Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 12:42

General

  • Target

    2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe

  • Size

    58KB

  • MD5

    2c62e2729912706b2db9b3c6707890d6

  • SHA1

    8760f2de0c8421395f8e4f624d6ad37239214169

  • SHA256

    cc4caa9b8e2cf9156ab4f78b7b6108bd35a15a84661d627860910eed6ea2b7c3

  • SHA512

    8d9165228f2e6ac3cc51fd2a9a5cd374b52a425d7ee8fe75b0610a94cfb69fdcd50002e7b031ba84140b5f05c70c4745ce04c68fdd565bc804284fb4f4c370d8

  • SSDEEP

    1536:BN+Tv73Rs2eSsWsBhlKH15v05KzsqL9oEcscXeSrlAPz:BN+/Rs2elWsBhoHTSKJripAPz

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /c C:\Windows\system32\msdtcs.dll
      2⤵
      • Loads dropped DLL
      PID:1880
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e055058298740b710a38df7525c1741

    SHA1

    cfad1667cdab2e092a773f77e9ffb3c44e472346

    SHA256

    776f3e83c3bdfecfd4b1e9026e0eca765ee6d73c41f620c50026d54f79c5d401

    SHA512

    ba4c6e54d76f76d84ebce4e87508752e93279e6834e877c119c39ce8b0ff4fb1d061f513641fc5d228ee9dc684a34cc7827064c433314cc35c2a2bc6168c6f25

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28b150ca2a3d5ec03da8b15695ef2944

    SHA1

    579a8c8ff43a770dd2f1feea9c2e3e3dc57e73f5

    SHA256

    b4aabdc7fb79ddf60b7d4796506b7bce0de69aebc05866853acfadb23d616916

    SHA512

    ed33a1ac0bfe91a47adfa3874fad57851627e81ab49e97a114aab7efb44e8a07ffce054dddf32bc81813a0f92581386db534cc1d13cf92f26da64bc60c0e820e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cba2a908f1c4e29974d1ebd933968344

    SHA1

    c7c965c9af91a71e12362dfea0c185a628061792

    SHA256

    68ff08ca580caa6690a4e5038044e57d507cc0f15eacb7f23694ae06cb0c5af9

    SHA512

    c08c2a98e7d1b775921042b6631f0d946e55a62a2849ac1b79bffcbe27f2c0d566c83e224588493c66ee410f355be2473bb25d8d6d1ed3e992b0f19e4ee1cae6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    18be8efe63e60e87d8cbc0e2f0133a2f

    SHA1

    f86f2d8b5877c7dec449fe4e4ff17d6cb01f4ee1

    SHA256

    64c6d735369ce2f68d8e42425e2cccc9a506ed00c892825b0d39570dbd37d0f4

    SHA512

    114d0cb2cd64dcbe40e6de56f88c9981d0a14826497c3202f2f5f79ca78a842cf774f4f4cb152de182475a5824d7404117f84fc08035c5b790faac5195307864

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c4fc8c046034bf5511be0013340e71a6

    SHA1

    124178069b198b24d45848dd7d14e9777bb64b05

    SHA256

    4e5d16ff51d8dea367f5f13e32798d2119241d41a96c5c6d20dd18c072e61402

    SHA512

    64d4976ed86391b0ecf642beb2b9cae25916392c713efc9b2c6201860cfcb4e8cb3c5961ae211fa8052a039b0d8003a39779b899e62298e8939690d0009147e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c7ea411090f0a4440573359e2e859ce

    SHA1

    c122ceb91630b05a47de6e12f712c38f35f4276f

    SHA256

    f93077400efee3cac759b74b27519067222daa4a8967fd1e6b4c71d771d62389

    SHA512

    3c7fbbe88a2e951cbd766637cb483caa7a610d88133a693b1241e74f987866f4fb49424fa9cf2454ff2315e7ea93d4703b5feaf2b90a596272ae1ceeb889ba90

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9c4ef7072a339fc67ab48ad41badbb06

    SHA1

    668b12e4da1c2c7b8420d848eb7761c9eb6fb1a4

    SHA256

    b3993eb914854f9cc1d7853d0057d062f64e78437af751eeb0bbf4a8705739b6

    SHA512

    2b64733c40b38e2325f7592bc7f5ef42edd3be17b838f81deb34b8c8b51b4271a1d65ba9b210f6999e6a754870e206528ed842bacd4dcfece42c0eacf1366c63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3be5d051f67d8356639518d868fb54d9

    SHA1

    dba76746e2454ab59665894d3d46fc1638db7238

    SHA256

    027690e785a5f69ac4e6f0d5b8963126a0892a3655b8a61a78d07277ec669ea8

    SHA512

    e6f050888d8483a279cf92be136d97191ae3001c4b223c9e48641302af39695fb51a43f85fb4e158dd87734a7d90d081fe8cd5c100d58c2a395447e43340a968

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6cf83d78ee1ddf2643cd59bfd826917c

    SHA1

    5705a889cad4e75318c9b7bf4daf30edc5312074

    SHA256

    3e17745b244de96dab92b5b1ddfbc678de253e41a7825c07d4db7edaf74a044c

    SHA512

    5575d0dcba1669735451554a34005c60f375ebe1c7f7e1bc90df637c09e2a20607cccf5feb4619de4a43211dcdaf11a46a2cdbce5d7815422279faa6c4adfb78

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dec437fad73b81aba3ec15e75a7afd61

    SHA1

    644d85dc1c610c279d9e360e87f915889b0d6d9f

    SHA256

    4e73060f80a73a3e6d49fa79cfe7b0828af9dc34bdaf6a9cdd2d38a79a385410

    SHA512

    9234b03a271590078f58143a3a8e3ba76f34571bca5f5f8241db4fdb31de4db70f091149abeade7aff7a509c50995987653bb8d80b26a22f626408d09af9d911

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e0b0157a4447d3e742227892190732a

    SHA1

    13dd275dac84241a196e551b62d461f05e8e799d

    SHA256

    18c142ca4ed93e762338aeb43d5eabae79f1d4b8c3473cb2dfc7245db9358fd6

    SHA512

    f48a732df309b5e75d528911149f2d1cf252636e280501036a5ac8991c2b0e440fb0362b8eaf9145ac1c2dc56590d91a8716bedae9f74a0298d1f235d2886d24

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    48dddf4532d531267f7c2a7bc814982d

    SHA1

    8a8ce086af309a872c769f29644a28f0b1187701

    SHA256

    591d49fb8774cb6f64cf9e592d47d2439f6b41e60363957e7932a0c380e9aad6

    SHA512

    3ae130df3b3a344a33cdcd1017c601a3d10b49050b150a938b728b6072b320e1a3df88280516e482e0f33f26f4a4faffda9f6e54e6f970e1dc250573b6c14498

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a0231ac7a325ce0e184050da338895ac

    SHA1

    a6b18cb63ba7df9ad55fed7d1612bbe9bcec5515

    SHA256

    c1edcc95bec29b5bcfc28431eb5cb7a154a582cb5f2b9602cc8389b2a3655359

    SHA512

    94998be4796f655b12f1cfb2ebb4f4e480a850ba00811687eec7c037aee7f79b8afbd42776522052f5e1e4a95d0263b475bdab41c87244628182cf00fd816f13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    78fa61c456635235f71ec087bd51b917

    SHA1

    5e1ca1267ef8b6e9cb196f980ccffcd741b1fc84

    SHA256

    348dfbd79fb7e2605360ceee34cce0c395c141c6c9016b35ec426ea097b04cca

    SHA512

    eaab4e9a584602b03ca313eb50214f758ed7aafc43f83e0eb1a64de021c294c94777c994bef060715956fbd4c7e19ef5b03528e9cd95f5587aa1a06064fecd20

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6406823b8d39d64ed79c8eadfcb4af77

    SHA1

    e4c30d15c33cab6f6bef713a4d0c298b6ea6eb26

    SHA256

    b55b15cb6a37b70164324fe1f130b9f7a03d4c95311ea038890457851c08bddf

    SHA512

    835b9686577c27c85eb254451da872b0ad64c5dfdc2cee5ab1e7ef4bca627cd6a91189fb205c35d25ae2648c92a46046bbb5a61340df9487abac4b4f89f1a48c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4441adb8014b147dd686d957fbf008d4

    SHA1

    f5fbf4b72cd79cbbcea7b8729f4c6d145a96039f

    SHA256

    bc0e270a7ca6bb4b345676853d8f2390546e746c0bc48fd8bf914c6b0402fddb

    SHA512

    9aa65298c7bed44b043a73a949a481914e245af3d63c97b937586b2d17227e1afd571e4bad90e8c3718f37956d3362b95960fb155b3fcb2b1bd14d6a565af42a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5e2ab690d5bd5556d37779bad023c1fb

    SHA1

    dc84f06eb26e5e3cf6a5e02d1fc7b5b9eb8ac4b4

    SHA256

    571f33b0b13f6fc8fceebe535f5bedf91b441572387f268106be533ed3ce17be

    SHA512

    5d1628e23f9f26fdb0835ba3f764830d1d31441325aeea56e007deb6d607edc2b803202476bbec4a2f06d7fbc3cedc6b9564f38ee705f2208a3f542ef210d8ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c02ea19114f8d85b51c7ec54a7284fd7

    SHA1

    4cc845f1d9d22240a356e6c6e5193bf44d26ceda

    SHA256

    e74409406f136383cbddc520f32a45aa1dc9268b11dd93cd2479d94410e15be9

    SHA512

    1e19f6e8adf9040362fd4f38eba2c7d63778281ce328816acc33af8976e2d24b0560f3d8eea6e8c82949e20c6b5e9536194bdadeb8f5c641162b7978e92eb94f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb6b85cbd15b450cf84bc43e3b38ea7b

    SHA1

    7b40231788ce9d8f6565caeb0c66eb37af07706e

    SHA256

    bafa541a185d13123b3bc446095f0e94e5116f5153dc2b43fbb3d52f71a3e227

    SHA512

    de65d92efde8a3153e44715fda283dec356eb94cc4e933c9a62e316a909f262867d1c3e9d6f577ddc21e2c31e7fa3b2e9f3b3e708dbcef0b1be2e08d62781c71

  • C:\Users\Admin\AppData\Local\Temp\Cab28B9.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar29B5.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\msdtcs.dll

    Filesize

    78KB

    MD5

    b400e2f5bfea3024b4007831920c66f5

    SHA1

    bb272523249fc9d00acb08be8b85765891788a3e

    SHA256

    cb5c27a1faf22e11d9e187aea87babd16c93d074dc386111d7b200b8bdc14790

    SHA512

    364b8fb968624e9d7c665584b76a263d4673d47ea664c6d2a13716af72062b6b5d4a33f0bfb823df5e3373e27e329dadd05af2364b2fea6204a29053d3ac5ceb

  • memory/3032-11-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB