Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 08:50

General

  • Target

    4912ca6a963691f62f3a74d25d7fa237_JaffaCakes118.exe

  • Size

    3.9MB

  • MD5

    4912ca6a963691f62f3a74d25d7fa237

  • SHA1

    ce0cc570e2bcd8e7ad059c6c2bdeddbbdea0b26a

  • SHA256

    d35bbe3e322b2118382b8367d0b1418df848f2564617dcd3db163db13669a975

  • SHA512

    b77b4fbce401acf624471c1973383666534103be71429c76d6357439d9c2534d47aa38743f04b85f870f3d61155c1ea9fbc57bbb90c1368c41979bf673e83526

  • SSDEEP

    98304:dpLnkplgYTHgAcjqBirPxgRC3IlkdV0t43o/59:agwgzZrZcqNV0FT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4912ca6a963691f62f3a74d25d7fa237_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4912ca6a963691f62f3a74d25d7fa237_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\data.exe
      data.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2084
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://uusdsq.uueasy.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2732
  • C:\Windows\winlogin.scr
    C:\Windows\winlogin.scr
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\WINDOWS\SysWOW64\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      2⤵
        PID:3000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      278234e6543b6343a225a644487575ef

      SHA1

      b6dba4953d912bd9d173408ac433c7c049a3cd58

      SHA256

      a28448b4462e6ff180ff7cdfbc93201434587ebcf85ddce4fd64b5f827a6cbec

      SHA512

      8812c0fda0812ab264e2b20b9a1deaee3d2ebf8ffba2041bec17d053b76af7e9041d85fdd6e5ec34bc6accef5868f36478523f7dfdcf2b358f739764d6dfcb59

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      871c3a8eedce4a94895691b05399429f

      SHA1

      575b476ad2ff4a43ecbb1641af6bb0e8e121b1f5

      SHA256

      5e4bac609fcee63e5dc64eb5970cc0df8c3f375a495173f53a28028470fcb4c1

      SHA512

      041c2e1056b66ff825047a2cedb05ea5353d1eade8d728367a2a6cf3abd3c1a079bb1c59400f21ccddc215f30ed339892c368e9d1ade6f896c4ac1f17a991f36

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      276e94144522ef93abf0b9611b7111a7

      SHA1

      140663079ee23c5b1393d76daee9dc9c131bff60

      SHA256

      51941d0323f95ef52b8ed4060841029d8be52226dff2623a4929fe3ea06b64cf

      SHA512

      00087cfe2aab0848551ed305596da1beb476f577d1ac0ded0fd10752962e3438c79407170aa446427ff1415c0b953f1d94b3ec26630969eb5f70faa9ae6c5f14

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      fedf27ff406b7032b8faa6dfe63f9451

      SHA1

      aa34bfac719934606abe2780eb2d14cfb867fbb5

      SHA256

      01b2da15345ffa2495a2c7fdcfe7beff7b217e81c1d0d45326646494e8287300

      SHA512

      525cf25d9adea3cad9070a2d90eea43a0a00307745722705089504bb79eca3526ab121af328c578823689fab519e090368e2bd37be0637cf0ce7cde2dce4e62c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      70746f2730bbc376e79f33b8ad2fa053

      SHA1

      309b29a68e2f7fdd73db5205be7c4b9dac14f4a0

      SHA256

      77e11b15abe3b7c3b5696a2099644df2a6ef3e2ecc84dab540aa93d39d6c10f2

      SHA512

      19ddbfad55a1b34e4ae3b69a8c395e044066f35be7d321cfa01ec9020aecfe8ac310a07014abcb7ddbd02154d74be945b2765273ebe7204095f0b2a1510834d9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      177f7e63a3fa20b8533a10005e83938d

      SHA1

      326663c20e13cb6b9361e0789ba63a173432d8af

      SHA256

      aaa2226b170fc4c05775de47f7533c1bcd665aa8dcbd74024325a50759a6169e

      SHA512

      bb1fa4c0f27f1960f246ade88cec360bd09ae7f471f5212661d6678574ae259f60c86e5587cdcf8722991950606de05ffa94f01817e8ddb1741b8d189c96688d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      f891b8518645b74fee6d2bad12df8b8f

      SHA1

      54e69511adb573ab628e5a0c6c5a406cac08b942

      SHA256

      4f22feeb493e0998ba975fabbe889e959237e4e551422f1ee746c689ac8bf09d

      SHA512

      47fb4caf172a2bc6ce58242619c2e1942c02b9e67d01ccb4d524352056c7cad853e8ac55bfa939af8ee7cdbb1e70d9fe85d1840493fd1cbb0f64badb1d7f471e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      a17c78156b5129511da1be675ae63b2d

      SHA1

      aa982f524853a0cd6ec1de9fe56e24a632fd0e8d

      SHA256

      24811e9f73f126294bb70a451a8ed40f55587c29e27ea64b6e7abe1a27451e42

      SHA512

      2a25c161c15cc19a678c8a3f2da6e70ad5bc0b4ab5a72512c4b13294b196cf38047a1f9940b6f0b64364b7d164ef7586f4c25f139b061520d83f63e196b85d52

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      ff000fef3b1b7ed3068339fc20ea786f

      SHA1

      36048b3a404b8c9e806a607c2104b5070f60a4fd

      SHA256

      51283faa7815200b055f42bfb34637f6c4c7cc2d2441b01411d2242370f1fcec

      SHA512

      9028dbc408d30def36aa9a85b99920baabdabc2527efd391128345ec82e50823c466a19b6bf9dd4217477b112609f3aded2e787caefce72a8fe4896114f60726

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      b147b90ef3cc04c3d0906bf9fe5cf627

      SHA1

      71ed754b3a7742894f5cb0b42e963d6d930f96bb

      SHA256

      ddfdd989a0c3e059ad17cc1ee5bf489280f926a8dac12810f2aed5ccf3c124af

      SHA512

      6d503e2ac9e77fa08e29d5ef7eb13ebfefa8f5712bd9878cca724b64c2af8e60214a28ef648bf2c355e7bdac6acb3f18327249d5092f446657072b324d834674

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      1fc887800d8d009dd7a56ae13d998c1e

      SHA1

      bbc3246f16ac35a3c1e510df344d3f118bd4a5f2

      SHA256

      416067c8c2ab1487b915e09075f256d5a1c34c63109695e304d3fa1c119a7aaa

      SHA512

      5d6affc381fcfe80e988fbfc7a65f99b5ac744d6ed74a1891a1839b0c7ff45d78f47bd3f4832b580f7ccfd720b1267bbb6ce6edf06f3013c1a9e901946c519b4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      e205c323954678958cf68651d0d6173d

      SHA1

      6fc19ae88e819df5a65e8c5ef0014127a4d0c15b

      SHA256

      fb5196cbb56cf3dd47bb1ba104c18c70cba94ebae00c24b2b5483cbddbc1c4f9

      SHA512

      b167b0b6d2f4d41e35a47abe3a0cf2efe00a1976b65f80293faae089b20ef2661bc4ceadefd339773fd3abf6699462a06d8f10aebc91b416821a57bb37a72df6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      1bc53c1f00ae79a87281cfefc03e9822

      SHA1

      e6c90486dacd44a2936b1efca13673469688b2a2

      SHA256

      398bdf5e2f9e3beeb2b7f353a182dd1375d69f02d484d6e7c09de14683054e15

      SHA512

      e0cbf189ec9c9039155e5d1a05f1ea7841cb07eaee6b10d8441ade503990c91391b31efcff7a60e9b2af8a9c9af213a9618dff5588a56b157e259b3d9f560276

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      b259bb03539b7e3cfad8a0a9a8f5fba3

      SHA1

      72f3edf65a1655740c7860daf1d639d3baf89b1f

      SHA256

      49bb7f458268fbf948139d3478a048f0b4cbaab0bd37da3a60b2806c5da3360b

      SHA512

      d55faf359a0d48279cdf0b5f5fd3a1919b257349015b4a961ac4a72e447895dd34963b9c337f6ccf8a4f8e4c2ac64505f4f2ba3e04b4404e6095362ed3727f10

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      f0a2f626d24686f33abfb482045c1d79

      SHA1

      04b2a065c03fc1c050eae70669d0e3b4a1b4f7dc

      SHA256

      0de1e2cda7301b6fe0743d66368e89db81f64d938503336a67665ca99b540497

      SHA512

      2e9782986ba6d818d83d17504cb7c786e6d327ee48c8a30afdad4d5997adb13e87e4c0d3cece1388af184b20cda65527b8ada7f935627423722c7f06597e06ff

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      526320bcf25ba2c8c8a11dae179021b2

      SHA1

      ad01d3a72111f96641b117d9bb952cc828bb050a

      SHA256

      cacac909f2cc17baa2b3fcb6dad0e983fba0141e1f80f1412a850a05b30c0417

      SHA512

      202bca55a597cc40bbea689cfd8def0e388d2d59ff90996455ea6eafd6fc02e9fb5572e8e85a7985be0cecb0a9aaa0add736a1bd1586bb597d939622fff14b25

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      3c66ac50389ae88f6c3d779342407f43

      SHA1

      82f44fc89246b55e672f4d100e2db242750805bf

      SHA256

      37ec79723d9de29ac84f96116ec74f7cfd8900929b9f954cf1d7bc1d09480d40

      SHA512

      1de35433376a47d527bcc5cb74aa1699792cabb266ae226557f449e85e2e289a228b39d236fc085864f0e871177d34c875e3b37c54cf0b964adaeae0d4d18999

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      2871b27f5bd5b8f1cb30c8d0ea2b2e8c

      SHA1

      d4a6000ba2aa5cb944e0a71350265ca05ae7622a

      SHA256

      a27a394a1c79537708037b1543dc133a30b1690ce2070602801f6a6609b729ba

      SHA512

      fd09a1378ae518fea944aef010d9054d8652b84ceb3f095c6a840a4db43206e809ed931535bd426316e7a2dcbf283f4ce29e22f603f7546363a48caee4f8032d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      3f8b1254f9dbca013adf6b8a22c5fef4

      SHA1

      a26887e6df83556558d86f74f9ee8672dff4b645

      SHA256

      ed6a6064d4c68857cd7638561f2c4b32ea7a0a8145d36c5fe56afd5f6c7e7110

      SHA512

      fc01908edef3ab9b9f8e7ae2a76bc213754cc2b95dd73db092d30101f9a96298f8f905bb990fb4b2a53e3be06ae78e51d01a7c649cf097f9bf9a7ca65b3663c2

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\favicon[1].ico

      Filesize

      94B

      MD5

      514eb157c352678fe6e6ffb103579bfa

      SHA1

      5892249a4b53845b0761623aefa1c0d251ccf7da

      SHA256

      5e0f936c52cb1e65ccda6fe580472f66166fa4687aeb931c2f0b25bf8c858daf

      SHA512

      91832b7b508d3386e65bea57a42c5b8af73f5cee55efa0b05ffb8dc9a60473cec718f2d28a9d8c7420ae92ec6ba43a1df598541571ffed4726a61fa4b8703edc

    • C:\Users\Admin\AppData\Local\Temp\CabE0C0.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarE160.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\data.exe

      Filesize

      731KB

      MD5

      f6a3c5801367424e9629464fea1cf096

      SHA1

      aeaf7afcffb3aae1158e8b51623909c905dae042

      SHA256

      cfbcadb6594e5e6e3a419c550209dbb6aee4ebea85c75c8d42fe8e5989d7a3cf

      SHA512

      e3e25c21593c53b61d6244a555a653e433a4f99ad9966f005fed4197f213030abdc9b3f707e3ee89c2e3245d215c6a97e1059ad64bbb729a48586d7e77b13ad9

    • memory/2084-11-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/2376-14-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/3000-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/3000-19-0x0000000000400000-0x00000000004D0000-memory.dmp

      Filesize

      832KB

    • memory/3000-17-0x0000000000400000-0x00000000004D0000-memory.dmp

      Filesize

      832KB