Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 02:47

General

  • Target

    76c6eafeca60307f4130d7991f2c8192_JaffaCakes118.exe

  • Size

    188KB

  • MD5

    76c6eafeca60307f4130d7991f2c8192

  • SHA1

    bcb1cce7099058faab258bc5d04ec7313da13e10

  • SHA256

    379a12d1b0959f2606a702765b9dd1b0afef1e9940efeccc9c549b0db3f8aac9

  • SHA512

    9f7dadf4792c6c3b61114565119526e187da681d6611f99a86b5df723f587ef8d9b1e8d8296fcb76bc7ecf04827490636df199ad0763a158f4d48de92e1e469e

  • SSDEEP

    3072:vtzoNsBXxI9+VavjRPn6Kt5PckgflaJDTF1sLo0FbZfXBIUMiRlbYPJ7fWy9BUm/:vtcNsBe9+GAKQk7JPTkoKXBIsjEPJ7ff

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76c6eafeca60307f4130d7991f2c8192_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\76c6eafeca60307f4130d7991f2c8192_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.orkut.com/Community.aspx?cmm=37111121
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a562069c47aa76bb7a5e4e982f49601d

    SHA1

    3c9e1586f193dd47cf07e409f3d38d6d6d14e218

    SHA256

    cf81636453cf68db9cc99b0c433662845a0049b24312527812cbd304e2191775

    SHA512

    09000b45a36226e96d53ddbc24159ed59025816cff4adcec11906c9bb7be8b767d0a1b9a48eb2e8f92d9e3acd2c7042fb5dcbc413c8cd2ae2c5d0e8eb0194aeb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c4f7d7a23e93241d0c89bd5e88769aa4

    SHA1

    811126d1601c021af6e379fa2b51bd31635766b6

    SHA256

    91eedadca19820f8273b62b9c5ad2eafc9aaf4cca0f4eacd26fa54f5eb6526f2

    SHA512

    e1c055c017f8ad6c7848d9c1d83627eb85848fdf0bf767edccc4f88eeabcb212115367193c38a57531c691fd8586c656793392e49ba8baa2dff599242f02d323

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f27531fac4801f097a902793c0274d02

    SHA1

    3b0de8c7b0936928e98642bb246c2afdff148cf4

    SHA256

    760566e7f67492a7c82a832b88b6d70b52ea083186eb5f39407716fd18b74952

    SHA512

    3d3e326918388294a6e1bbde8a33d8248443dea88d83ea2d500ce6aec1ee93fc68943081d48bd558de5dcd894648075f88ef3c01fd907323b7ac5a6fac8b0b91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    33aab1146c4d963cc67d4b3130281b69

    SHA1

    53e17ec9a8c3f0e88055f40ab0b95c9979b115ec

    SHA256

    6daf31561e6d32d3911317d4aacb8baad2bd4fcadd09c59e7207248b74328c3a

    SHA512

    4c98c4ef33766de6f5fdf477ece233ae75fd69bbed71ceea889f13088295819bf46f7dbc82a328abc75b23f2e36394bae20fd1274b0440530e6403c6569e05dc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    2ca3634182085576659b58cd53376355

    SHA1

    ff8aeb1517c60ba0566fca6aa51149559f78d703

    SHA256

    17286041d134115cf8679b3c39752c357b9980d7955ff6760f70be60a4628894

    SHA512

    fd170962e5cb869421a8e4758fdbff82ae3b2ca56b18612367f44d962d81904addb04a6372f8281c02b18dc8691e8a05b82966c778a521663829668ade06cf02

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    02065504db958cd938bf58f569b711c0

    SHA1

    d45f83a65735af20b82d652a2321f3793f7d42a3

    SHA256

    3c2b44ee9da7844e483ea739a2a626527249a64cb358e3c8ac4d9bbfb1427620

    SHA512

    e868316aa47b434e0dc98dd4273dc53e153d301702d447a8307e36e9917788f779d8a6d4cf65964921cf5c5bc71f1d21459519d71e762d1028d2c4074ac11c08

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c5c9fdc65b0d3956f02eb095acf9f6b4

    SHA1

    b7bd133127cd4ee920d4912a62d807ae5b695e93

    SHA256

    ae6e531b4346225b5df9070040aa83483297628447032145f516d2d607ed3ec7

    SHA512

    31a9a563f9b031afca23573ff66b51f13170c21ed3f1c991b3d233db44322c48133bcd0e98b3ce74f4d2d58358266696a03d841eb9fbc47d5bbaf09ef490b3ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    d62f36fc9763b804061fb91f433e6d3c

    SHA1

    0d328f923936cd56bc17a0fc91883679cda23b0b

    SHA256

    afa41cc7c8441818bf6f31f5fbfc3ce81850a8470d65295726c809b7412358af

    SHA512

    5c565229d64d6aae80799c127a9744bf31322746b626f1853e52cd17d03307b55ebb370be46ba3694a31d28e2da1e2c67f945f0ba9d6c42b4096f5fd1635a9bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    cebe48390cee03ed44a65e13c3ba0f33

    SHA1

    ade8dea9522dd045d39aa17d5e3d200c3a9a9c04

    SHA256

    6c95c0813b8710ec9e70145bac88b91f9451d14ee0b9d949489c068e971ff53c

    SHA512

    4efadb9ffee66255ad52b302aba4a5c52454e5068b51c70d9dd81b09c4f70c813688141627f6def0147e887b1e2b8f7841de0e126aaf2d05c00dd5f7467844b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    07507083a92f415651bb69fe7027be9f

    SHA1

    64544916d1fd1a4c9614c1ed448c2097eafdb905

    SHA256

    e7b2d93590d2fe21ca05197ec2e459c6d794d9435a206db427fcfb07799ae6ea

    SHA512

    96a678d94453546790d7b999b707d95932afa9896ebd3bb4206df5b6d0fd1c681d8f25c81e462b2e874743a91dd2d78941fedd87e4f810ba251b5f64d538f7d0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a66ddc8c7037661200204e24c7a83c8e

    SHA1

    97ec8fac26a5d44b920a94589cfd2867e683436d

    SHA256

    8ff5b7519e5803e4869334e12301e82d079e998b3c7ac2ef1eefe29182576e5f

    SHA512

    5a1b5adb27d7b55c854ecaefdb9bf587b0d344625585c247f40131b8528c4200df58b7063b6ed0f814c514b937d73c3511896091a94ee70742f30a189dbdbe5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1a0fe73cc712f6471437b84ee7862839

    SHA1

    33ce94c194d56aac6a8b701e29a885a453222f57

    SHA256

    d3097ade4010fd1502250c2a19cfb52f21859543fbe56a781e2d36a52198ffa0

    SHA512

    0db89c0479ce51b9e0b761cbc474f5bab92fcc8a6c1f96237f2663ac35920f31df590527448b867f27d7691555bae1a64e09e14b68a671bbcd50712c0f4d07fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b92a7c5bbdbfd1a819830777e3469502

    SHA1

    7636f9a194becd9f2571c4e87e1034b5884881bf

    SHA256

    b50459c2da2deccab8216ec07599c305a56f09bf8c0e2813e7ba7bf75e605d6e

    SHA512

    fb46b820c850ec18d1ac62c45409055624b1a3582accb5e078c1708ec65e573ffa88876b84c44169251975c57727c1ba74dfdecbcf68fd3bea0cbb8265e82461

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    96d3b0f3d2a8a6444ad892039a2f097a

    SHA1

    6b842cd3e54bcddd2617684a9a5f12e6a73abc7c

    SHA256

    14247371bd56ffe4c3ad6b06ddc95308eaf7a01356f436c3803d5937fe6a65c4

    SHA512

    214cc6637485e5cfe133f331f6f630542a8060d58d63590093b61110cc2639d8ec0c5023dbcb060aedd19a19b3f61f1e9611e3f37adfb6d5f3f02ec353e41aa3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    31df758474f432541ed80ac674c4cda1

    SHA1

    03bdf47313dae90a976c6765127dec33db7330b2

    SHA256

    92468d2d70ba351f685ca4152692a3a0451838917d382f7dc0c447e113b4e294

    SHA512

    dd2b5f45c83d5270f2a4012529936ca96b1a0c4559c54aeb1c0d80ace866853516d07480211a7f50f1254850d7ee76871d406ee50932300418a73593e264312d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    81f298c27217e3f9bb96c0ca7bfc2c62

    SHA1

    2a92ae872dbfb9af9d0af57c60fe88a72fc50295

    SHA256

    42e138a712637905b78a1be925eb1fbc0b85eb4b2901015f9b795d6c4d73a67a

    SHA512

    d3caf4251916c511faaaf68f4af8d27eb49b63660395aa1fb117900743ea8e6ef113b7319dcdc28321cecd6cf11322649adeafc5f96dcbcafa499b08af06c856

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b05f405fdd54e131da7bbef5a303b985

    SHA1

    7a7fe3a27f2c17378f4e1c669b327ccf0bd24aa9

    SHA256

    3ac7173795905bc973c01a84d3f88064c99c3407d753f67c8e1590bb67a0adf6

    SHA512

    de47a698adf3f24b5a2cf70de0c4b9bf2cdeffa60d31b1ce3a79c1b8e00186eeb9390fb61633152e9ffe76d16dba53d6074a62f2d86781214d0e036dddc7051c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9559ea5c8ef12c9079d8abbca417bd30

    SHA1

    6155d3b3d72336ae3404fadfc46eb418964b4bae

    SHA256

    425d45771da3c9f2ded573ca3f16ce8bf1628d34a9308704300edbeb36cf2f89

    SHA512

    df57f6edb62fb78662dbd7841a011f01a0c2d9ed213319f9f6b2ebad63a26a861cbe905614f10776b29c6e6d1b7ef5d8c1f185abb20498532dfab635f527936c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    5aad6c06ac8023c0b79a18df209e9927

    SHA1

    a31b327dab889b1cc9891d029e6043a233f447c0

    SHA256

    7d1376193ba7cd47499b67ebfc80dd85de04e4c31af1a989496ad4b4dac5b616

    SHA512

    fe6febadfd74d6272d485fedb8b13850101fc865453bd19c71f5968afc6f50a4f98f50ca1ea2480d5a34de1d708a430daa9d2931cf170c51479367b35b041140

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    8ab9f9ffa0c16eef3429d2f5fd1762a7

    SHA1

    300d545de062f8b5ce411f7dd052504ef9f81789

    SHA256

    e6bb230c4e1f52e39c37c8c1b77b4ce9eb78989ee2952cf9c95eec226b4e54fc

    SHA512

    39e3509c874e7afe99834a788ef4e4c0168ca546c92770a335c36b548e740e8b8f9ac9c4c3f1451222c6b90d78f5bc7072d8caac95a179c8aa020bc787c7e5c2

  • C:\Users\Admin\AppData\Local\Temp\Cab456.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar469.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2972-764-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2972-763-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2972-0-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2972-332-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2972-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB