Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 19:32

General

  • Target

    68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe

  • Size

    388KB

  • MD5

    68a12b8739cd4b5990bd232cc4d19e30

  • SHA1

    a0c2e99e5119739b2eb776c75f037de0d57702fe

  • SHA256

    052b88adfbaff27d677852bb3baaf192ff88cc76c4b6b93fc92f27a4a145a941

  • SHA512

    bff2aca4a5e484b5a8ca9edd328cf96a8ca9a41852b6837c69ce7ff50e7e9a39bcb3814f820865bc20de2d67d69bcb725c77e6b1d856c6e83e2da8ff8cead56a

  • SSDEEP

    6144:mzzEVZVFyhU4T4MYdQEGgKfYsxT2JHoiwChN0lLANhCRd9qb1x7g8kJ:mcVZT6U6MKfYsV23hALANhC4jcpJ

Score
7/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    75a34ed7302c53a32192e5c63e0a2b90

    SHA1

    90b470941ca67f5e61f7e45bcaae7fcb6ad0d424

    SHA256

    87c26e1c313e4c6c0ff5c0b8f819a2070301458f0f39e94d43bdad5fe00acb45

    SHA512

    e3262ce46d9c2234cab07ed733bb96cdb8b0fe77c33282e84a7d784f6a92086fae47886706b75a5d239b3ab1d5acc67f2757775eec3278f26fc42b8a4990e4da

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dbb246d252c4f110087e7104bbc57573

    SHA1

    f41f42f411fd1510dfe23385526aeb3bc3ffe2a0

    SHA256

    8833b0478d711df153bfb6ccf671d7043c197e3187790b9ee5713d9946be8eb4

    SHA512

    b0999760b9faaad009d201c350d3d438e2b9b5037adf3db6a1dc666c40a6f301a16a6ba40bbe5062259f97592d8739052699528cea3406a8d440f5f7fe3d1522

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    01d8d3bb978d6143a09d453f72d41a2b

    SHA1

    ebaeb2fcae4b7189cd2ee6aab790f22dc6db479b

    SHA256

    83b91bfdd3305387940df9082ab774ab3a52c665020ffdc86d4a0bc60e4766c6

    SHA512

    da87503cfeec433cf27e2cd3db75d75eca380b73c293c72544fad4b2805dea6223d6bd359c8058a18bd33ba5c7010a13c9a2e0d2148a76577f2c2db77f0b3d72

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    901157023afe520cde7f00a0b8749411

    SHA1

    092428723ba6bd5646a643816217685aefa5bd09

    SHA256

    16a6230158837178ca81f6d39cadfc434e71f354a332d82cbc2fe91b7c9a68eb

    SHA512

    2f18972b1f6288147437eb9fe2cdad22b27a8b294f996424350f336f6acbe84ba4317c4217d158f754e1b2caef1e717201700c85b9c09c2a0c9fad2e8b7d7bfe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e7989c9eff15986369c14c57933f5d61

    SHA1

    04912abd826518688f5d6c4cf52caa81e9098b57

    SHA256

    99143da7309d62ff1f7e5ff24febb4b56880983c6190d65fe9641332748c21cb

    SHA512

    1cc8b6743b477ab8870914e7326687bbe187e7c1d53dfb24ca2e614dd356a3c92ef46a8b6416bd13f8b87083c9e7c41373496a1690364a41ffe9bafb77b88693

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f3996b38a39ff77ac29dba582c37b1e7

    SHA1

    253eb789cf96f89f5f548da3b8b9a04c58df9b79

    SHA256

    8e443b7b5f969fa7b661b4f85b5c4b95c7a41ca178eaa77eb5158d8f78c77915

    SHA512

    a84928c3a9d4eb419efe7eeca0ca8c97098949bc1dfbb2d7c4397d514bb8a304a2bad9819e4700711cd7de4dd31f9d44c6626cd9b80743c239380f35063b3c84

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e8166d72b259cc71c894cd1e34ad162c

    SHA1

    52acd5435f7d916f2113dee2e790b5db547986b3

    SHA256

    338e2dc08ecafc3bc8d3fb040c8d4eb15fe85e99ecf70a25f6b0e8330b43b2f5

    SHA512

    5a0cc3293049890d943686d1f111cea1c5b59ef50792d24b19bddbedc392af6a77feb8a5569af8f039c21ac0452ced934030b62949cc3760266467443df71efa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eb160b7b8a13b5104a3a21ab71fbbe43

    SHA1

    fed2bd5e0332da49986a7066f7b7d049910c5914

    SHA256

    e5a70cfd5c317327f7ca8907eec8f61664a41c56175a7264b95172b243006353

    SHA512

    5f0fa8313903431b103fc6e10b3771eacca224d3c8be1ccb53f5d0548b910948deb27b6c747c73fd72be49247cf5c0a577cf5780677b15c802e421f02bd1f3ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6300fec3eec7096448f63d3f33d73b45

    SHA1

    35f61335ed711eb10b6f3d3e3da7449ee2143bb8

    SHA256

    8e598d778856f163af4a786f18c1590373ba6d66ef2e00b07889ae1f153fd4ed

    SHA512

    2324c1d9dca95064ca1fa31a25b4fbbbd99c7480ad74ab57e03d1a56c2039dd773b6b170d54aa3a53666bef9b9ce9aa9fe4b16b934cda9f56850624f897f8d6b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    36b15619d9e2e5c96187ca7b5fa1c3af

