Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    57s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 15:05

General

  • Target

    681148ac866ee08182ffe71934df313c_JaffaCakes118.exe

  • Size

    135KB

  • MD5

    681148ac866ee08182ffe71934df313c

  • SHA1

    cb025f81ace932cfdc46e70140faeeee030ae626

  • SHA256

    83f5c60633475ae50b42629dea84314f74094c3770d72329af762c1cc74680be

  • SHA512

    a3927f29238dbbfcde3d091146a2b094814a9c170ad89433adb78f2ba6f95e789b14428cb7dd87303adbe4ccc528f656693534c081a0ca504db96a1a2f905296

  • SSDEEP

    1536:I0Y0qkc5IvFz70yiVdqDkhSchSWiSDWP/OsWQH6CazASXhXSWLlWT3PmcsYN/Xzx:IMqQFdiVdubWibOQNi3MWL4FksNYFfPK

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\681148ac866ee08182ffe71934df313c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\681148ac866ee08182ffe71934df313c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\SysWOW64\cmd.exe
      /c start http://youporn.ru
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://youporn.ru/
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2688
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\ProgramData\Media\rdb.bat
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      PID:2004
    • C:\ProgramData\Media\plugin.exe
      -wait
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2196
      • C:\ProgramData\Media\watcher.exe
        C:\ProgramData\Media\watcher.exe
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • System policy modification
        PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Media\plugin.exe

    Filesize

    135KB

    MD5

    681148ac866ee08182ffe71934df313c

    SHA1

    cb025f81ace932cfdc46e70140faeeee030ae626

    SHA256

    83f5c60633475ae50b42629dea84314f74094c3770d72329af762c1cc74680be

    SHA512

    a3927f29238dbbfcde3d091146a2b094814a9c170ad89433adb78f2ba6f95e789b14428cb7dd87303adbe4ccc528f656693534c081a0ca504db96a1a2f905296

  • C:\ProgramData\Media\plugin.exe:Zone.Identifier

    Filesize

    13B

    MD5

    38de427224a5082a04fe82e2bd4ea9ec

    SHA1

    7e4a53de1f83762dd2febd39b818e2258bc83bc1

    SHA256

    12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028

    SHA512

    ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf

  • C:\ProgramData\Media\rdb.bat

    Filesize

    97B

    MD5

    5303b5018a6cd19200b98d31ab04f25d

    SHA1

    8285eb92f131111e40d2dc864d3b386dad6b9129

    SHA256

    464648d492af6bb50cf65ddcbdca3e90d4b224ccc6f4ce3944d439b6c32da524

    SHA512

    654aed00850f6b7e424a5ec5acad086a51fb54f5f944238979f43fa1aac430661250210fe5f38dcd78e46311adc7e6b282cb5c41bebfe5a7d297afd6db6de21b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9ffe7229b044ad7248d0d04129b84940

    SHA1

    99a8237c5f91900cbd8bd6e72ea5a1d2e33958e6

    SHA256

    0bc968bb8e07e09bf60d9dbc951968ffb26a74a642bdb4dd5aedc880431728de

    SHA512

    7ccd333866ae6eef25e8d4ecef4ef648b3ef6f81756e4289546b96925c85401f93e50ca5a66e1d56ab8a645ca4d46ba0225692c454aaf2a55152986a6d514a66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    02379759ddd4019d3bb10c7ea8d3de0b

    SHA1

    679c0751d111147383b5bd2ea7e7d24d853cfe75

    SHA256

    3665a3d3de8e8b421bc78cd01f595c47ed141b36730eefcb08f86d2f27042722

    SHA512

    3d958ded10edbcebdc8930c73e3f8e05edf01d8c765f657a64255d8487e081b87339f51fa8968b0e2ba36570f953e28f832cafe3750cdcfce632e18d6c755334

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bec49b45cfbf39c4336d818b9fe4f0a9

    SHA1

    1be6b4a0c2d3a862956c4e9531d269957ed163f7

    SHA256

    e12fa7c06ea9b2d24dd4a6c681b4fbe2e75aa996576f4468ea5118648dcc884a

    SHA512

    7377b11f4d4439204b5239f70f1418a3dc4636234f2f24b40025227b7498ece2f625f534a0d64961c2f454bca9854dbc81e79a1ae86c65c1003978d7806a8d74

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2be44c34bb50706bd0d826502daeeaa1

    SHA1

    ff8599823964e5707233273c3923bcc4134d307e

    SHA256

    467ad53136c0b49311c2a572221bd522fa558d825585b21d5bb478e2946784f0

    SHA512

    c4f50c4e30e53294d90f9c5235dccde02a5fb5570c2f67ca3b3413e118dd8679e18f505360ca34b026a2adef7bdad1c0067568820d4759150625a53330f4d098

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c01a37aac3b7b97def8766c664dfede

    SHA1

    d2777308c5c2b07229159136da710b5108ce4606

    SHA256

    c353776a47ab577b21b65fd9b5d6c7234aca82c8922425a40d52682616ba68d3

    SHA512

    3eec718c96ba14f18cdd6690b626994b9e6f9217f525a68db6cc9e549553876ca469eaf8b1f32c348f409d89e53d9c4b42738dc004d29ed3b958a522abf2816c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    10390fbf2c6b92fb098d5bcd13f43e6e

    SHA1

    7e35ab93b17fa1faaeaf242f88eeda6b008a78a5

    SHA256

    0d23c20198ffaf539933a8bf353d2722077bac9b27b5373f6d93a8095d4654a0

    SHA512

    b243b4dee1e9b9d5124f33eca7728b8f6249e82c671cc8ca693265a96f890fcffc791a9a11add9e2c020a7e557467b3c944c82fcbfde46c0343d26d4601d1606

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee858d9d6b8cc5e0f4404a2f8b23d1da

    SHA1

    4a7e773200c844f07713a0a0c228b9c243aecb89

    SHA256

    e26eed8db7ec247b3f3331e1d0f540842ceedd3504823c9e4bb4731a416d40c4

    SHA512

    486c61988d1127efdb883cbeac774b2204944f1f1424e9e43f4588b0644d4c0e9fa550293a9c51cd19b398b4e395ffcc821734b76365c7d9e6d7363de9e14e29

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4054f2b1b82dec3d844861ecf77f6fd5

    SHA1

    ac3c26eb9740774b1c3fde8038a173ddbdf1409b

    SHA256

    eea3e78f15d5eac34fb8668cd2fa48f35f1cf66d800a2260478802caa18b5b39

    SHA512

    196551139854d7693f7139c397b80169e3eac96c94497aff0ebb685c52365359d298a66a177a784cec65a155b181419732c237cd43f4db702ff3217bd97e1cdc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    640599451d9b1861d4da50514bc7d993

    SHA1

    96882a5f98cd5e9e67c3e3b005adef7e26d1d66c

    SHA256

    cc26c915bec6bd07ad93209be8448d5931b8e64fab39e3a9044833664d35917f

    SHA512

    157ec498c643f19fd3a2d2e1bb699458c6c81c195d74e74cc362ea3f7e96be41b308067814ab2a45e892806eac0a427b508aaadbfd357ef4800a0d2e5d4332ac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c6d5d1626e3aec49b0025e89232bd1f

    SHA1

    68629d6d1953ce4d57509f9f0dbda3ac01f7d572

    SHA256

    ce897c5eb663418c265e307011614ed5a3806fe9309466c62aec5c23d0e47666

    SHA512

    9d0f6019d993c2eefee3d202f335040d219573c66ddfdffa00a4a83eab55a8a8ae25b6df18d678f0711faad3672e4885d640f344e4beeb04927440759de63c9a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dd51202ce2a0b1725c677c3eafa744d3

    SHA1

    2644606c68a91d2bf9a38e8354981d9407fbc698

    SHA256

    e666c9880c0191c7990c4edf9e01b53daaa221092a413df0f02ce14db344b893

    SHA512

    032272269a5ac972893bc8d9ad61ba4daa9871aedc7eed56573d43a3934c0822fb84c118a0d15fcfd786a859e8a37a73b10abfe96ec33e3650ba480f48530002

