652df46613311d68f30c58c14
-
SSDEEP
12288:Ab7jkD3v0VBRxE5MBGlcM7UdTLI7UZWG1j3FLiUh:Ab3w3v8BRqEM7UdgU1j35i
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e961af210377cab2983914fbb111f3bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e961af210377cab2983914fbb111f3bc_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system\smss.exeC:\Windows\system\smss.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
469KB
MD5e961af210377cab2983914fbb111f3bc
SHA11b33d9dccd2e074380fea43b30356b206a575cc4
SHA2565e5ac8cfc837f39fb6eb6e9a2177d688acd5454a84456a7faff349ca5a3b0eb0
SHA512670865875e8962833ffb91cd3a17bec39c999fc903bdde67eba373a655c5aeee2c32c695690db74129a0754bb0125f981e7d0e8652df46613311d68f30c58c14
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
232KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
232KB