Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 15:10

General

  • Target

    f647fecfda6bc469055df4a48119f064_JaffaCakes118.exe

  • Size

    332KB

  • MD5

    f647fecfda6bc469055df4a48119f064

  • SHA1

    111a1c2fea67c02e0de8597f7fea2f3c35a0398c

  • SHA256

    7d49e8bd52eb8c6aff222cc98e4502dfe1d3be546909f1720e2554df90f5719f

  • SHA512

    fad2190402a3e6a90f9022b1f3ab9598e24a9462cac7f2d6029a97684f253534ef524d75d51e12846b9f872ef10cca69ea2d4f43868d576c3b7c2fb6356e4e71

  • SSDEEP

    6144:w5ZUv/Z7QRbOCe2Qy8/yRoH2QuF0RBfqMJX+VzpMb6ZkqmcznrF63GU2vL7:w5ZUuRn8/yRx4BfqMJO7kqDF63GU2j7

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f647fecfda6bc469055df4a48119f064_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f647fecfda6bc469055df4a48119f064_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2936-0-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2936-2-0x00000000003D0000-0x00000000003E4000-memory.dmp

    Filesize

    80KB

  • memory/2936-11-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2936-10-0x00000000002C0000-0x00000000002D0000-memory.dmp

    Filesize

    64KB

  • memory/2936-9-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-8-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-7-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-6-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-5-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-4-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/2936-3-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/2936-34-0x0000000002A40000-0x0000000002A41000-memory.dmp

    Filesize

    4KB

  • memory/2936-33-0x0000000001E60000-0x0000000001E61000-memory.dmp

    Filesize

    4KB

  • memory/2936-32-0x00000000034A0000-0x00000000034A1000-memory.dmp

    Filesize

    4KB

  • memory/2936-31-0x00000000034B0000-0x00000000034B1000-memory.dmp

    Filesize

    4KB

  • memory/2936-30-0x0000000002A70000-0x0000000002A71000-memory.dmp

    Filesize

    4KB

  • memory/2936-29-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/2936-28-0x0000000002A50000-0x0000000002A51000-memory.dmp

    Filesize

    4KB

  • memory/2936-27-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/2936-26-0x0000000002A30000-0x0000000002A31000-memory.dmp

    Filesize

    4KB

  • memory/2936-25-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2936-24-0x00000000027C0000-0x00000000027C1000-memory.dmp

    Filesize

    4KB

  • memory/2936-23-0x0000000001F30000-0x0000000001F31000-memory.dmp

    Filesize

    4KB

  • memory/2936-22-0x0000000001F40000-0x0000000001F41000-memory.dmp

    Filesize

    4KB

  • memory/2936-21-0x0000000001E50000-0x0000000001E51000-memory.dmp

    Filesize

    4KB

  • memory/2936-20-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/2936-19-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

    Filesize

    4KB

  • memory/2936-18-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2936-17-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2936-16-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/2936-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2936-14-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2936-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2936-35-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2936-37-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/2936-38-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-36-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/2936-39-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-40-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-41-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2936-44-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2936-46-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2936-49-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2936-52-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2936-55-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB