Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 18:31

General

  • Target

    5d270a303e179e8ad15fd8a62ceabdc1_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    5d270a303e179e8ad15fd8a62ceabdc1

  • SHA1

    ade6eae8fd4fda7836e522d6d9c7367c5265cd4a

  • SHA256

    1bb44069eded7296bad34edbda02b5a67d8a19f9980e4f973a28690f684a7b4b

  • SHA512

    41e689abb54fecb019a7ab091b2a957c78d84079aa508f5ed65add1347e7feda8e9f2041da82df34dcd67f48082d18e4a90e00b1b3f3029b8486a1847a9d477e

  • SSDEEP

    3072:5cVwWS80KnUumy0pmHCrDvIHBirxiCQFp/3M:owWS89bmy9i+Birxf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d270a303e179e8ad15fd8a62ceabdc1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5d270a303e179e8ad15fd8a62ceabdc1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Local\Temp\JavaUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\JavaUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\JavaUpdate.exe

    Filesize

    144KB

    MD5

    5d270a303e179e8ad15fd8a62ceabdc1

    SHA1

    ade6eae8fd4fda7836e522d6d9c7367c5265cd4a

    SHA256

    1bb44069eded7296bad34edbda02b5a67d8a19f9980e4f973a28690f684a7b4b

    SHA512

    41e689abb54fecb019a7ab091b2a957c78d84079aa508f5ed65add1347e7feda8e9f2041da82df34dcd67f48082d18e4a90e00b1b3f3029b8486a1847a9d477e

  • memory/1560-20-0x0000000002CC0000-0x0000000002D3A000-memory.dmp

    Filesize

    488KB

  • memory/1560-22-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/1560-5-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/1560-4-0x0000000000403000-0x0000000000479000-memory.dmp

    Filesize

    472KB

  • memory/1560-2-0x00000000001C0000-0x00000000001E2000-memory.dmp

    Filesize

    136KB

  • memory/1560-1-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/1560-3-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1560-0-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/1560-10-0x0000000002CC0000-0x0000000002D3A000-memory.dmp

    Filesize

    488KB

  • memory/1560-23-0x0000000000403000-0x0000000000479000-memory.dmp

    Filesize

    472KB

  • memory/2292-26-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/2292-33-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/2292-32-0x0000000000240000-0x00000000002BA000-memory.dmp

    Filesize

    488KB

  • memory/2292-30-0x0000000000240000-0x00000000002BA000-memory.dmp

    Filesize

    488KB

  • memory/2292-34-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB