Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 23:10

General

  • Target

    4bd0b13dcacc9b8d342b6c0b8a95ad63_JaffaCakes118.exe

  • Size

    212KB

  • MD5

    4bd0b13dcacc9b8d342b6c0b8a95ad63

  • SHA1

    7ba9dd3fd2cb893cc318786920ac25b79e51c21f

  • SHA256

    39260499e8c6cb6df444441e780b557218f8ee1c9dde60e0268e6ab9ccff7a0b

  • SHA512

    201cbd6f19a1a752a588b7a555dc21961a99780527c6c4fcc6be8a9e9953450c71191b901f8409edc9e0379944e9d5836dd4a7190fbcf4ff7122bf5bbdced34b

  • SSDEEP

    3072:Qe+wlcm37b7X7p7HqhQrvUMyaYlmejRQl9DxgQCy1Vj:Q3wlH37b7X7p7MQr3ypTjRCX3

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bd0b13dcacc9b8d342b6c0b8a95ad63_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4bd0b13dcacc9b8d342b6c0b8a95ad63_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Program Files (x86)\Internet Explorer\IExplore.EXE
      "C:\Program Files (x86)\Internet Explorer\IExplore.EXE" C:\Windows\TBONUnst.htm
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" C:\Windows\TBONUnst.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b15ad6f0ec9d2922a2853918dfeb7ca0

    SHA1

    0e6e0ff2c37bc5a164168a03e6e4621a8e62c797

    SHA256

    9be2c77bd5e4293561f27265622e4fd056f05b0fc3424b0759fce2257c1fc670

    SHA512

    a502bb9d7c0eafd806a5201c0a95fb5b631571fb34e6915fef3fb43d0bdd607f40aec7d7225a33b0769c93be76dfacbf77b9cf2283df386643f1fb536ddfef94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c499410116e6d261a132298db35733ea

    SHA1

    d1f000158dd578be3d5c9e58eed4ad294f1be803

    SHA256

    f6b48545a03731e84bc3498abe33e7f5a77128814c8fad6b0782ff06e51f582c

    SHA512

    5c24508ca28a7a0493d269357862042a681df2ff322f685a8589b043382615b4e69e13765c02bca94ca3e5d52bb385015e2b6d0e4c5879c23a6e6e5be9253c52

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1df8e10535b66a5fd3d148a1bf3bca2f

    SHA1

    ca0fd2341a9bf8ee96bd369e76b6f2ecf82e57bf

    SHA256

    d9b80389e6d5b25f35ff32be90eb18a8c8e12b191e2b24e862cba089885f26aa

    SHA512

    89a5718e9009ea17469a9c1674b0632a1f97cc8597294b844ff2efc58ae57753bc234cdc75d6a8656f315fdf67684469872257e061c5b43b1775ed4224a10f27

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9fef53319574a98cd7ea2adc82bd3f7d

    SHA1

    659dd3d6dd2c8fd2150a11bef4a489242f4a48b3

    SHA256

    072b696d91397e97c8b5bb630f6720c0165a92b7741517542e4ee11280a6e1e7

    SHA512

    85375d11f951b88ba58a9240dc070c6447718f2d905dc21579cd18561c630b292f0692386ae1bc6a138b4776a058df8be8eb23c8910579730971f3a414a3391e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6c19ecd187b797505e6429d3b165ccba

    SHA1

    d3676695d9e332166c1e7ffba0d74b1bc636b53f

    SHA256

    a24c3e5c283e31c1695c42527a9b9af0d184a1f0bf7501959223dcfd030973af

    SHA512

    b7bc949cdf1be72a5edec75728bf2677e67122c604cb6e015b7c5a567f35f4b27d93e5a385cf16386d86ebdff85ff9e7880a211e24c373ecb8a94f1b50c527cc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    46277455d2dad4a96869dea55729e98d

    SHA1

    c1c59ce098ffd27bcdf6a8c47f01554a9f760f43

    SHA256

    80eba1230adca250ab672adbb7fdc04cc19b4655b3b7734c6bafd980d9c6e0bd

    SHA512

    ccd0c7148cf93cb3108cf7b51430039e630699b489a7fe38cd78b938fd14832adced58d8b74c372a0966b096e3583fd816f85aa245572fbac413767191275825

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c21f45f7dde193d265ee0b25bba18b15

    SHA1

    49d8ee0a7a75d6e67bf55f08167a449c21e192e7

    SHA256

    41c9692db887cb44330bffd433f4ca8a81cbb6a0bf0e8c1222b86065e4bf2d38

    SHA512

    bed50340eb928b3d3ac7ac2ab8b1a967c7f3afb6bab307a9b2845b4416a2a28da7b165521c7026d33c834dd9afb9c7bec080a99b0a8b0af0028d964f67f4521f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    16480ab27b9cbdfa38bb2dd1ec1709fd

    SHA1

    2d1965b2aff46b90d3f7b9315177f85850c5207b

    SHA256

    98f224736b2dbfc31936efd576c2894fd8ebb42bad19825679df94c4b8af22e7

    SHA512

    6ad2abc77b627e2cd56641f086d9a4e3abe25dbbb0241d95f2732ea5438b434bfa6324b0d72a24ee500057ad506b58dfdc62c1b35e03b157596b3f8a5e81d3d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d5d16874143475116c0d0d716297a3f

    SHA1

    71ef12ec52bef319839d54e02f9847daaed96e06

    SHA256

    02f2b3c5b513abd833980163483a2c6b95a12879b294b4773de6324312ccc181

    SHA512

    412a9e6349f257be8f9a08b82362c55a0e589471c9ece64138d632e9f250cce01d818a4f0c4038be64ca7939a66db2fad92137622e5162cbdcffaaeebfd86c04

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dc519a9caa1f45010249e4d7513b6d1f

    SHA1

    146c993c07dcafeccde4504ac8cfa216e48c3a13

    SHA256

    b297d6fcf26533af6948d6bfcfc60ae5200ef558a7794d44618cb9912b1a5a76

    SHA512

    af1f6ff5cb9f5fc6cc2eeec594e035ec9d69cc16bb36b8cc45151a0464103cc90bdfa2ddec69aeee746331f298b826cdef98d3a2b03566597c1335a710b0f957

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    38b8acbb51f04901322edd42d211da7e

    SHA1

    ed5fd968da53fc4253d4d59c043014112dbb9824

    SHA256

    c9ce0ebf832ed5ba7454edd415ed2c7cff6bd9323be7443973386fb5ca6a707d

    SHA512

    df584cdedb53a21e3d0c1d4c4300a0c7ffd6d2d4a448edf3b9556bd1792b0d875c22d6715eab373195153d011f0b77725c3e81a5ab522b38d3b3662206f77abe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    302ef1e6bb1ee713c2c922e0c5b201e8

    SHA1

    9b6cf95572a8db44ddddd04e492b39253b5c4a1b

    SHA256

    630013feafbb7b7dff863d205b980d16eb85b33e4cb2b9c8beaae22c368a8442

    SHA512

    c7fbfd193d304c3d9b1a3f4d0e99213d018d1185b4afdad7a930d05b01cd749dd7044d213c57a25b042e51df591ca9116e13a6f53575fdb77eb411067da0b16b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f6943af97f647b275e9b72048761329c

    SHA1

    6bad6bd9b68190a9527857f19bc20dae15b1e301

    SHA256

    1d069240b8dc05ff4ebe76e150aa3ac963c0a7ca60a06c0d8c4c38bcc707b232

    SHA512

    eae72355c0f1292ba0bb0f7f23af8708109b814d0a33b763b2df924f6defa643f68410b1eeb0cdd57ce2c8e802d2ae80e9811c09b3cdd9de32e22c6cdd9d68e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3c2c047fa470909b0e3db2dda5a77bf3

    SHA1

    96daedaa7ddb3665b3a2af0ccf143939a4287ce5

    SHA256

    5be0ed1ba5ab58e8fa71a849b134440e9e6f53db8d00ca7392540486839a5f33

    SHA512

    398c1ce1f78bcf978c2dc8db37e6dd94c3e52d2bd254349b2b14caa8cfb1f361f513043ba5e480a54e3013f4ad65e631a81ba33615062dd2686e329ca7df8136

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a250cdebaa37f740962ca9fa14f42d2a

    SHA1

    a79bbb34408b81d094cc94dc85d977cd9f385b9e

    SHA256

    019497b22f3799a7cbe1721e8540d233fad03a1aa2716a15ffc321f55c1da895

    SHA512

    4cdf53476faa3e2079e34102a9fc6b3d466e782bee9e7065b3e40f476ac1dc2ce4ad7487cffc8bedd34b5bdc5ffdd12b571c05000d07f014b2cb03214ebd6b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dfacf1aca391e6c4167841731780c139

    SHA1

    dc9655c3bb017f3c84c29bcecbdb2be66b98aed9

    SHA256

    bdc7a080568751f13a914d99d38c4d3091c1f2138217eca8d55a4d6575628975

    SHA512

    4a4811cd9ed80fc642dd638f0a436562f27ef8aa104345397bf88d6e0098bf10584c4e1c70bf4c15fb48d6e5429da981b266d7b40330d82d2fa94b2801e9fade

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    792a4ff3d83067ad811c99e82145d411

    SHA1

    5620fb6b0a2cea2efc745916d758919e3d6af5d5

    SHA256

    5325ad42d4d48e2a81754a4b0b300d14d18f2fa5ef3a00d43abc36d1eb67b6fb

    SHA512

    250247c6407839b7a66d0777a2d218659dd15c9721eff4f65b5af2d517ef7f766d1c5b7e1cd99e8fe51097747ec94c0ccf5f0daa61cd1c8d9a95aa83d5d63701

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    35c667181dc8f9fdb38e23f0dbb9a53d

    SHA1

    57c2dda741220626e82fea51f1f1a96e4285cc9e

    SHA256

    159a670c0bfa60d68e2721d0b65945cd441b9896d55cbb74f3d477c1dfcb7062

    SHA512

    cdf060411238848c22cefe9683d4275c965da49098951f28070ff68d4d854dd29c371b357dd5fa6d417a30c3fbeb62d2469e50be6959ce9fc478cb24a2009e09

  • C:\Users\Admin\AppData\Local\Temp\Cab1892.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1960.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\TBONUnst.htm

    Filesize

    3KB

    MD5

    add6ac2bd1c959696eea2674099bb40e

    SHA1

    20e01dc4c096cb02856179ac8bd1404077474982

    SHA256

    e664244157dd756584d7ff6853993612bf8f6f3b79f3db7e9bb9f2bff85aa29b

    SHA512

    34018c7263eef01c5ae8e4972d89439360fb4e9b52625651975be85ddbad913687c270e770e2bde1f4d0721037f04b9e1b484b569cc00c9a6baeefb1cd2399b9

  • memory/2488-2-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2488-0-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB