Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 01:37

General

  • Target

    0f605728f006d004e4f0cc25fc4eed6b_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    0f605728f006d004e4f0cc25fc4eed6b

  • SHA1

    3bb00932e6f117336fcf6a1a057791c277c30c5a

  • SHA256

    97eb42e846b0dec2a562667e6394c21cdc9182929bfae2b47c7b3980fd9c3fca

  • SHA512

    abeb87a8de29f78cac51f523ec5d9859453e9e1e71ce8bc8ce5de60c1858671b9b2cb0857daf88a518221ad4a70bc095b0a1ac929898046532f4ddbf1765d537

  • SSDEEP

    768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHf:aqk/Zdic/qjh8w19JDHf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f605728f006d004e4f0cc25fc4eed6b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f605728f006d004e4f0cc25fc4eed6b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    39eff33805df186bd8b95efbb9fd25d8

    SHA1

    8e17a9c1a32f41101308f2bbf9fce2f164d68955

    SHA256

    f856500eba64906c0f667cfea2f8c5f346c45b0d56e507f11b8e26ca29d8d5d9

    SHA512

    378ed785eb212db598e1fc714cfc13abb8962e773290911217e2c591846a36b6594a8bc292069cc18362f10fb4be4d5b61e5fa6f4aac62dbb5e76707fd03af72

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    237da26be15b2409f7c10f82326b8e93

    SHA1

    39132440a9cebe7e4ab43bd5d92d34ea23eab6c1

    SHA256

    b61873dfe743c48f9cabd1b13a2218c76696f442671707980a71c1f831832fce

    SHA512

    238ae13396f7e4b96283b0e260cfafc07176edb15d802a3c0f2dd6199a9820a24970e5126e39f3202f330c9030fdd38354c566cb30db384d82853adece2cd2e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8afc848a1d874b16513c2a20f7fd19ae

    SHA1

    866973b751af34a17a4beb745d9de534a6f1c840

    SHA256

    4f667de323906ccb9619807f2e2a3f95caabbbe11d7eaf4e0525814e3cd2bfa5

    SHA512

    6118935d21d56d1d24b75ed5c7b358617627013d6e0e2b1c403ca9fb4282820d57b930de7205b41c2018ad101c1cf91427f8d43a6067dcc4fff24254d8687d40

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2d5f35eb6bdb1ef5060a73dbf7a42f43

    SHA1

    91d19301f6a8924ee52024367eb589b8f0280639

    SHA256

    1fb73b03a4aea411ee8742d57d92804abac2a7033c71d583dce66a15a7862f60

    SHA512

    e1fae3be9835df9667530bf74a130ddc6f3b669100f2125b4355482d807a86fb1544382f09bb0bcb2e2654ec3d75c77f512be04f4f756c3199f0609e580828ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1b10e792e073b359ba952013761fd526

    SHA1

    57fb50467e09afbea6a7861cb8845be6c1dbf2ca

    SHA256

    a8ee12728de281e9064608d7f98d4ac91aecb88d4629bb62195d9b3b1e60682f

    SHA512

    9557a8bb6e54465c1dc931b25277ef3490e1d1934bad1f6e159471628d49a25737d2cd48b6bb2e5acd86313ec798e5afe535d5461d34b0405bbd835eb233d6d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b050ba579062810fa06e007f220b714e

    SHA1

    87f18c8d4817cb3841e1dc3f1bfd33dd044e7ae5

    SHA256

    ca7cd17e71da0c7e35bd3313c0fb8004ff33f4ca2510175ea9f746ea323c335f

    SHA512

    767ab961578d97d816076218d8fc8d93f73da5f8e319a6abd8d02e5ff74fabac2e700892875cd6e9f8cc8d13d706a96c61610eeeebe6af0721c6932fc8a81ebb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fa107ccb8f2491214a1cb4baa0ac517c

    SHA1

    5e9473aade26cdcbce1f3aa9221874e83b44c131

    SHA256

    11fa3fe562cd887b9330a4a62d85ce55ab34d84cfc041cb2447f6b2c4d8c5238

    SHA512

    8fe1d38f58e36b95dd5dc7bf8bbecec22a07b482edb17c5b4667237d401aac14591590723aa2d24a1a1dc52a51a4dffe87ecda218f153d64587a2ff115dae612

