Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 15:29

General

  • Target

    22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe

  • Size

    274KB

  • MD5

    22d958bc70960f3362513feecfe3ab28

  • SHA1

    0fd519c310e189000bb77ad0b96003285ab0ed9a

  • SHA256

    b358ddcf17067d2de0a909f0cac7fb74d96b7f25cc15cb9f08ad362c5423dfab

  • SHA512

    b97a175c63a544862dd82505484b3a5aa73debbb70f5ad4e0cb901a3a714997e49638cb277c331aaf6ad99acb5bfddd7c863db15bdf1e90d44f95d33a21505d9

  • SSDEEP

    6144:Fx+gnF+2GqK22ee9HaTmS+8QfhNRdw8tRQIWEy/a:Fx+Kw1HaiFtfjweR8J/

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\background_gradient[1]

    Filesize

    453B

    MD5

    20f0110ed5e4e0d5384a496e4880139b

    SHA1

    51f5fc61d8bf19100df0f8aadaa57fcd9c086255

    SHA256

    1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

    SHA512

    5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\errorPageStrings[1]

    Filesize

    2KB

    MD5

    e3e4a98353f119b80b323302f26b78fa

    SHA1

    20ee35a370cdd3a8a7d04b506410300fd0a6a864

    SHA256

    9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

    SHA512

    d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\httpErrorPagesScripts[1]

    Filesize

    8KB

    MD5

    3f57b781cb3ef114dd0b665151571b7b

    SHA1

    ce6a63f996df3a1cccb81720e21204b825e0238c

    SHA256

    46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

    SHA512

    8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\ErrorPageTemplate[1]

    Filesize

    2KB

    MD5

    f4fe1cb77e758e1ba56b8a8ec20417c5

    SHA1

    f4eda06901edb98633a686b11d02f4925f827bf0

    SHA256

    8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

    SHA512

    62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\bullet[1]

    Filesize

    447B

    MD5

    26f971d87ca00e23bd2d064524aef838

    SHA1

    7440beff2f4f8fabc9315608a13bf26cabad27d9

    SHA256

    1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

    SHA512

    c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\info_48[1]

    Filesize

    4KB

    MD5

    5565250fcc163aa3a79f0b746416ce69

    SHA1

    b97cc66471fcdee07d0ee36c7fb03f342c231f8f

    SHA256

    51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

    SHA512

    e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\navcancl[1]

    Filesize

    2KB

    MD5

    4bcfe9f8db04948cddb5e31fe6a7f984

    SHA1

    42464c70fc16f3f361c2419751acd57d51613cdf

    SHA256

    bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228

    SHA512

    bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

  • memory/1708-6-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-5-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-35-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-44-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-10-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-7-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/1708-0-0x0000000000320000-0x0000000000362000-memory.dmp

    Filesize

    264KB

  • memory/1708-26-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-4-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-2-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-1-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/1708-53-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-61-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1708-70-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB