Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 19:19

General

  • Target

    70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe

  • Size

    57KB

  • MD5

    70e49a354e53708d81202744ae8fc1c6

  • SHA1

    24746e0dbaa653171c308be8759d866e91e61a2f

  • SHA256

    7285c09b613a6d73bd7982011a13abdf56c39a2302d88a314b47836eb426ba4e

  • SHA512

    a1a132cb17b9fae471633dd3c30c4fc7b1b1cbee61ff302e008b0b910f78ed943a2c26dcc183d3615e9685a8d4b36755de6f98a03993fd592f89d6f942cdc84c

  • SSDEEP

    1536:MYE8pu3/c5YtKIuaHQ3mZUdkjXDRFdy7ABwj8AoUwLPb2:MYE8pu3/c5YtKIuaHQ3mZUdkjNy7c28I

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\program files (x86)\adobe\acrotray.exe
      "C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\program files (x86)\adobe\acrotray.exe
        "C:\program files (x86)\adobe\acrotray.exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2416
      • C:\program files (x86)\adobe\acrotray .exe
        "C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\program files (x86)\adobe\acrotray .exe
          "C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2132
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:2176015 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\acrotray .exe

    Filesize

    67KB

    MD5

    d6615e30cd21209b196874894a21a01a

    SHA1

    b8aebcf28348243698becef68b123fcfb9d4873c

    SHA256

    834e2e21ae60dc9e7f78f2ffc138be2ab7c7983c492fc6d42f00055805de0ebe

    SHA512

    14bbe7eb183678c0ecef0a1b81873dfa57de96f3a50a5a3a405f605dd62a058b5cf6d3a76f196288e25c5b91e05922df6bdc92937fca35dfd87efda45c34a193

  • C:\Program Files (x86)\Adobe\acrotray.exe

    Filesize

    73KB

    MD5

    aaf91f546f1dc122624fd84f2d19bd3a

    SHA1

    b75fe256934e513c801dc1be1ae912e04bd363a8

    SHA256

    689fe514c8c67433a83839f7a8f64ba9363120b322455e62175d214c7c1b8194

    SHA512

    2aa4942347ddf3860ea95e2346dea342e5a1d5628b624dc6e38bb692838cc219b6d44ca1c84d90e7740c570697ac9976552c6e9548490d76db8868a79f7207b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4040866F7CA6E6A6E63F490DC3DF2BB1

    Filesize

    550B

    MD5

    2ee6b9654df8e1d5e02ad7e7c405f31c

    SHA1

    45c9e856de5f67e80c35460c6f19e9343467ab2b

    SHA256

    e8d672c68dbcdb57fe6057113d7d2da7abd249cabf45ea1014dd673f30a90c2c

    SHA512

    eac4c11ff3674d38ccade99c7fdf618824960666e985a3408250c8a02e62d771778346c8af852cc104dd92bff98a8b16992f8638387b0f1e7c7a53930508d6f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aef5a15201e28c3f6de3714685362af3

    SHA1

    97accc3444798c6f4671d7fd64b315539c265df5

    SHA256

    386f8313af040837b49e679511e1710056a5e9ce9458f2757105f214c30e83c1

    SHA512

    20690e92db3318994e257fd49ae74b310882553dd4c0801d6b006cee450a024de1dd03a97d5c0dcb86f31e28b957e1c5ea70282e29ed5596bc9f5651b0b64822

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f74213e756ad08adfae3c4035d6527c4

    SHA1

    b48b0472c8558e4ba3887a676973ed2b17dec525

    SHA256

    00187801b5e54e187e7482a71f04674dc92fe059db1f260bb76216b49e1216d1

    SHA512

    62a906afbf9f543c12cf4a8997d7b5d8078aa712fd16455b8c4d06424053b4ab2eba4320eda73751da07371095b2e6a010ae2dd0e1eace1b76598e8102acb047

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9dda3e74d5ff8e5a9d395c018fddf2ef

    SHA1

    27ab6f4f4f8e4dd69af34d300b82c6fe81e8e62c

    SHA256

    7aabc3ad7c4d58ca9a2f9dada5393d8fb26e2e292680c82dcf2b7eb606015180

    SHA512

    6430d35ba714c0f8b8a736fcb089663e27558b4b32f0ad3fe10c33f42010ec7d1ca700400a771fab2b37b896be164822a7d620493e2486133f790763bf07e916

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    de13a3992227dc0bd1ba6b8c4285bba1

    SHA1

    98116d678af4a4dc3b8abbdb54a92d1e79fd7e36

    SHA256

    29fd12f3448fcda576ee46e42e25580469d7f3a33015dc47c880bdbe1435b837

    SHA512

    3551940b77f7aebb5604bc7d3b824500faa88ee2458c2d33db564baba8264642efafdd95291c5ceeee31921dd57d8f79ce33ad05d464313fb7e344765b8ff8ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8f131b4165c4c18d97a11c6c871fa0b2

    SHA1

    d9a9d9e1254d938f821ea634b2f1d32f54559e46

    SHA256

    904d15b1d53a4c0e58aca14b03012b24c58413e91c7b00d94e1a84691e5ebb0c

    SHA512

    3c97dd49ca04fa87e954f84f100f6f328c94aef05377a97f24cb584b3224e83ce20c9fe3de54b2eabf34bc3b0f23ee059778ab0a468a38e5e4f35a0d58dee3d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e1315a5984e8caf35f9ca533990f25d0

    SHA1

    242360ffe2ef51aae44d85d96582409cf696a803

    SHA256

    b524a6f76a7ffc6028ebfa9c57d4a8861de34b0651d1a74d177e3e320db4ffed

    SHA512

    ba1151b86651ca59a428a81bdd1d8615c90ea060e5c516fd11f6c13874bde97f2d681e0592c894ad28554d98151105a554d10261786b4c4c8f6952c9485841b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    76e4a88629e12273860aa829cc504251

    SHA1

    2f5b37d6a89e1bb7bd35957ed84820c41dab5665

    SHA256

    c92e38fb4f8eced6407dcfcc35dbe4e700811d40bb757032009ba26f185f6dcd

    SHA512

    ef9dd53389cac542f1348c49b3c6cfb16e10f6ff55e0dd303ab6b2ad40c2ee1c8f2ed2745c13e84a03fd0f26a753f9f5b18d22d38bd14042200ba3aedf394fd9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47eb92a19c1b098904c11fccd3742071

    SHA1

    feed819087e72047409869df8c168e3268f61e4c

    SHA256

    82679a7541c5d6d9f5a03fe03875e6adf69706849160a946458662ffec7f4b21

    SHA512

    79257acc8baeaf4f9c3ffeff2726688334c713867cc94c803c71df940f5e16658f2b55bbe4eb11b770c0b54b2bd84c0e075580325e7fa8bfbbac365b675f3de2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5759522117b92f76ce5f3ef2bad0f8f4

    SHA1

    b0d005915dc9a87bf31ceb54e39af8420188c3e6

    SHA256

    32db4b5e4bda56c48781bf5f74e2d572bc098ec832a8b4885c9bf63f7384a1f0

    SHA512

    af0130d0d9dedb63101ad6ef0869569a55b27b6e8616354be13eeb193e55a7b97ea6e0f9c98d6ba5adf8a058eb7a47d09c30a0519294c95e2b19ff8690ad16ee

  • C:\Users\Admin\AppData\Local\Temp\CabF344.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar23F7.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1320-35-0x0000000002150000-0x0000000002152000-memory.dmp

    Filesize

    8KB

  • memory/1320-0-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB