Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 21:01

General

  • Target

    271f1f2117b0eb7f5301ce4a22b914da_JaffaCakes118.exe

  • Size

    454KB

  • MD5

    271f1f2117b0eb7f5301ce4a22b914da

  • SHA1

    3fa456c517a538a9922f792e7e772e54bacb9818

  • SHA256

    eaa57acde4466bc8088992090bf6610e73658fbe4c4a7c7353464986bdd4986e

  • SHA512

    fb7024244e09f88777ea7732fb48dd27ebf1452433a24466563d7af1e5616e721f046fa6e44af37dae28f1b3211dd6453600e2cf2711aa61449319f104456e22

  • SSDEEP

    12288:12/g4JjcB9re7F1OkwtMxJwqne1IJm4q6EPuPwnKA:a8y58IHqz7r

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\271f1f2117b0eb7f5301ce4a22b914da_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\271f1f2117b0eb7f5301ce4a22b914da_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Windows\Ezimaa.exe
      C:\Windows\Ezimaa.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Ezimaa.exe

    Filesize

    454KB

    MD5

    271f1f2117b0eb7f5301ce4a22b914da

    SHA1

    3fa456c517a538a9922f792e7e772e54bacb9818

    SHA256

    eaa57acde4466bc8088992090bf6610e73658fbe4c4a7c7353464986bdd4986e

    SHA512

    fb7024244e09f88777ea7732fb48dd27ebf1452433a24466563d7af1e5616e721f046fa6e44af37dae28f1b3211dd6453600e2cf2711aa61449319f104456e22

  • C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

    Filesize

    372B

    MD5

    4ff01c9151982d6f7c749d3b876ee7c7

    SHA1

    7e3575526c74421ac71b0e5110d4f8b28ed0859c

    SHA256

    10cbb5639fde639319f66f162774f234b226b7bd022f49b954b560b91b7e9f19

    SHA512

    fe08424957baf586f5cc4fe58a9f26ebc5c8e73253afc80d6920d1b0ea0b234dc73271bec704c41cd036ae0b7dd17a97f7afd673280c4c2aa631e49007d8380f

  • memory/2352-17-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2352-25-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2352-50905-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2512-1-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2512-2-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2512-3-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2512-16-0x0000000002A20000-0x0000000002A93000-memory.dmp

    Filesize

    460KB

  • memory/2512-15-0x0000000002A20000-0x0000000002A93000-memory.dmp

    Filesize

    460KB

  • memory/2512-47412-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2512-50673-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB