Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 03:14

General

  • Target

    2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe

  • Size

    654KB

  • MD5

    2aca4c28536d8881ea6a357cf76050ee

  • SHA1

    85e18854fb7a7a4c5f1d7830014d50e1555c41f8

  • SHA256

    c3243905f89bfdacd8ece8dc8fa0d9e79e2522a9b6b3cea642eb64c70b507459

  • SHA512

    35e8d8a7b7eb4e202843888bd5b74bc09447627771c4175653c2e8f09fe422fdf85008de012f0bc29ed69d516ddd70cc5fd5b41895df9eca6daa76ca5347d96d

  • SSDEEP

    12288:waWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQ/+:3aHMv6CorjqnyPQ/+

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.81830.info/tg15.html?2d
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2648
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:406530 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2440
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    02f438a651e4e54b88475298a6667477

    SHA1

    b4bf4363d8aeb954d3c4b6f42062b037b9425206

    SHA256

    89af8165f1c55a435ee9db95eb9e9b2f31b07a73c368616ebee8bbd1c0d58536

    SHA512

    62f25036ed7675a7e3617aa7f942517e769f68a55a37cd3f45f2d5e18e8b81e734817933f891314f27967ff81bbb41346b3557e9426fa2c4ccce05f8c5a18035

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3123cb63847a8e34bb09add2c2429bac

    SHA1

    27378623da7615d85dbaf50bb3e85784bdf5cefe

    SHA256

    86df995a526425095546327900ed8d233994929184ae14d2051b094961a46e5b

    SHA512

    01e7d44272ca5e70844634762c08c7142e5b9a576778d84f0e24073186f5c66d06dd4b4010127cdb45abc1f77765986e1669b9278004dd799e315039efecba0a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d377a7fa0ff7987e0a7e3b63997885b

    SHA1

    baf28ace222fe95c4ee74d348ab42060cffbfab5

    SHA256

    199954ba84467372300d19da09cd04ee6dbf9faa53d2e7d18fe05ab74fc1d8dd

    SHA512

    d99b51cbec146c9ec4c5c6a022626b68c5ab29e579efb0cb2699bd930fc44f1180c1f0d576ef587d5e028fae9fb523c6ba9c5a2a70f1ad409b1b43574960d82d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7973c95f37553ba72e3aeb28f7c5d2b1

    SHA1

    5f4584d368cd89d29364c5c261bd58a6b28dae64

    SHA256

    7e6c3be25fee4c189d9f6141f6140b8c96f37687384acd737ae77954e3fe5737

    SHA512

    7d274b12ff8751c12acc7c8e9066972bca44da722dd062559f2c1f6766f9c3fa6e6025c8553580de52dea73ab86faf94c2e2076515b9b21b491b31fabdebd388

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86de4eae141f8275a0d96116f218f9c4

    SHA1

    f653eb02890ea8e5093c3226f96c6a25a26ef491

    SHA256

    aa493950f17c32f13cf762e0fc28e08b0946b62c482b95192ecdbc6e3427c42a

    SHA512

    7df25f72b6cef1a2374da2bd583fb96209eb6f279e30220ff6320b4ab347c80aa60940f821bea93c62cd9129f0a1be8e3ea4af7dba5d5552c6c8ae9811a5d45a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4a812a3da4f1bdf543aa6cd96421dbb8

    SHA1

    6ba43617d7baeeaa0b652815b700888c36643e41

    SHA256

    73033caa6f7978482a42a1d98e0c2b511eb479a0ce3dad7c6ff47c9bd8cd9047

    SHA512

    8ab73a794ab651ee53dd34a325a29b0ab4e2e0c95c2398c223aed581d3778588fa9c15385e4f9ba00481b46953d8d2a278fe36402cac3e100729e161ff76fa81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4be876c736686e390fa404182445ef90

    SHA1

    06c4411d35351f49c526d06da2565a40902a1af3

    SHA256

    ca147f8a69863bef741c90f33b1fc215884d9d570c1a6f13ae7c3b832416ac3e

    SHA512

    eaa6d1b7abb4834e4a943984128d282cceeabd256f8b2dc394c56193839cce14762bbeed7157a5ca9567266031e1dcd844dc5886a2f503c75c766626224eb6c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1bb02daa52dfbcac8288253efbea6407

    SHA1

    e87c7301d735afe21c55b3bb009623bb252550e1

    SHA256

    b1be0f7cf96443c4ebcc1844e4ad3ddf530c0649140c1e4f18b68d43f0eacbbb

    SHA512

    796c13cc9bf55e1090738e8ea0dfbb0587f3c0b2f3744064619cb69a15ec283b1a3ac18f8342289624aa23b6a5c2b70f7c3d1c3a6679f5bf077560483d8ebd5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    11a151d15ca092af1f4c0b5ad44e3627

