Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/02/2025, 09:10

General

  • Target

    JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe

  • Size

    208KB

  • MD5

    d9c3619d817b64930691f628f4e264bd

  • SHA1

    b7d6087f47e90463ded34aa72ffa249402d0ac27

  • SHA256

    31103981353b7689abc6ad4a3a2b7b48fb92de59b7f344faaf05aaca7f4e4cf2

  • SHA512

    2a7b0f1c1fa4952684ba7d1ec67af26859ac3c5fcf1c5f7f73ba510f397b20a5f226960552160ad55c77ab7a7c9f4b417be3b9bea4041fee5f4194acde7f4d29

  • SSDEEP

    6144:9nKNcFl7mMdGCUoY1dJ6MlaKqqqqqqqqqqqqqqO:oKRWfJBTqqqqqqqqqqqqqq

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 4 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9c3619d817b64930691f628f4e264bd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Users\Admin\AppData\Roaming\msconfig11.exe
          "C:\Users\Admin\AppData\Roaming\msconfig11.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2104
          • C:\Users\Admin\AppData\Roaming\msconfig11.exe
            "C:\Users\Admin\AppData\Roaming\msconfig11.exe"
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3368
            • C:\Users\Admin\AppData\Roaming\msconfig11.exe
              "C:\Users\Admin\AppData\Roaming\msconfig11.exe"
              6⤵
              • Modifies firewall policy service
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:2176
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjFFNkNDMjYtRkUxOS00MDdGLUFFMTUtOEQ0Q0VFNDQyQkNBfSIgdXNlcmlkPSJ7NUZCMTY2RDItRDQwRi00NjgxLUEyMTUtRTExQTZEMkVFODJFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MkM2M0UwMTgtRjE1Ny00NzRELTlEMDItRTMzMDA2NzM2RDA0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4MTUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE1MzQzMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjMyNTg0OTQyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    208KB

    MD5

    d9c3619d817b64930691f628f4e264bd

    SHA1

    b7d6087f47e90463ded34aa72ffa249402d0ac27

    SHA256

    31103981353b7689abc6ad4a3a2b7b48fb92de59b7f344faaf05aaca7f4e4cf2

    SHA512

    2a7b0f1c1fa4952684ba7d1ec67af26859ac3c5fcf1c5f7f73ba510f397b20a5f226960552160ad55c77ab7a7c9f4b417be3b9bea4041fee5f4194acde7f4d29

  • memory/1352-0-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/2176-45-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-35-0x0000000000490000-0x0000000000499000-memory.dmp

    Filesize

    36KB

  • memory/2176-70-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-68-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-66-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-64-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-47-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-62-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-42-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-43-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-60-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-58-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-56-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-52-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-50-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2176-54-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3368-34-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4288-53-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4288-3-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4288-40-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4288-5-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4388-8-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/4388-11-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/4388-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB