Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/09/2024, 06:59
General
-
Target
e1f0394e7a92e7a6882874c87fa10821_JaffaCakes118.exe
-
Size
497KB
-
MD5
e1f0394e7a92e7a6882874c87fa10821
-
SHA1
e14df8aa6899ada28756d88976fb1e485fbfaad6
-
SHA256
57adf57219631876c6264c2f2dcd18f83537b80525bed3217db28c9e56613acf
-
SHA512
af5d3a4c7117f74c541493e03c2f10a81ab13606e91df8bab8b2a0f8a30b2fb99680d6a0592d0bc551ab0c7c62544240875126258276f179a6870ec7838ba156
-
SSDEEP
12288:31Ra1rN4wopVauKAxZkhwryPNtTirdorX:3Drp4XAx+hwrynTEdo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1f0394e7a92e7a6882874c87fa10821_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1f0394e7a92e7a6882874c87fa10821_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\EntSver.exeC:\Windows\EntSver.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
497KB
MD5e1f0394e7a92e7a6882874c87fa10821
SHA1e14df8aa6899ada28756d88976fb1e485fbfaad6
SHA25657adf57219631876c6264c2f2dcd18f83537b80525bed3217db28c9e56613acf
SHA512af5d3a4c7117f74c541493e03c2f10a81ab13606e91df8bab8b2a0f8a30b2fb99680d6a0592d0bc551ab0c7c62544240875126258276f179a6870ec7838ba156
-
Filesize
988KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
268KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
268KB
-
Filesize
988KB
-
Filesize
268KB
-
Filesize
988KB
-
Filesize
268KB
-
Filesize
988KB
-
Filesize
988KB