    SHA1

    d0c44f78ad05814a0b2e346f1cedb58ca4fb430b

    SHA256

    d738f90cc9c3be3c92ae9d375489ca93c04a2871d75879b2f5ceb7847d19f12d

    SHA512

    ee125b2ec049e61cd85d1c8aacf1ef2c749e1fcaee288d266d24765a5506304863b3db4013e8143e7dcbda0dd4480013aa4eb57b655c1ee5dec068896e51b73a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f408357a7c47ff2d2d15c09ad71561b5

    SHA1

    45a72742d5f910dbf4c7324e18bbbbde2bb98e12

    SHA256

    ae9d9fbd3331d3f0bb67f924fe0e9f989ac92e1d9be94b0a6db48581b490704e

    SHA512

    ec9aea6c7a002e837dea3828d22be745bec5857637f17ff9556e6edd4714fc4c56fa8d45a68dd50d6da5299591098eda4e84edf1db710e1d225d6d61778b10ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8dafde19ecaeaba8ba10300492429f1

    SHA1

    3e890811d79e924c80120db1b896acf604e1534d

    SHA256

    9d2afcd22a6328275c020dd4e05d87551a781b8a2aa0b2c63b09007cb752df34

    SHA512

    890dd3760ec98195b15218429e73954e708d3e7ed4f7d837a5887e778e4353e29cdb4f71e0a6e2ffbfa927408b932e209b643f398600574e2859698d71b620ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ed0b332473a8931f962789d34771fd68

    SHA1

    85ebc260fa00808f8da4af0507c77ac6d267acbf

    SHA256

    c7fe530f5461c906ed11c83d15e53f538dcf3a67d81e89eff15a9bc9ffe05646

    SHA512

    2f75c67de1550076a0d93f48b52ac750ddc78b69f6212da7732b0f9ee20a4ffa067890fb6eba95e80a13fd865a7d6bfa21f75acd9899e4e2dc4e8d53015956c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8e882d083e145f2547258bf8059b3ce0

    SHA1

    b76f62242aae160f13181763c41ee093e1877391

    SHA256

    0f7581cbfe313786ccded9926d2065591a5ae68e1220af0461a913c507fbfc9c

    SHA512

    6f69016cbad4d40a3800edde4e2ea244ebbedd4a1589e10dab6af7711c452b0589a3bfc1c75f79c6c2cf973e87080e2a1b5b728e6e54c21e99e0c1eafed6892b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2a8f4b97fb75b4c3dcd1cef81dc0e922

    SHA1

    19e076a6e7ce62062971c1700064c1ab90eb83e2

    SHA256

    69cd895fc7c1201e0b61b2c8b16661a1d56f1bfc967945bb01edcae1d6a8abc0

    SHA512

    1b780e72961137f497055936ba25bb645f1fe70743f103de8e7ee2c2b9b38bca8f3977b539e6a00d930e5b2cca71fe2ec51364790267e2d4cd49b21693717be2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4768f20f32dbb720bc0162065807d925

    SHA1

    719c87caaa0e5e34025104c1dd3ed3988cc936db

    SHA256

    a87dba5858075dbef061c638d5c91827b3a3dabad401c2ca8ae86b44e3e02bbe

    SHA512

    bd5222d9183351274c62c845177b899cb236183cdcea6b5130e8008f6d1f6956e5dec76e94b5147d0e78415400f3d6aac27641895ed0f1ed90168731234f07a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    879319a5ae8a2a6a6676c03bba90f134

    SHA1

    23a66add79281955416dfb7add52bef32aaed76d

    SHA256

    66cf23a48bf70e960be79afe6f630a1656a3fdc3a32669575f63439bd31ea09a

    SHA512

    ca004f15a78fe52c69cb74626a95e056453095b56fc3d8c1af7413b59f19a5bff735d912b9d7fe5c5b1fe786df0743f691a6823a50b4e7f14374e7d2eff7b55d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    967013f3506ba568269fea05c3ca7e0b

    SHA1

    6ca89d2047837416345b9ea8f23b0909825d21bd

    SHA256

    7cb2c3bdd1e92e4d62ebd3e3deb9ea507555d5efdfde2181c912e335c47a3d98

    SHA512

    a96eb1fb061f34545b2460aea7da1dbcba2455219f0503d953030777a079a8378bf797ad0cfcfeb63ceb537e2cf76753f80249884aed2706dd1d6cec0abedc0b

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{513C85D1-3D11-11EF-9629-7667FF076EE4}.dat

    Filesize

    3KB

    MD5

    9beb1449e99e64c5ba6d1145634779e0

    SHA1

    918e4c5f54974235d66e397a4d57c480e8351abd

    SHA256

    39ad010db3ce9d773229bf09ba786ff6b0dd1d06ad48b16ed6d792b6f1e3364d

    SHA512

    015b8a65adac92fdae3cdd188d19a53f7e12f42581abbde2541a8a1c964d7a63449706ac8d6c8fe04993c7c90e4dc59c4104e1c9200192011a31b516f2bcf09d

  • C:\Users\Admin\AppData\Local\Temp\Cab55EF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar569E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b