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d9936fa34cee6990d7e69b7f2c2bec7

    SHA1

    66a0fd52268fc22f5b9b0b6b28305e379c927c72

    SHA256

    7ee2b2076614aeb4ebd0b08108029f7b08f4726b0b7a2674eec5d6d5899dfae4

    SHA512

    51cacbf2fdb6f1a81fb623eabe2cddf72c1b2bb4a06e00bc1e8c764671ed1c6d9092cfffbce5e614c6df8f97ba20f949b9e5547ebaed7373bab513ba2a7a273b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3251c24410d766821b6a982071d96a7d

    SHA1

    18d7af51fd4c9fa1f31c44f80322abd1bfe92d09

    SHA256

    162093a48a90dd4fd6758b9dfd6989b29750734af7c10b0a51e6542c6b797d17

    SHA512

    497f3b35503fa02604ff71f01425f0af57808afc33bf787a26cc54007182ff8666a34e5fe04217aba183665899bd9cd6d760123b51ae63b34ef56f1bf217c781

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a71e1ffc18d25559c54b841197443f47

    SHA1

    2e020530aa95fbed8e9ab114f47fa555881a2546

    SHA256

    5f807288984afe62c52c35289e66bc5749051e5f0da22c6afdf07756f718b287

    SHA512

    ebb92f5c388dbd907dd738120b7f51dc902cb177997239568a9ff1dda5473129fb5b9d87e5d153c57d4264a0f725df5bab6d2478ec955bf97e1c155bbc82f03a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68b04e9b32dd46c8052aeff7c1774825

    SHA1

    a5a7a799a48a2e43d7b8a720c98a3e16606543e4

    SHA256

    9d341aba7b624af9070d47bdffd4415e04430a3467a703104dd6a7bd57590a73

    SHA512

    56acee4408e1834e23dd17e520b7e57ddb02feb42ebdacf10610c3e8713eb4e0c02026d046ff16038f1faac24f8a6068c5098b432cdd92ef6233cdef7c2c1ffa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b95093a985437f5029c7e5f65bffdf34

    SHA1

    81e8a72aa08e53c798dfd4dceb4d4b38df7bd09d

    SHA256

    99fffef327dd31d7ab1188347637bc59a88d1cc5f329e480f2749529b56fcc15

    SHA512

    9c89c28f24d9a3fb5748e36b7594c9356dcbc37aeeeda3d721a5a4700f1306bc3a1a1f3f4872544096b75fc4d0172a8de7734d8e47d337592d7d4c18d8e637ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86d04a8de1c61f2235742294fac64c51

    SHA1

    34a3a8c6213fa593c200bb0284dd92ea411ccc52

    SHA256

    ae615684c7edb81e18beb7a3221b43ace1d4fc8ddbb81bd856153afdf4ebb01f

    SHA512

    be8f7b5d73cc085bd2f6a9a64a5638188f63f33023522e66c34f7620c73b589f43d530379c8b8a91b83b49df0f9eb64b845d13cb62f396911bba6849e8f777ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d96505413777274c0148c058dabeec94

    SHA1

    fbcb984efe06906acb6beb2e1c2009fb68e57b5a

    SHA256

    7e4bcb76fa734ed1aae22bfe81a89b87c9b69a20c1fcd103d2c2926ff1dbcd78

    SHA512

    9970a5f8ef86f6d51fa8ad845614a80a05e17cf9e285673b04a7b13a7f8ab98d0bd0322163f0b924ceea93c0622ebb74329304dade5b5cb9c800e16ad5b31dcc

  • C:\Users\Admin\AppData\Local\Temp\Cab20EA.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar20ED.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2116-38-0x0000000002300000-0x0000000002400000-memory.dmp

    Filesize

    1024KB

  • memory/2116-37-0x0000000002300000-0x0000000002400000-memory.dmp

    Filesize

    1024KB