Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 22:03

General

  • Target

    2663fc4b3c9dd5d12e77acbdc765061e_JaffaCakes118.exe

  • Size

    14KB

  • MD5

    2663fc4b3c9dd5d12e77acbdc765061e

  • SHA1

    2e89cdcb745638f03b8a6567601082d9864ffe14

  • SHA256

    2a89459711143eb3a814b6b5fddc27789c6fe25559475d3b1c097d09266c0d39

  • SHA512

    ac5755746f0c050d62954da47e63a96e2c230cdb72fdf92a2ff43486099508ef2a92718725ca444821edabff95a5619a2399d477bc6f28fcb62661a45eb51efa

  • SSDEEP

    384:/THplgohc2uWgty5+PIqMvE1HWjBfe/2ZOWw3tKWFl:/FlgoSSgtfIUdWFe/PNn

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 37 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2663fc4b3c9dd5d12e77acbdc765061e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2663fc4b3c9dd5d12e77acbdc765061e_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system /v disableregistrytools /t REG_DWORD /d 2 /f
      2⤵
      • Disables RegEdit via registry modification
      • Modifies registry key
      PID:2540
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3684
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17416 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1584
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17420 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:628
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17424 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4908
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:82954 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4432
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.xiuzhe.com/VIP.html
      2⤵
      • Modifies Internet Explorer settings
      PID:232
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.okxiaoshuo.com/index.html
      2⤵
      • Modifies Internet Explorer settings
      PID:1632
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.okxiaoshuo.com/index.html
      2⤵
      • Modifies Internet Explorer settings
      PID:3208
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.okxiaoshuo.com/index.html
      2⤵
      • Modifies Internet Explorer settings
      PID:2072
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.okxiaoshuo.com/index.html
      2⤵
      • Modifies Internet Explorer settings
      PID:2408
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.okxiaoshuo.com/index.html
      2⤵
      • Modifies Internet Explorer settings
      PID:4376
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.506013860.com/mama/vip.htm
      2⤵
      • Modifies Internet Explorer settings
      PID:3104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    98f9ac4c9fce1d97505db04985429753

    SHA1

    374b2b3964b14d4533998bcb4073f7e78bdf825d

    SHA256

    df3c22e29b5fb2b98bacdd98c84c4ee067717cef369d029a61139776fa1bedaa

    SHA512

    5c1cd5aa01db5a7532eb3124dd3b3a029ea83d15aef226a986061a8549e8c92ffc5895347810123dbd8d1b29074f1e66461e361f67b03a588549e9f83b6089c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3994DEF8228AE1D7767ABF85A3741D99

    Filesize

    472B

    MD5

    454c630d2b72f5019d75f6bcc82be756

    SHA1

    e3612c9e8f02c75c9fc767a50e6be5c1202fa97c

    SHA256

    06d9b3cfd6def758909e1467720aaa12a8c526131d42475e9d166bdc0bed1828

    SHA512

    2a41af0534da6703bc28f1f2c80d24b28077aab10592862fefb054f05c5e3a2b9b40180a54353a05b0f59b3822dffd35e8ad26f2d31942f538311723b7da72ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    09018b283356d2a4207b9533f19e2a31

    SHA1

    34a611ea4043e78352e50fbebfc707bf3a1321ad

    SHA256

    7b737396178f650052961b694d56765a9b6695d51ca2c1bca96a875cf7bddf98

    SHA512

    3871540f7609a410c54ec5c41e1576997b666db86681a666d3e5c4fb02661306459410fc55c3a5b3d3ded427d565841f23fbc9473a0b05cc65ca7979af029c3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    6566aef97226dde1bd3716a0e86fef88

    SHA1

    0efaf8f47087c989ed252fa1a23c5a5ee2ae0ddb

    SHA256

    97521de5a92ca784f7daf9f75768f6c06ce8c56bc5154f4356e2848b29aaacb4

    SHA512

    9c144971a73a864568c513ac148447870946583536703f0b836fad005c95f4bc5a300ac40761da51d4fbe70b4becb9ec6711e82fabdafa769b0158abf2da3805

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    18055f062a53f1441886c9e96e50044f

    SHA1

    5487af536d25ded1a7dda6e5f3f9e5a98d08c7f6

    SHA256

    8a0645fa1538441b56dddcfeb1d3c3c57695384f78ef0267da8c1903c57be6f8

    SHA512

    0c71ccead77173c513d977a0ab749ef237d992d0d3fdf7c0c5a355982faae3fd9310732444731b7b0b9c9e8550fbc13d49e9c9fc91c6251dd3c1fe5a5adcf256

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3994DEF8228AE1D7767ABF85A3741D99

    Filesize

    484B

    MD5

    cea5bfe66bfb6defd5a847cc9283c0cb

    SHA1

    a3931b4506245d09ac043b3d8db507ed1b4ec5e7

    SHA256

    244c0e0475c5245c14d25a81406e33b6afde300da4284bf66c35a35d946b79d1

    SHA512

    c0b47e016c1ff69ef2e57be6ac8e5a7bcc54f8d8100e5866637ccdc86682f5640c5cdecba5e00ac64307361a6a4753813eee255a63a3e618ffcd9126c304cbcd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3994DEF8228AE1D7767ABF85A3741D99

    Filesize

    484B

    MD5

    b29b1b598c6df6231e7636876b7ec63f

    SHA1

    79a6c1cfeb29992e61fe888590e32aed7cc23ab9

    SHA256

    93dbb05d7b3eaa1f157ef81f70ffb4a748abbce412e8619c919729ec9c35ff15

    SHA512

    ee4b0b763e59b6adc33aecbe17dbb1b35522f2a9aecdec12624aa6bcdfe25a4a57765ace65ac0c2e8a6398971f1a7e678ab83014f48f4fd88e770f10e5380610

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    6093f0050b86ce9703570a19117954a4

    SHA1

    46836270ab2be72f30dac7e12bf3a0d3723c9913

    SHA256

    5369bef704ecadd60bf7e8d5b71fbde9fdbc0d850d32c4efa3ef41414f655d3a

    SHA512

    b6a5608657c54a86e7070e2ef82bbd7ccaa07839e7ca3d608a6066852c92618c97b71b31a1591b7363d2bae34eed4404690fbcfa9ccae4211999061bec253c37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    957f2405946e3e944918e538492d62ba

    SHA1

    b0cf27db1b4e7c37e217b087f9efd452a13ff6d1

    SHA256

    9d095ec1a08641ba1b37b5d83c10a35850be08abc4cc89e3bf35369247c3bd13

    SHA512

    2cac4ba862344e935d4c5d37325bfc86d7c346b8b07c760e972cbdac4c5f40dab5c331232916908f12604ae7048dd286dbcf3c2396e2bb67ca4a637be6e175bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    a14dab2e47c9951fcde4e2300b3b423a

    SHA1

    e35ed7effabe37e5bf3df4eed38b30ebb0fd0a47

    SHA256

    78429545f801f1352d41d94330647acb33252f469ae0193737e2a6b3ddcb644d

    SHA512

    fbfc99324943664af0942fa0b60bd70226554efb58748954e74065316a8fee51b49502fd0547f645955f0ddad6db330f24991b0a3c2ac0a81195db76a2ce07ff

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8P5ERGGJ\index[1].htm

    Filesize

    985B

    MD5

    a6d4a72f6894f3963ce90032da518aec

    SHA1

    464eae231cadfed89ef6db9b010d5e82ab8d6038

    SHA256

    874a410af24e2cd4761c054565c768b03898c09940aba283df223a51378aed28

    SHA512

    bef6a7676fb650d633d4ea3ca862d27c26d1e2795ae2b4b6b89861c14d116f856db21a79e46d6be839318f4fbb8ac784425bee4a2d3bbfc61fef4bb8f0210ff4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FXFUSUTP\bootstrap.min[1].css

    Filesize

    114KB

    MD5

    eedf9ee80c2faa4e1b9ab9017cdfcb88

    SHA1

    ed29315e0ffb3f14382431f2724235bf67f44eb3

    SHA256

    f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5

    SHA512

    ff9296270da6bcc3b664ce5f9dd5715109a954fa9ac59c9845332b5edae9aecc90db3334a3434c8d4d3623c6495de04fb6b9ab3cee0803208246cc9d1b4049a1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FXFUSUTP\bootstrap.min[1].js

    Filesize

    35KB

    MD5

    b6d6c550cb657155feb06fdcd34b73cb

    SHA1

    27947c0c0fa837da9bdfdfc36f649c25f54bd1c0

    SHA256

    267a83092a5fd6ec5fb746bce12d440abd37f1d649c072f653e17d0c800eb647

    SHA512

    f57baade307d54d9e4b7c820d1b5ef32e948df73789c8fcd51bf0b1ac7d282f05b540d14ddb0b5644c44bdc6f991ae67c9f4a78595f4b33bd91601a24aef1402

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WCI4PPHE\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/1552-5-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1552-0-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB