Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2024, 07:10

General

  • Target

    4d48147aff1bb8ab18255b32d11c29d7_JaffaCakes118.exe

  • Size

    260KB

  • MD5

    4d48147aff1bb8ab18255b32d11c29d7

  • SHA1

    a13347c53a0d207a312a9be9f2ef9a6d5bae360c

  • SHA256

    63845f087d2c1e6110e619d02bb8f893d6ac66394ba169a96883d821c9754652

  • SHA512

    0d50f8e212210a9850f184f2d66e1a4b8b1d8f03f31968f4c22e52d897948300eb186316f3c4cef0324dc719706e69b548d087aa5393704de86f57147b2e4b70

  • SSDEEP

    6144:sMaDN3jto7RcPJ1KOuNINpk0gniex+2LQKHKRI:sMahuNOpax+2L0I

Score
7/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d48147aff1bb8ab18255b32d11c29d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4d48147aff1bb8ab18255b32d11c29d7_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=ZvizXaqutWM
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1160 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    316a35778a228023e04ec6db723adcd2

    SHA1

    0fcbdbabcc0de997b2e9259ef6e9005376600791

    SHA256

    7a9d5269aaedb2223c479609974f3ed360303c757d91b071a8619e2b9996eb0b

    SHA512

    f7a8184936c01dac736d675afde1cb5bc82be3ff88535bd13994faa460ad2a2ea9112e395a031050a72db2e88f088260b711a87711a710a26b622a0deff90c58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    426df1d9c15baa799776a31177f23df7

    SHA1

    1948d88d5217bd060f56097e32356be15dcafa32

    SHA256

    dc5d16399d0c529e70e789d383ed517a1e09c095e4d59073f9edcf456e2d5375

    SHA512

    a12091d9e261cf9cfdb83a68b4ce7fadad436eee694e2f0dcef934064d9f0531c5377f0a0c222c2320f8c1695c93613aa3551e34dbcd31ea33c5a01816e49ce9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c389871813393938033b6355333d390a

    SHA1

    025c15e6a8d115103da51d9ed0abb16f5d59e34b

    SHA256

    4c1c8448a2998a0d3e3c24e19695b758959f3cdbe694d9561d01a9f107968095

    SHA512

    86c14b77cc514f30064fd4614e6f8b44bf2f296cdbdd05db6b723086e96c71bda029746456bd1b1ca8c0060194f4c189982c95ccd26f01086d1cb565f82ba04f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6525bc9fee9460c6f08d239d3c4820d5

    SHA1

    a6d3182ca56a09be0374fc2c7ff816d343ee2b4c

    SHA256

    dd554853c5412b84e9aed8b57b0d7f0801673f1795131b6e806a5efc21577347

    SHA512

    5daf6994cd22d765441e65687848e788cd52152f19b612be7308a2d0ea63c1dbce2a444e8617bf50fdd433c61dabf369abfbc793b4acaee539d58f25cfa54bfa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2b2e54f7cfd347bfb20cd62aaaf453f5

    SHA1

    1e94f4868b3395e77c288fbd3c2138d15bcb38fd

    SHA256

    93f59ee4443587552148a09ba5eb0f5747988e877ce36c577309277e2c458641

    SHA512

    d42d0eba3f9cfb0d94ee7bd42c2f769ad4b284888d35e080cf26843bafb0f2d43ab7482d6c5cb03ee2dc5808862b80f5bdeb3d75010fb349151708ec27448196

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e623871a1a037e1141689abcbba9aa4

    SHA1

    e19abde24bccb87e9a8ad7ed9a0c3aa0cf8907ff

    SHA256

    609720270e1e20a15f0e73004eaa09bacafb57173583f9a7759ac2a6bfcd97c6

    SHA512

    17c9ebbdff62c632c0739468de809144dc4f8f16d0fdd9f8d5f51ed08b1c501ed295556d2e2aa2688e68a126bbd54dfdb6b3dad4cf40d42dbfd9708c674d11f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    50dba87af5b566a88b0406a80fb45d2a

    SHA1

    c1d8e3d746dca79c2fd1c38198ee0b7ef1f68aea

    SHA256

    e64161cc19f49f148b3dd1e18cc6d88398a80bbdf58a32fbf15bc1485af51a06

    SHA512

    cb072d4e76064d4444d0da1760170ba685daceed66abeb7ead136e9ef38cd539f6d829fc2dc55afe9fe855cbb0d20555f835a53aebf2e24fd2529c80b3f2a81e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    494ea973677b5ebbf1ab4ebbef0445e0

    SHA1

    2563d98152bf73ff3a54544fa62df9fbc8a39159

    SHA256

    e3e6cef9563d15af7d2dcd473e69d39ad2c929986f532f93912cc6be152f8592

    SHA512

    4b7f1aa1407b802120831cf9fd1cc68545e923397dfa70d1ca1eac9ad5e908118592c5e7ce039d829a95bdb3e096642ed2317958f5762e8bbf2e16b538dec461

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    49973686cfbccad74a8d3ad324092e4f

    SHA1

    83aa379f2eb75b3449dc6b5d9e5fe307d0b912fa

    SHA256

    f19f24ec9e4e85ce28eea99989493371461f3d8d7e98460ae485eadd580d5494

    SHA512

    21dc2a2fc66bfc313004a607df9d14d6bb6b88cccee8b52c02f5a348f186dd420b8b9df045d62cc14668d9ee3895bf4b9401dcbdacd3a424f0dfecd82fb18c4f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9e7e6acf408e1b1109d1ede67a45454

    SHA1

    e162e694db11373598dac194cf2195202e5812b5

    SHA256

    ccb60f4ba4125e47e6995fef7931d1db45c25cfd34ff85ebc0f8cc135e4f7e47

    SHA512

    43b4862dccd4a4f4d11647808e3be0cc72af012d6a9d5fef14a1093a002f081c5bfd529007529143c145ba69b3249d9c8e4118314b1a7fb18b06cf8e87e39554

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9724784a46ce7823cb23ac10f1ece14e

    SHA1

    3d0cb2a44c5c5ac9b15a03c59400846627626109

    SHA256

    2baf30f589eedcba93ce1588fa1018b5b3e1cbad2a4de431809bbd0206de80ed

    SHA512

    270e8d9905d4c4013172771adb9e533d04c068788420349c724a5c102265fe48744d845a0c467e483e3072d9d367105b878f705b8e8a289dc296ea88307378c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8f57b9d8fcf00171cae20268435b5bb7

    SHA1

    2510fea9e94dd9fe59d51d1b4d6c1018b137fc0e

    SHA256

    3325a71790b4b3235455da6b0c81ce2c90c37767244b65744def23ef29fc4f71

    SHA512

    b3320a8480662b94a3425d4568276438a47de8f05130476f9bddbf6ce892235ca13c3947643afbfcccf86397eb0252480232beadabe62404dd2484f74a23645b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b3afc2fd50c4c3a974d01e227492dbe2

    SHA1

    9fd71ef58a8d82c033e3b28b55a50d74e17bcabd

    SHA256

    6d84b58e2e1db0adb325febd078ace8169b51fb01135d6014e6ad9077889ed16

    SHA512

    87cc69505efd0797c19aa7c554ab87e986e8f0ad5c3aa4097446bbfd0deaaa8a4bd8c055ab14a8ca17903c2d4bff55b8a65aa402cf1af04a78d0d73e85b2b99c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    279c8628404b3df4c89ab93d6861dbec

    SHA1

    4e059272b25cd60b60a1ba605ef60a79c8c9445a

    SHA256

    b4f47594c72149aa6256fa2f1b9e20d7bae143340184524b28b0c994e7f09b16

    SHA512

    d7e515402e2c1052180e9012fc1c4ca3bbdbc08a43b81fd7c0696f38b060aa1fea65f707c4dc5cec7181a8e208bae983fe6df465a4707ce080def772077e37c5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    59b92daf63df11da29dbdd3a8ac8a937

    SHA1

    663d3ab8131bc610e516dd2dcb69c9493cfff9f2

    SHA256

    c269806bcf02b768c0bb4f73f442fc109f52a0b130bdfa17e4c6e32eea722b2e

    SHA512

    ff59f76d7507a94c3035c85260f17bf56fb6273d3dd9fd571ca545f84288980372c9b2382d7b1204e36eef013d32b19811095013e7fa3d766238754ba686900d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    946753beacd9b77c03582491085e56a7

    SHA1

    0ce45ca53820a373dbb23132aa85bb38334422e9

    SHA256

    d0f6efa8ba420d2d44465d9a4bad79c18c42a506faf111af3308823228a5f30d

    SHA512

    806051d884947dc2f7c33bc1ef1b25b433e6c3cc37fb37155d35f3c8aa9100beaca9402d4590fcf8ab3b559264c6536279f9214ea664a6757492c26d0717eb6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0513b6ee3509db0c05cb42ef7c6f74ee

    SHA1

    2ee4275e7633403fee771b33aae1bf893d2b37da

    SHA256

    1c745e66b133e2fe67bed9399a45bbf053d4f53865162e12fbf9ab0bb1248178

    SHA512

    9792c7f1f2160f2bf1a37bbfd13a75e4bf427ca0ec3c202a22d2e343bd1da7d3de5f9040d5fb72c20993cb67dd3c419280baf890e59cb29ee3316d9056acba21

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mr225z1\imagestore.dat

    Filesize

    1KB

    MD5

    7f888d658342820548e63239d7f4bee7

    SHA1

    2ba19b8732af2b2795bf146a83d9bdb27a79371e

    SHA256

    f33805d84d5288c477067309ee733ffb3763e99d3404f93215ba24277fc0a2d2

    SHA512

    715caca7f0cd510734501018fbd40deabc71d842ff703bbfcbd6339fc3ec4c9e059fe9250a1fd35bbb9046d86a8e7a77fd733cb034c5c9acd7c665e54b4163d0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I31L8UE7\favicon[1].ico

    Filesize

    1KB

    MD5

    f2a495d85735b9a0ac65deb19c129985

    SHA1

    f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

    SHA256

    8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

    SHA512

    6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

  • C:\Users\Admin\AppData\Local\Temp\Cab233B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar233E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1792-1-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1792-3-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB