Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 12:20

General

  • Target

    05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe

  • Size

    46KB

  • MD5

    05ee8e353312c1567d551a400d2d9c1e

  • SHA1

    539be79745a708ea59733684f1278a1b3a3361d6

  • SHA256

    176fae2a1644bbee4712e57e780b1565f41f78022f87ec538764cf603f0904c1

  • SHA512

    79211824c65a002ada9f29d0fafbb590df8867f6f8062467a1a7db0a35f25b6566152d95250729d005188463bedb7fc52bba62ccccc941ed6c78be4c2a6d09d5

  • SSDEEP

    768:nJ2IUDRgwxMcl1UQof8LEB7uFUsybEk+6chKkWFX8xC4X:nr8gwxMcGkIg4EkYhKJsxx

Score
8/10

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    079615f7a7e64838faeedd5945817314

    SHA1

    a0004969d61aa004cc961f075fa2b6c8ceaa39b3

    SHA256

    243b3ac1bf26d5a94b39e0d50d3ef03021c942625dd936860500521950797ab6

    SHA512

    e6b62a90ec2e58e6c9deee0087416b816699b6262feed096741ecdbe1d3e8b68230679fe2851237605823306326c6c47479e14dfc3ca73a6b78ca320c3c7055b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ac22d59cd264ff6f1563260c727c3cb4

    SHA1

    cd3522bc5f29003343385fbee1ca0fc80313833e

    SHA256

    f9a00f25f0a44114baf7d4422b41dfd792d2f1ddf89b593098873ed67f03bcf2

    SHA512

    d0ef55ab1c0241a90a50518266125d9cdb4bcd87a79961d7a3869a3efb4523ace70c10e6a5978eff8a5379219011741d753661a10552ebbb31de1158b0c6baa9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ffd236cff54159ebdcade4a0075eb7f5

    SHA1

    d90c314689c61935afdadf7ecf7e9d632c655ba3

    SHA256

    7a43de59630b54d0ae6f12130009e1bbe4c8b853f50b4e86630adfa5608b774a

    SHA512

    2725f9b349f8d5770f21fa9157caa1a888d3cf1b377ddb2fc3cc9315c4dc047eceba756eb687cf9a7351a73033fe51ac93edd1becc59291a3431a7152a5a1c99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2a0991a9e5f1e2e299eef80be6f581fd

    SHA1

    c6b5458fe9df4949dae76e43effb034a30f2b4fa

    SHA256

    ca0423a604b28bc94d8a407fe20e5c402692a84a732203ba5f62dfad7bdd866e

    SHA512

    cf2422aec292cd306beea9fd9517d3acc24bc819f36f919e0bd4e178e866d742b3ef37bcf1950c69835740946fc18102efaf849ebb41b80d5fc6b763fc627e15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9dde4ae59ece89de7401dc7c9078cd05

    SHA1

    4fb349ae13729063580368c8b741d7ab5692a8b9

    SHA256

    4537d462a0de17706b5ba3829dcff96fdbd1def8be12250c293b0c29ac9dac9c

    SHA512

    9b2ea1952e0a7f9d8eca4b5713dbb41eb54527baa13941714fdc7bdd0e61ff50f81d5adb6565cbaf00eeec7eff9d546919aeee39841304328c38d42dc87f60bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c72238d953c5b183864b276e9f9881a6

    SHA1

    1aee609cafd99309cdeb4a1af7ea98bb6e729b17

    SHA256

    498b7748a1a4ad472152f3599a998a7e7c19f0b594da82b3fa7da88cdb21ab59

    SHA512

    3b25a986ab26f50f8f47f1a53d788dd8c70beb10704f67784f30c0800e4db7d84e0e59d59e60256b7c7ddf7a2b1bed0cbea2614410cc5514e4452be6190ffd6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1cdb3558bb7a348c339d7aff1937970e

    SHA1

    6906bcd71908181de5c2a9007c297b32425fe9da

    SHA256

    afaf643ab8d1ad1366fdd509516bbd430db8ca8f968490588e7880f1370c52b1

    SHA512

    534b26dece86742a86cdc9c5074ccf3541aedf963a16aedf1469971a155d9dc09bfe0204b8bdb5624915525c33e20958d7a2cd4f44519ca509e3809069db5ca1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e9d925e7d4c4c41f03739ea64f781564

    SHA1

    13366096daac0627e24b02c878190c0bc624744b

    SHA256

    de0cf91e9c2d866cd951f8e05e8a111c5a1d1c3f0e4d72c0ee6ce2b471837096

    SHA512

    6cfbd23e44dfa1727af1c9f90d2fd63615fe1d7be4004888c1811348135824b0571731ee5fc9aec89070939ee3f9da445e74d390b766affde4f835d824d3404e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    38a3688ba1d081dc3da6cb2dccb2c01c

    SHA1

    ebac9ad22519fd534db95b00ec49052936313d96

    SHA256

    0f787b5ca9b5e29c1345a81c7ad9259ed419f1366b3f80323a78309de45f1051

    SHA512

    15cb24d45454c6859618b6dc831b620c30b5510a0e260e958a663dc9814c3361cb22980560049cbb67d36f45314221449fe0e0c6ed5edc64d7a5a12ebb1d3d9a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d030acb2201111c35b52492f50dd48c7

    SHA1

    819430b8210703512f4591ce928a704b6d829e25

    SHA256

    499271505fd763ee38060dfc3c99b70e2241b9d66247f4800f066c79a6536bc2

    SHA512

    339448bb7912599a99ffb8c292f94fc7fe24c3c0ca397e79e126c2e52d4a3de0fb4e52424413f96531c04d62c0b831c9f0b6f2282d0472dfa1eb4c5f2b5ae202

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e96fdce834d22225f40d503ec9431f6c

    SHA1

    e971d127677f02bf039f4020241164477876f4c4

    SHA256

    aac47d1e32fce5666c72e3ea754c715fa743bae199286005b1afd20393a3cc3c

    SHA512

    079b9240b9e13a6558ab165692291f9bcffd35cd0e455e9a4b0d15dcb392aadcf976e8debe095a5a2ec14c48eb84ae115ed52063c06587994d08d93189962ed5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d52375728cd8901ed8d1405823148e4b

    SHA1

    4643a6a34964fe49058145a4879085b0494c1dc8

    SHA256

    1d08fe8a7b2a3a5d380464c543e4fc767451534026a742213ec915d9346866fe

    SHA512

    9976ab617ff7f4247a52241dfb2e8b800f9da856e600d8c904f1c658746bef726636c8244be58e2189fed88de0e6e25899675d206ede07b873cc3a4cf16de80a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5162c8075a8f14c734e204057be73059

    SHA1

    520d80bd115b506a71e7448f686eaa428473a99b

    SHA256

    bc5127f4e140395b39fa6d440c4e75ee375ed2b8aed938a1252e87af900046d2

    SHA512

    ef75c7458171b4c385a3004da382e84acd5483ab36cc0213ccefe14725d039187cab99d244ba7650dbd7fb5ae7a7f556592b093a575923512543ebf3fdaae3fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f9a760e0fc61b0d81f4858ca3db5350

    SHA1

    1cb61f1fd48f5273af9b7b28011e6b78bd0762ec

    SHA256

    8b2bf3adb3bf48204d1e8cfe07db7cb3b1283c6d200cf03476dc68eebc5e24db

    SHA512

    bbc717b36218f7e23e3ec2b72643b8bed306efc79fc111f372152b875b024542ec061a19db8830905d07c81fa99d288234b4b0df812246cf383022bc3252b986

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    609ea7c6e44fe265915b44d3f039cd81

    SHA1

    01373cd35116da31f7d508d445dc74c39b516e2a

    SHA256

    52ae4ac12fc806cd8e54f16e2326191f5cdbd5c0c21313b6b897d70e757f1e3a

    SHA512

    fb029d3a0bcefc4a6952c1a229d8dd3d85ff90976260b571ac61874006f91a67e0093b29f39e8fb540e55851bd4819e879b393828da9d9fb0b4deb5f82fc66b5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c904bb2fd66c35f190ec78af6a876295

    SHA1

    69874d0f8a2373d1809d2117b672eecffdf28f8f

    SHA256

    6491f245325a948f42def01c03b2a2f58ac97152d2065c8b7d2b4c88cac834ce

    SHA512

    01f37bc9c4b937bb86d2e53fb0d42e1e38af5e25ee4a5f86daabd4578d8f144515a5d814edf1d992a4fd70feab6c1cb4429920a90398bea66c3bcf0c0bbd896a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    09cfb93d4ced6771fa89326222a9c42d

    SHA1

    c1ca442e3637f0bf9f7130a6f96e83952338a0c3

    SHA256

    1f528f980f43689239f21450fccd817179331afc4dab31dfd73015650b85def5

    SHA512

    8fcee27c78c23ee3974fd554f384a27ae866b2d674c91bcb094852624f47715a1b28de76f48f744574e911af46fef8e90d095536034326c457a9ea77147f4ace

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9c0540d14c9725fcb7a367b987f15fa

    SHA1

    1070210af3e607a4e6ba9644ce9199cf477d1081

    SHA256

    6de6ab208666f7a06ac270b1f2b6ca8d1c61432b36ec72fd3aec2ad1bd8c64da

    SHA512

    1f66a2540c30410116fc7d446c1c5945bec8a08c9c84aafba71b6f5fdcc7959be342c4fb5df7744b358073e4aad4eb67f5caabfa0e6e763e9fc2d79c4fdd80d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0927be73432d88202d109a3226185288

    SHA1

    c671fbc9424ecd652d44b49fac47758ed6226d91

    SHA256

    c2a593cebf21e11d603754de667751ec5b9c0bc5edd97b93b1eb11f64aa57b3c

    SHA512

    cab34608baf8ad5978be00fe0f27f7df7e2ce37d0194efa28fe776f2ce187eeec7840a77ca485b4e20d2a2d94958ee952d7828e47c24d9b795b4a35d63c925fe

  • C:\Users\Admin\AppData\Local\Temp\Cab2E24.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2ED4.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2056-1-0x0000000013140000-0x0000000013151100-memory.dmp

    Filesize

    68KB

  • memory/2056-0-0x0000000013140000-0x0000000013151100-memory.dmp

    Filesize

    68KB