Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 08:57

General

  • Target

    2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe

  • Size

    16KB

  • MD5

    2fbb1192373c4219baed34d251d1a532

  • SHA1

    d660428452a4d95ca043df222fce28dfe234feaa

  • SHA256

    0134cadf86b4631844975aa0b1a0cb90156381900f2dfea99e25c0b0c9e5d0ac

  • SHA512

    aef0f3033af058f5d17817d1349a739272a0e5c3d4393ebac05a309f10c4f8851a6fce4da5629d11650fcc12f30f40869b9076726ee6af1c4d271e64b83316c7

  • SSDEEP

    24:eFGSpNtdi9ym230J4w0Qb0EVM208hElHGSYpKV:iddGym2Aghr7YA

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" http://lapublichealth.net/a.html
      2⤵
        PID:2744
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://lapublichealth.net/a.html
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2708

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      13b7be165948c361c1cd9a10cefa8db0

      SHA1

      39e06d6f40f36b6942106affc7f1887437d52359

      SHA256

      595756d42ae8349f710ae286bfaf74bc4f6eebdb1579ce26fd96de5b7fe4497c

      SHA512

      0d1777c8dc64acaf64aa6a7918d97ea725a5bf2abe58db6e5a6c9f9dbb556a84a6b4836baadce0714f0db6ccd41c4a4cc362e10d5265c03cb2afda56bfb713be

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bf7b044869c8fd462560c3673f145e14

      SHA1

      4dac320225e335e19dda5e3d5efa05ab627f7e12

      SHA256

      d1cedd2f4233d30a4072f7b6856374f0119743e71a31d6d915ec3bfacc84c8a0

      SHA512

      c4e1e0adb42f54d3f3f01748729b2f7b7a475595126a9dce76428ab536f3ed323bb77249c4c1b2c77b59192e0a282f07aac32436f27c9a9b255278364a68b9c5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f83a3422f2d06b7475273afccba453e9

      SHA1

      f83714a56a6c67fceb993d471f477c8506884571

      SHA256

      1f039ebd22ee3ec4ea5510b54c6877689cffd2c8fdd6dd5178931e64bf42aff7

      SHA512

      e3867a7effe92fb7719fafb059a85d37a4ebdc6f126153c955c608ea43a63f3e7c5eb782a8c3d4507329dcadc4ff2422d2cb20877ccbd7dc035af2fa1dc04d4e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b47ab58d64e55ba3f8bf6ae2ee19e777

      SHA1

      6eb78247900372ff9f6c54b29b014b1a382ed445

      SHA256

      1605fe85242f454e12f1dcd417523a311c1e69c6b0a81bc658e0dee1c3c69120

      SHA512

      a6bed49512880ede9fad1c222da7c2bbe2e4c32ceabbdfff11639ca9c91cf8cae1e0692c4c4140b5d850299775453efda5e885898c90ac3ebc424ade9a2e4d9e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      448207c5ca057d1f1afd2b089e512afa

      SHA1

      91d26e0748778aa23cae4c255fb163edb1dbba47

      SHA256

      ab17791387fe6a14e39e4dbd9d25977d091ba3e4be7d5791d4f7059eea6858e8

      SHA512

      3f00c00d967a18abf2c53f6c6f58c56e9496dbb943857a5f3220210ae12f778105225bb7affad999cf30846054f7bf08f471b5ed86c178cef4826d7f7ebd5c45

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      153f460e205ad72d4cabb472314089db

      SHA1

      a30c4872ed8e2db8dc2e75d38dc0cef82553caba

      SHA256

      29fa87d2a49c8770490bca588a38ef7a13c6e7b5afc024cc7a0da46e9e8aff30

      SHA512

      e440ccf5f7cdd39cd673a81b8d957b0f8f0271a33a5cf599d7cac358f943d11293c055583667de802ab333228b70d84baa9e7dbc14ab50c7f007591f3ef36342

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      02888cec96a18096a20b44fcf5384310

      SHA1

      a0299af089bbb21afdddc2c4ecc5e3cb2214f959

      SHA256

      ecc0a906568387afdee75c90acce6f0eaad2f32314b13d38e6411b3b4b0e5c0d

      SHA512

      8983c6d6cd276b96a668c6172ceaf118993b9d9112ec174f036d984d516c9cb3bd9807029ac024a95add9b5898fc8cb91a18022894ca062a494f5538f240435c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fa2f26160e0fd1621ab6fe4cc9a5348a

      SHA1

      7b476e488190149e93a4637f59c86b35b8744728

      SHA256

      faf2ad43a3c9ec3a599bd425bf252a2701092d9f01ce10aee682faa6830cb8f3

      SHA512

      7dd1acf8ce6cdbda5196abd8348d536fba249ea4be683e75bc555a6a104ca0b2e6472183bcd961fdbf5c3f6d01e7627b1ee28af2c14be4b585afc46c4baf1003

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5632a4ddc92669ff29a92f44e7902ff5

      SHA1

      9be71840cde21e075f7a42e08f5c147824ab5718

      SHA256

      65c029b5510a920e91e82cb9b9c7e4716ac5d607dbf5972027cb70dc81850315

      SHA512

      cf7461c5d7952053c6a8a1fcd712529c014fdf7a2428750bf08c572da27a27c4f7cb59fa6e50c7a576b431a72f156de694a5752821f50db44dd7466f02f4e42c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4867d65a0d61dbe377738b6d377e4630

      SHA1

      376000ff3e8a8d655b075aed4fad7ca82ac78f98

      SHA256

      a796ab00f2ab0c9af9a77af6cbd46f9653b9ef22c1d5c236ac28a245f2f459ef

      SHA512

      322be716cbca0eec3e072b410b7a770436feb0b68c50950f69a58f36e2154f7f1b18a16853ba32ebbcfb10d3a9df597c857bffa1e8806680a7ef899f2cf8fa06

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5bd23ce1dbb11b260eb1b2b762c738a1

      SHA1

      eb88f02c3098cb62120253a1bc8c435a70a87408

      SHA256

      ef4d6d3fa922acdbad06a251ebed991f8db780a46a8686a52bd60bdf9650cb08

      SHA512

      0987cbc8a91388299d4691bf30c4ce85f9445c7c99083d39135bae73023473af8f87dd51c25acc3a3e70773739bfbabf6f1992238bf32347dd7aabdb13b94c50

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      beb21894e2035108efb001629a40380f

      SHA1

      8c310899c469ce7bef1d779d5752f472f0f54d4a

      SHA256

      0db18ed4ec9905ddfc6d4530f2520911094aff45c3717e1b3dd608e4b39f8f17

      SHA512

      c630d709d3ceeaa88ead260e51c5cc57fd0b5af3b6ecf041190ab3ef23fb87704b267e74e2acf38876f1bdaddd149751fcdc996ae18a60ff120f155b4557cb9e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      47fca8448628447f89b1ec5c83c85c5d

      SHA1

      cb2fa5705385b92858cc2c6288eb87d2bb477248

      SHA256

      8db0c687c0f53945188e4e1e51899864856166e4456f1685322959452e8af2f4

      SHA512

      c0a6ef6ce62d2c1ce79041705bb2a2be926f579aa229aebee28358c7f2516308846aef24968ced3d52342efa7f191aa41c0f07ffc6bf1f9ce811353b182aa779

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      28bc36857cc7cd46235449b08b1b5cd9

      SHA1

      89a0d7c8b85c99b08e9304c1230c3aad8574c2d2

      SHA256

      fdfa141c8bfd5ffa29c30903703eb737e32adb1b069587bee37a6dfa7c715254

      SHA512

      f29b0a6e34100bae14ec9e70f7e15e5e7b2d05d934ac20a06d03d098ac589b93a0d0ecc8b1bc409a68d12addc0919008af7a177d9e77a36c248656f7672ca381

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e2b3479527329a4882f6a8ce14ffd29d

      SHA1

      2521c2c8053213a7822942ca3c5bf55cbc2dd797

      SHA256

      51d62335e07d09dbbe8d2718ee6152e97e402edfe93bc7ef3bc2372c6dd1ca9b

      SHA512

      bdc2243366382f97a93fb73672d56029c78e1304c00af0bea25cda86ae89dd97bf61bb3db953141f92081e42ca54c74b0d52aeec16f0789da69985b87fe8cee4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d3e899ecbb9d5877b44c61798829d27e

      SHA1

      13893b2e04262ed3552e87392ca863ea65670cbc

      SHA256

      edc184c16174b78a823401d54f9994298ff59cd04a045b36dc499ec50797e1dc

      SHA512

      ac75662e5f7df431f96b6fdef9c37d161f5877ef53933283696203db82e2e04ee7a701edcd4b51a9694aa88008c12b2e24eae477746fd7588217ec1bd7d4a2b3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      446acc548e1d0789809123ddaea41956

      SHA1

      84371e30a951f6dd3fb843cee505109e446b6ff5

      SHA256

      9601168dbd2156b13488cc1330eea42895b64db24024ab3dbeb6abfc607c962b

      SHA512

      f0fdaf86a7c3ae7af0d50531ed59e8b72be00c980657523ad9576e78b66a8cb3f46a4c7548f8bcc91e3702bafc3ca808f9b67fd7f3c1472ecbb1b8f98dd8e0ba

    • C:\Users\Admin\AppData\Local\Temp\CabBB64.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarBBC7.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b