    SHA1

    b4f7aa2d7332b62f79df071019e2e3cfec3baf6e

    SHA256

    bbd18e5adfbc84a63c575624e1b0bd08736be0f58e128f59666c1206e604ad12

    SHA512

    72d23e044a37704893269885b1b0ea37a216f8bab28500df59632842d869b9af5bb44079bb8d2188f0a0ecc7fa41d538056161ebbbe3de73c2fc371eb1ca2532

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    539e8b43b1f6e1bd0e7a9837ac6b04f8

    SHA1

    aa813177084e2992bd7686ab3ba6181684afebde

    SHA256

    370082710fedbc29a348291ce5701e3daa4ec0bc31b442b4085b57b0daed45e4

    SHA512

    ced9ddaeb93fa93764efaff9edc9c6fd7feb4848b7b544b99e5c1d905870a90f139d50edf91ef2422eca598deb9c07cd55c95ea586fd830a8aeaa3ceab8f3282

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    116234aedaf233d60e1d517b8779a318

    SHA1

    253ff3bcedba38d22c4ecaf0c59abafff5d93eaf

    SHA256

    8804d893013571a3d8dea7d408c937e4db31549f1bf3f33f16d61c09d270c5ce

    SHA512

    e5fa227df9446209e4a8f84a51d64e3e5ada59ffa2f6660ab97ac883927d6280917697322a543ceec3d615b901090d13945d5bf0db9f8476e7a0535056fe4afc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d933bcfa068a5d9f7c3ecde07833cb33

    SHA1

    12d7824050f8a367263e4100f969fdfd33de62b5

    SHA256

    c86e8cc54bc33dfd2b4f211fdac1a1c897ce5b2b5bfae331dd1469a56055557d

    SHA512

    68d6aa9cc8b30091c089743ce33b6d8af4f8caf72273138d77ab84da97e2d6f92476dd417113553dff5217262fbcfa2cb85a758cc3fe92f618e7a6e1d336a21b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b44c110d9042f11a61e42f249ff3fdaa

    SHA1

    45657c67fe63521b47d47076810b34d20f410f74

    SHA256

    441054febc2bf87fe84ce755f30f3b659b0391a83ab4da56d2e83d8dd16d300d

    SHA512

    2b978e2b637dd78f54ec9231cad7b99a14b3130c8cfc3979cf0021f457e7d5c86b18da84c220a6ae53fd53e3d08638b4a6f49781aa70a4bfb849207c5a1fb550

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    90821939cc4d3cb905a07c9219cea78b

    SHA1

    0d91f18a69776edaf5d2d3326518cc69f0b900fb

    SHA256

    643d219fd6ccc6c417df84f3b1e6bc5c95fb948798bf367fcff120ddb730e1bc

    SHA512

    a1bf628350397fa3501ed54d42a855fbe16d0501ec68d097a2e29ea14ace7171e1b53ca60a44748337686e410af45819a10d13545340f39d699ab5bfda24b4a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    995bcbfa6a5667fa834032214776f06e

    SHA1

    199772dba16e0466d20ef823633aecc1fa4915d6

    SHA256

    281b015bfcbd4e7910cddfc7d560bba6d10d8920db5cb7a05833de3cc6947f63

    SHA512

    28626b237e869428b762c4fd5f1834b62b1e33cbdc5a25ec972040f08b94e8a4bdcf84ac2ede81eaaea39355c8a9cdf9b71225df8b9ff698eb8216e4db2d2655

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e8f57c4fe7eca06e079e447e8cbb889f

    SHA1

    68185e7434dcd932cc5352e262f07816ed4b236e

    SHA256

    d7ed692b9c687e18710f84f9eb1cd9b4e1a5b0fb8e7054d58d62c3e6c807efe7

    SHA512

    353842cf7c922f7c2134464c9d726eaa10636b55770305e2f11a7f579c761b6947b3ecebbcc3cfbbc8f2f735365082ee678bec7536776440660cc76cbe15b983

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fb53b1753b6d882248e6799c86809f55

    SHA1

    14b27679f9e8a031a62064b7099eae4fdeef59f9

    SHA256

    847a7631b03c532ec6b7a9e9a64a3b3d8f0ef1cde27985b9ef0708c2fc10ac2b

    SHA512

    336d48b298d44c8c48f3de45fcca6dd3ba97391d0f1b414e33a33e10d882219398c7bd42f0a9d85f5ab4abfe47f298461e329d3f09e964568ff075f748f08bb5

  • C:\Users\Admin\AppData\Local\Temp\Cab5CF1.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar5D62.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2776-12-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/2976-1-0x0000000000220000-0x0000000000233000-memory.dmp

    Filesize

    76KB

  • memory/2976-7-0x0000000013140000-0x0000000013153000-memory.dmp

    Filesize

    76KB

  • memory/2976-0-0x0000000013140000-0x0000000013153000-memory.dmp

    Filesize

    76KB

  • memory/3040-8-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/3040-5-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/3040-10-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/3040-13-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/3040-11-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/3040-9-0x0000000013140000-0x0000000013153000-memory.dmp

    Filesize

    76KB

  • memory/3040-2-0x0000000033140000-0x00000000331A5000-memory.dmp

    Filesize

    404KB

  • memory/3040-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB