Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 23:24

General

  • Target

    0fea3a41bb2029e5b35030b6c36e7de0_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    0fea3a41bb2029e5b35030b6c36e7de0

  • SHA1

    774625a63ea945f607ec1b78385e581b0181bc07

  • SHA256

    d5adfedff600d6a7306c8c8271393e91b1b7ed899826598782ebc6665fbc3eb9

  • SHA512

    883d0fa93d67ea94553303b0f154a246555db1ab86bdc9844b7162efb1b92af96eacba56f443f62e594a4ce3d3a3090a09c36836b1200429b3cc56d50e40e293

  • SSDEEP

    24576:zUu0KmNRRpMboRt2WnBNkh5LphUi+X4NRVZEZOqJKjZOqJpruZOqJ1:4rfVTgRphHIwNjwkruwS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fea3a41bb2029e5b35030b6c36e7de0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0fea3a41bb2029e5b35030b6c36e7de0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\SysWOW64\explorer.exe
      explorer http://www.dnfdajiao.com
      2⤵
        PID:2648
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dnfdajiao.com/
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e5d4fc1dd76fbff47d84563efb6d5dcf

      SHA1

      025cd8f70812b4929c846a9842b4cfea77ead3a8

      SHA256

      2072409400af50706d9df34b19886089a46eff757ef0245e1e3d5268947ce5f7

      SHA512

      a98c1e87ad95fb0a4b670316c347b904063d258f37d7965fee4868399f921f7aad89141712a9e72aadb27c673cd34347b73439624846d4c1267b7af85d10d0b8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d4fc3900ac921e17fbb9413a8afa9452

      SHA1

      fca4e7764b6a0b8e2c37c816d2c2aeecd9fa847e

      SHA256

      250eff1267c9d227acd14e83b5fe33a125108517e35bd12d875c0f2cf5e8a94d

      SHA512

      7c4dd77096ff34a348f2ede3ad0cc9783fcdee51112bc7b5b5d604f5f7a9dc440db8e2465a2349fc15f6cb7a1c3f8243b2ccbb77ca86f148d65e63037f4ce9b7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f349847f898330036119f20087c6d420

      SHA1

      8a4a1f4aeda59c3f431272bd618bdd88f861711d

      SHA256

      07b65d19016b56ae806d5527bbf2b32299f9cc65ee565cf11bc0ff9c4700d229

      SHA512

      167522d845532ca1cb86f0af46314bff95669ff9c352cb31db3123ac6a8d1a25e85c01ac6d7150356a74f1fb33e8b1e1d3bb23fec814a1a8d2e92e146e8d887a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e4d4fbd7e48ad4b21e8b3c294374710e

      SHA1

      d5a2aeb9052a7ea2324c593728c6a61cac2f2821

      SHA256

      6b4ecc31bd0fc22464d89a319de0c0f52ce8b2aa738fbcbccc08913b597eb38f

      SHA512

      fcde9ea1ed8615f0443e6150c4c6dd9e29bf97f4633bd129eedbb8229f16db32ebe69b926eba86954049acb598cbfed2a80d88e150828832c4cdfce843099341

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ec06b9d7017d8159fe0d6640797c3b53

      SHA1

      733c4a4dd762a9d2cc258eec6d2bf80e65131acb

      SHA256

      f6c1717f891b10dea239a5b8f1ac9265b956a22acb41749d08ac57c9d536653f

      SHA512

      2e5d76afc007175c7b7ef0816bbbb26d84c5467e208bb846034dedf9460b9a17530c1fba4299deb1d6ff705284829e0f5cd66144e9e4770bb05baa7c9a1e738d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b7eb0ac60d6275a03378904cd807022c

      SHA1

      4a2aeec4ea134b827265ac5e388ddd2e12de89e4

      SHA256

      596c0235ac078222399f2c325b4f021739e4a3e0d844409c79997679245459a1

      SHA512

      5afa3fea04684645fd7d45ca83b46f2413dbd42a74087d5eebb8171fbae29f6f07926fefab99c81de1c0ba2533e3f80ad487bb24061f8d267bcbdca0bd481aa8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e250f8460c334fdd01a2a99a587b8e38

      SHA1

      f26ec6dc42aaa448d1d4700616f25cd1488e12af

      SHA256

      581b721c984ab803aa1917fef197d2199895f745704c325418463964ce01a9b8

      SHA512

      821ea21c69ec09dc7fdfd7879e18a995613f89f401dd72477bb74acb536f5eeb94f30f1393e16ec7fbb6e48cbb63d484c5b5e2a151b00b2dce47380ab329f8c5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      15164a30e76bb13d693562eb48214f02

      SHA1

      dac614b9448d10b161fdaf7da23cbc3078adaa19

      SHA256

      be100719a29d33dd3735cc9d6f63504b499fdd940295bc625094e3e77fea423a

      SHA512

      51b1cad64ad53e73f91102b0e3fbb9245532df3ff3696492029bacf158ea69a96f94474d8416d719c6dfbfeb4cd4376b4508325465fc40c80f8a240532701c5a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1a6607144326b11ff58533b2c9b8b4fd

      SHA1

      52d5e3cc67d0c8b700c087ea3086719390b17c86

      SHA256

      4e68c0dc025e8e019bf7cba2dd5e7f642770c16a9bd3a78b855cd79b914fccf4

      SHA512

      11217638b32e1723f0e50c3095d112d4ee5ff9dbcc814ca70a0e3d595b8d0f2decd4156017ed7816052551ad34381eb4c0802eedd7227cf4b00c75f11f6e3750

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5d5259180c2a40a82b39ddc58b8785af

      SHA1

      d304bbc4cd2f92061181d6e6360f39d83be26038

      SHA256

      1e5b3829d9d950c82832ba07c1a8bf856dcf29e04bec279cfd3de328d4dd536f

      SHA512

      99782300377af6328227e09ee2586b628f52b07109afc4ca58ea94edd3442a3ebb9a708be6913fcdff67d737a2486b34ff9394da00215b5600dc3e18206007d4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c9c2c08c4af8bc5d8c160c2cdfec2632

      SHA1

      1823bace20b63371de8a876a99fca0e3d0905aa1

      SHA256

      73d6dbc9515fc3f1acc63f28a6ee06c4bc1a8f9b930b4f4a00d99aa35a5481ab

      SHA512

      163fba41a4762e98a7ef531eb2806db1f43571848505b01c0e5b678cc5040ae42f17726480e142ac1bbb1fb8208e2570e3379a03fcb0b39c78a821bf8c60f2f4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d0c94148d3ae1cddee243054bcc9a16a

      SHA1

      c296a9d38052baa99a53784cae9a77946803d7dd

      SHA256

      3bb8c536609511864242a09445c6f9e43880b72e1597cb1f5f54ec5f1df52e15

      SHA512

      527ce9fe80429cfd4b95a11477d743d554d5a17a7799f1124b1cb1fd48e90dac59853d79fdd9bfe8a98a212dc0c195f2b96795e993a48c44c52c2f8fb9ae36db

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      925cfb131836380fd612b76e6ff98433

      SHA1

      bf71a2db8b0032f169259ef352c49b3984330f0f

      SHA256

      f9439744812cf5c8cd052b95ee0c94166fb899275a509b50a82518532ccd9d54

      SHA512

      62db60bd7b6940f42d9d2bc37ad39b57cc0f3de66ab85c8203cf17b9d0fde3a2da94f10eea6bfbcf0c87362f1cec3721ca8389690e3267bc660e9d673a9a13c5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ac01f3ceae184e5985444d18e77918b3

      SHA1

      9b8e7a008332ef0430c69f388744055043c9b26f

      SHA256

      3af65cbcb24ca86306894db0137180a8df053c03a9a145d759c43bbec50f57e0

      SHA512

      9f92567761557eae8c31298a9f5115804cdd6217ea92e3e73439323194cf8116d371bff181053142d578db57a9954bb476e3821bfc19a839996a5ba240352bd0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      71436636550187a720c755064a5f8a74

      SHA1

      f594aecc9dd13f6a4aac4b91009e95ec759c00d1

      SHA256

      730ca7e1ef4cc0c120043ab2421d89af91680041e8777beedd8363c1885ddc94

      SHA512

      cd4854400f7224610240feeeed81e398f53678cfdefc122b2b99ee86dd70ec959180353e5c7514283fe625ffa12f827cc286830d0b7f95118fffc66e78c670fb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5395a2f585cb9a6fdc99779e07f8af3e

      SHA1

      d77e2bc1936f740320fa1292374534a65a88177d

      SHA256

      e171e7722ff2ed2fff82c7ac8db47739cc84c4fcdce3a4200186fa925de1a193

      SHA512

      8214650c55109e990d21762cd14cb2688a7587a0192f67df34d27c27cf17289295741cbe805d6c6e8560893c88f88dc2f6235787d7c53754fbdb69ef2575346a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a1849fc836278466f597654980c79027

      SHA1

      05eb56489b7f5eafa8eec3ecafa2d085e90ec5fb

      SHA256

      81e35df7144ecfcc58f56eb93306f282d4e5f9c82500b721ca72e58f9979e487

      SHA512

      16e9949b2dcfd17426ee5015708d22a719dde43c233760638d4c72894c7b448353fc0634bd8b6001d49060f4a0bde832f3e47dcb4a6f5f525eabdc3c4befb406

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      394ef93274c71936339bf3f1e0eef4c3

      SHA1

      8ad695e96387899cc3dcddb2c81a51afc7b61afc

      SHA256

      e1ecfd152c172bb768eb67c55a1e0fac8ef3e3b0ad8a056799f661183e5e6bc5

      SHA512

      b4c27e060b229c0d348a8772ca51b616636f639f62c460b2864eb09908b88cf18ee64c27825de33ce3f550f76a88f2dec64e641b1545db277da3673e15478730

    • C:\Users\Admin\AppData\Local\Temp\Cab5DBD.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Tar5E40.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Windows\SysWOW64\SouGoo.ime

      Filesize

      52KB

      MD5

      b60da4e2e5aceba3ce3d87ee2cd872ee

      SHA1

      9bbdbf1f3ce2c000a86e0473da756a4b1031db41

      SHA256

      b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

      SHA512

      664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874