Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
05/07/2024, 21:01
General
-
Target
271f1f2117b0eb7f5301ce4a22b914da_JaffaCakes118.exe
-
Size
454KB
-
MD5
271f1f2117b0eb7f5301ce4a22b914da
-
SHA1
3fa456c517a538a9922f792e7e772e54bacb9818
-
SHA256
eaa57acde4466bc8088992090bf6610e73658fbe4c4a7c7353464986bdd4986e
-
SHA512
fb7024244e09f88777ea7732fb48dd27ebf1452433a24466563d7af1e5616e721f046fa6e44af37dae28f1b3211dd6453600e2cf2711aa61449319f104456e22
-
SSDEEP
12288:12/g4JjcB9re7F1OkwtMxJwqne1IJm4q6EPuPwnKA:a8y58IHqz7r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\271f1f2117b0eb7f5301ce4a22b914da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\271f1f2117b0eb7f5301ce4a22b914da_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Ezimaa.exeC:\Windows\Ezimaa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD5271f1f2117b0eb7f5301ce4a22b914da
SHA13fa456c517a538a9922f792e7e772e54bacb9818
SHA256eaa57acde4466bc8088992090bf6610e73658fbe4c4a7c7353464986bdd4986e
SHA512fb7024244e09f88777ea7732fb48dd27ebf1452433a24466563d7af1e5616e721f046fa6e44af37dae28f1b3211dd6453600e2cf2711aa61449319f104456e22
-
Filesize
372B
MD54ff01c9151982d6f7c749d3b876ee7c7
SHA17e3575526c74421ac71b0e5110d4f8b28ed0859c
SHA25610cbb5639fde639319f66f162774f234b226b7bd022f49b954b560b91b7e9f19
SHA512fe08424957baf586f5cc4fe58a9f26ebc5c8e73253afc80d6920d1b0ea0b234dc73271bec704c41cd036ae0b7dd17a97f7afd673280c4c2aa631e49007d8380f
-
Filesize
460KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
460KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
232KB