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3962e6305cfa313e323b24b44f411e8d

    SHA1

    39b7e96cffb8bb76096465f701603272868b8887

    SHA256

    b0ece47c591bca624874778b117c37b01765514f4b7b168c9217cea2cdf3f458

    SHA512

    8daec0e072924e18f707c0d2bd6383f56e87fcd74a31dd4bb656c1824fe1030da3d518cd57e49112f2ff4f7436c1eab67f50c9a7520ae0acc33716e5a1bf0dbe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9bde2711518519f023277eefe18e7dcb

    SHA1

    a46f17e47184c5bd0549ca2ddb9d8f7334e0e2c2

    SHA256

    d78f4a37dc0b6f3d7cc4063e26c6bd8b919a80a4edc01e794dfb114a7edbc049

    SHA512

    ac43a216d318c8c09b4d9b56e551f796bc9db086baa144f8c1c7e3ef7cd98dae5e8543bbfd8d08ac7ac9368ddcae21fec026f5b3a0d61797b5a37911689e41b6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9e1c06bd3a2af1703e0f689f5fad6330

    SHA1

    cab6e967f9ebf75feb7e8093d2b12bcdf17e8a9a

    SHA256

    c700514dd8cb6a95f316b373ea8ca2a8e3c305365f982d89c2f65444eb228b3a

    SHA512

    d530dc9c2f512701717d02679deac2db3d6980d2ec8cdd337836126926f8bd9ab14c2c665325beffb632dd0aa58ddff7a395ed16b1058935b78338e47edf1671

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8658f439f8947f033aa2734a3b67f5e7

    SHA1

    ed7ea3e7bdde33d144dcd24d56b55481d5a2add0

    SHA256

    900f0ef37a8fd4400a7546db851bb5fd822dc75e6fe9668b54d17beeb5111329

    SHA512

    9b0615bf6218cf6cc5cbdab306289514777d7b8712b97c41dcb4d72946b66033c2eef815df0f295ab3a1d58b9bba0d98c43372475c9cbdcb5af288bd49168795

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4712d37826a1e02e1d17a756ac210dce

    SHA1

    56af27be33b9b5df107c817e77df6477b111a03e

    SHA256

    7c001f4c98d84c554ca0b620cbd0d32fd1a62a2cefcfc1181a275225d6bf2d0a

    SHA512

    40015226c1a6767f12e87458ebac5d557ebf789912dac4b5fa0a78eaab2228c8bf962126a112c2e6db1a58bf507889551c0c57e37b2f9bdb510b2f231cd3f6c8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\search[1].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\Tar2C9A.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\tmp31AD.tmp

    Filesize

    40KB

    MD5

    7ce12f8d040d7da6c58b1dd488dadde7

    SHA1

    6601a0fe748d819ef011ba1f96b762f30455977b

    SHA256

    0bc2a78be91150e4319b34be7888ef44c20962708f02ae29fc3d65e1f02f7629

    SHA512

    4550c594769060092d93b72565e26550eaaf0ff0c9f20a747480fcb1d5f18b8834ed59480e16fcd6c34499411e9187327b5094caa79e211c3d31354817145deb

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    0c20194fdba9166318313502adbda1cc

    SHA1

    a2558767382f8e293f4b191a3b0fc7b794a5f66f

    SHA256

    79ae9742b2d367f681fc1973bd0d27c594e25fa03b9e14ff08cd1669101879fd

    SHA512

    9433124ec9921c56b870478ff82f767c0a30f2d2532bdf95acf8ba7c8a74c0ca3997dc4034b7d286030f7e2d4f4b05ac4efc4bc65d2885fb8f11f58965b62c42

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    0165bdc76c5c9091acf0b66748ea9675

    SHA1

    806eb154dca17b67e4b0e886c20d77991394a5a6

    SHA256

    7b33c23d64e984b4a43881154fb55aed4c932b63095c979734efff4f9f311daa

    SHA512

    bedb26cc70173cad4719ab657766cfb1c230be5c2dfdaa440d33c132acea1eecb66434b0752beb00decab30f99f503dde0a225f6b72aa573c5a6c975176708da

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2812-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-61-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-52-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-35-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-34-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-66-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2812-568-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2992-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2992-0-0x0000000000500000-0x000000000050D000-memory.dmp

    Filesize

    52KB

  • memory/2992-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB