Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 17:40

General

  • Target

    2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe

  • Size

    474KB

  • MD5

    2d3df43464ecfe0c82902410267ab158

  • SHA1

    6eb51d7b8aa89dc4198b521bfba1bd3120f32513

  • SHA256

    bc9edcc989273ea2343f5b565f6ac28de3c0cb6ea9dc2fd4ca3d57881e8e8fb5

  • SHA512

    ca64b476fe1b8572e687f487a722dde38637f236a0c622b6f087873f770b428c598caae7328e2136685bf5feff77f9caa220a0eacf9a9c02e9e2cdfe7dabfbf8

  • SSDEEP

    6144:5SrUuHX7jBQj61e0Jz6H119A1/DXg/SwxXUZRQORva4:5mpL1Qj61e0ASDXg/S+EZRLX

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2924-0-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2924-1-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2924-2-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB