Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 06:14

General

  • Target

    a9e75765df0775bee71cd33fdea0c0e9_JaffaCakes118.exe

  • Size

    491KB

  • MD5

    a9e75765df0775bee71cd33fdea0c0e9

  • SHA1

    846412a39d9b4c5e5ff0f3a6c8c3924b28bbdd07

  • SHA256

    4bc3dc613cdb6ab9fb4bcdd0475b059e3587e28c18a2ccf3e80da7e7a3267de0

  • SHA512

    d8dfe3c052736d501925452905158d0ab6762f8b415ae92a46152c03eb45eef249152729a4aa892298dab279dba13b371199a6f498b979b9d81b5f81707c326e

  • SSDEEP

    6144:JnnJ6iBx7HhYENEyhYNHYY/A64oBWm/qkp99o3b+Eipz9HVQyppGZitfKx/8GcsO:JnUIjFVIAifSkvY6z9HVQgd+esTCmVZ

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9e75765df0775bee71cd33fdea0c0e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a9e75765df0775bee71cd33fdea0c0e9_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2632-0-0x0000000000400000-0x0000000000B90000-memory.dmp

    Filesize

    7.6MB

  • memory/2632-61-0x0000000002E00000-0x0000000002E01000-memory.dmp

    Filesize

    4KB

  • memory/2632-60-0x0000000000270000-0x00000000002B2000-memory.dmp

    Filesize

    264KB

  • memory/2632-59-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

    Filesize

    4KB

  • memory/2632-58-0x0000000002D10000-0x0000000002D11000-memory.dmp

    Filesize

    4KB

  • memory/2632-57-0x0000000002D20000-0x0000000002D21000-memory.dmp

    Filesize

    4KB

  • memory/2632-56-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

    Filesize

    4KB

  • memory/2632-55-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

    Filesize

    4KB

  • memory/2632-54-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

    Filesize

    4KB

  • memory/2632-53-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

    Filesize

    4KB

  • memory/2632-52-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

    Filesize

    4KB

  • memory/2632-51-0x0000000002C80000-0x0000000002C81000-memory.dmp

    Filesize

    4KB

  • memory/2632-50-0x0000000002C90000-0x0000000002C91000-memory.dmp

    Filesize

    4KB

  • memory/2632-49-0x0000000002C60000-0x0000000002C61000-memory.dmp

    Filesize

    4KB

  • memory/2632-48-0x0000000002C70000-0x0000000002C71000-memory.dmp

    Filesize

    4KB

  • memory/2632-47-0x0000000002C40000-0x0000000002C41000-memory.dmp

    Filesize

    4KB

  • memory/2632-46-0x0000000002C50000-0x0000000002C51000-memory.dmp

    Filesize

    4KB

  • memory/2632-45-0x0000000002C20000-0x0000000002C21000-memory.dmp

    Filesize

    4KB

  • memory/2632-44-0x0000000002C30000-0x0000000002C31000-memory.dmp

    Filesize

    4KB

  • memory/2632-43-0x0000000002C00000-0x0000000002C01000-memory.dmp

    Filesize

    4KB

  • memory/2632-42-0x0000000002C10000-0x0000000002C11000-memory.dmp

    Filesize

    4KB

  • memory/2632-41-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

    Filesize

    4KB

  • memory/2632-40-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

    Filesize

    4KB

  • memory/2632-39-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

    Filesize

    4KB

  • memory/2632-38-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

    Filesize

    4KB

  • memory/2632-37-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

    Filesize

    4KB

  • memory/2632-36-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

    Filesize

    4KB

  • memory/2632-35-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/2632-34-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/2632-33-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/2632-32-0x0000000002A70000-0x0000000002A71000-memory.dmp

    Filesize

    4KB

  • memory/2632-31-0x0000000002A40000-0x0000000002A41000-memory.dmp

    Filesize

    4KB

  • memory/2632-30-0x0000000002A50000-0x0000000002A51000-memory.dmp

    Filesize

    4KB

  • memory/2632-29-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/2632-28-0x0000000002A30000-0x0000000002A31000-memory.dmp

    Filesize

    4KB

  • memory/2632-27-0x0000000002A00000-0x0000000002A01000-memory.dmp

    Filesize

    4KB

  • memory/2632-26-0x0000000002A10000-0x0000000002A11000-memory.dmp

    Filesize

    4KB

  • memory/2632-25-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2632-24-0x00000000029F0000-0x00000000029F1000-memory.dmp

    Filesize

    4KB

  • memory/2632-23-0x00000000026B0000-0x00000000026B1000-memory.dmp

    Filesize

    4KB

  • memory/2632-22-0x00000000029D0000-0x00000000029D1000-memory.dmp

    Filesize

    4KB

  • memory/2632-21-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/2632-20-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/2632-19-0x00000000026A0000-0x00000000026A1000-memory.dmp

    Filesize

    4KB

  • memory/2632-18-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/2632-17-0x0000000000D20000-0x0000000000D21000-memory.dmp

    Filesize

    4KB

  • memory/2632-16-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2632-15-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/2632-14-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/2632-13-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/2632-12-0x00000000024C0000-0x00000000024C3000-memory.dmp

    Filesize

    12KB

  • memory/2632-11-0x00000000024D0000-0x00000000024D2000-memory.dmp

    Filesize

    8KB

  • memory/2632-10-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2632-9-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2632-8-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2632-7-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2632-6-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2632-5-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2632-4-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2632-3-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2632-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2632-1-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2632-62-0x0000000004220000-0x0000000004221000-memory.dmp

    Filesize

    4KB

  • memory/2632-63-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB

  • memory/2632-64-0x0000000000400000-0x0000000000B90000-memory.dmp

    Filesize

    7.6MB

  • memory/2632-65-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

    Filesize

    4KB

  • memory/2632-66-0x0000000000270000-0x00000000002B2000-memory.dmp

    Filesize

    264KB