Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

bd02dd4aeb...18.exe

windows7-x64

8

bd02dd4aeb...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 20:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd02dd4aeb54e99962d72649846388e7_JaffaCakes118.exe

  • Size

    20KB

  • MD5

    bd02dd4aeb54e99962d72649846388e7

  • SHA1

    45e4bee4b2dfddfab1f8de0b9cdc564617a1b561

  • SHA256

    0e36eb0d6f2b882a23358d5fdd98c812c8139d64bf26a4cee2a2d43b2a43d4f9

  • SHA512

    ff804b2c036b08191e5b157c34ddcb1a0aa57c354b82f7cf65e180f235b1037d03da99be7d5b842733445c6fc0e6f66cd618fd10fe07e26b04ceb92d68b56f1b

  • SSDEEP

    192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJBf:1M3PnQoHDCpHf4I4Qwdc0G5KDJZ

Score
8/10
discovery

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 28 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd02dd4aeb54e99962d72649846388e7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd02dd4aeb54e99962d72649846388e7_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2852
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2828
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    180da1708a61dbb94052f765ad1d4768

    SHA1

    9b59087ca41434fe10fd508a20a54094b4b6721d

    SHA256

    adb3033294a10214cec0a9b4ec2015024cb19d1ef506e9298e23fbfd67211f4f

    SHA512

    ce86708f360ed98888336cb5f87b6ef2675898a7b5d8f5ad41ac95cc9966e754c7703701c89454da4747e4db205bfdfde0954b377999e4651178f28ab09d56f9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    612a093651036f2844727dd85d0d7c82

    SHA1

    5f0700270b8320bee873c038fb5aba88d261e601

    SHA256

    24b0f6016e131d4c0980f0a633cdcbc0729d212d5e40beb7b35f8909f0d3a4e0

    SHA512

    edf34ffd7dbf61900fa351944fd021e05043c19a6e679e6956e030ab0290b551f72a5a89738ee1772686a48ca860896f9b5fcf00ff925a72838effea66fc876e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d6530dada6c7f479faed3c7ea28cdc0d

    SHA1

    ecf30fae2e50a4bbd8beb66a968d5daf45419010

    SHA256

    a982c5da1a4b388437d7b74469c081ac614485d0b66cfb323ed4158356979bea

    SHA512

    dec19f5ec3109ea072f0de2ddc5817019aad42fcad2da27466764ec607234d02b77c976679c86bfc8143a8d3b368970b13f1e0554b1bfd975b2eab3ec5489647

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    434cfd6bb34e87c01869ba3d61e53a7c

    SHA1

    8b319208309601d13cc77eb8af1e5ab9ccf934ef

    SHA256

    96f55c8df7d75eb1d61cd26cbd999985342577d50193a12ef48e4b87cf490347

    SHA512

    f615fd107014c6b11cd4fa0eb8a4c6cb6afb870b231ffb14abbeddf2cf0d0ffc2092b450371003ecbb511aae84c196c055b6961275f31ece48b7fac697d7fc48

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9564433a0c82ae68ebd5e2814db62737

    SHA1

    b6f752ad56380138b74bac3c83a80d3c01259a91

    SHA256

    874a6f3d8fb7d46d7b4044581ad13478eb65a3403f6a9472b5602b12be9c0a80

    SHA512

    785ffba8fbbd1e72d3fce11e8a0c34af7f8ffec476cd8d2101df1174dcf85960ce94e582390febaebb4e7e674ca07783bb0dc3dd5a3c7074849d682ced45f38f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b6fe6538bf5c111c11b0cc03120a913a

    SHA1

    9fec6f7c9bbfd12f47ea1ec91dfb911c970ff83c

    SHA256

    e5cb1abeb23ed8016e836108867d0fba7d099356fab0091c0470a400c60fba50

    SHA512

    43de8b86d948498c2054e1a6c7471c1127d108e5f200dd4cf276814c041d6ef4d4960691b9efe6354d5ea2e1211781863e411d7bfa968a38513c5b157d3bf0ce

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    5ae9ed4aff18685b5bad70c5a7fbcbe7

    SHA1

    d0e43b1f91e2825de1485500a6d4c4f3b38f520e

    SHA256

    2e8be90aac7ecd486eb7b536b047e7b5526c727bf46d42b4b11dbd6eaa9d7df7

    SHA512

    0615459905246439ff1a2acb8c28715f370c165163d93372e7f16c909b92253df8ca289e78ef08c5bd7f7cb3ca3bcfa256547bc34a2ae85b7928eea1625911b3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    22cc4819c58635d64dc40dd24744dabf

    SHA1

    9ffd65491c6bb2cc81e36c27b6b6286f1ccdb87a

    SHA256

    c19817be9dd4a943883aeb452d6ada9ea171a1cc9ad175cb8bbe4acbc33c4bee

    SHA512

    3547974e368d84d9a769e3a0a8b9d97d8219dcf4a7f1a9520ed2a1d70ff6a72214a661707da33eb8c5a849de127f566f8d1b1611382274c185528206e347a2f8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    54dcb0002bd79794328477bf35c1d971

    SHA1

    6cb162a9897edcb2eaf401fc6c3add1c04486a7a

    SHA256

    6b09f8ad923dddf89548d2e0978c335cd8a82de73586479ed7d0c5c4c43428c7

    SHA512

    8637d9d08f69f2db67fa00bb886a2a4ba02cd73797a125a7532f66f33e3b9292bd6e98a6b0b1a003c29fe6bb87dbaded5ff54c89dd38b96f1fd29ba180dd662f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    58ae27fb846616d9a1fcde0a0f5d24f9

    SHA1

    d37e2660330593e51ea2478f988e3b17ea1852d0

    SHA256

    aa96750c9b91943792e08773715a3b6eeac1def3b11071397ce2b462ae1d3475

    SHA512

    6572ee230354a8077e4f53702a8e81835fe051d41e0c701933b752c1d0588657b518c4ca8a4214881a6b9feb1c26c89555a910b21efc494654698c6fa3ff2ee8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    36dc436854e504be286f06c40abf69bc

    SHA1

    3137c1cefdf66f0bcad6f21a6111066a9e89995b

    SHA256

    01e9b93d1089a556842a19fcce6b551d0825e3ca25bc46209e7a84d8f674dee7

    SHA512

    7626040e8ca8efe2b3f47e2c7b68b5f7199f5d3b57af1938d1f56753911546c753efa25d910d2476726e6efbf99055704b9050138a44b6f21f22774a90e301f2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    5e1d4e781af47f53dd746225be9c3802

    SHA1

    4be6c0489ad4d75eac86228b9d134da9adafc133

    SHA256

    0c0f3acb4c29be064856db1a1640290d69e8e7b9347fa8803b78b447e6c51c42

    SHA512

    1841c8a04143be1d4e3ef8e4a1db772963c0614f913de690ef2e587cbcbaa6bc75b411f1afe95ec7e0408708889bd2009ccf6c0ae4312959591709a3ec4b69c1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    3db7abdc9ffa11272eec52ebfe28ce87

    SHA1

    a9f7c1f36249c55a920e78844efa304ddc29a6c6

    SHA256

    c7b30efa2c31ef8dcca317d4d7e8866e5b1c496f9655caf5ba51d8e7e19eadb9

    SHA512

    e79607150c921b579adedc70429b3e7df40aa9aba23b5f0e835659df9b87ebc9ecdee6c3c1c33847df87b9389d1b1ec2edb4c8d1709c67372b1ee8a948100875

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    61cac1fa32611db63e3249f41bd092e9

    SHA1

    429381f281073bf9b6e0fa61c7e870ce324c37f8

    SHA256

    2a8a09051ce436c492a14a342ca63dfc4b2ee61d7afb968036a8e2a33a1c2736

    SHA512

    d2dadf19f43f941525bfdec411eaaa880253a76f0cf4b339269c630ce85255701a46833fef284e91820b808b0a10b45c089e43fbeb2e4d12d912f5ab8cbcb21e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ddaae3fd919cd168c36eef5cd13b89ef

    SHA1

    7e1597468518ef8a344ff4c31035c1756002b954

    SHA256

    64f5a06cfd01362ec1d2050415ddf3f04ddc7e070a34c4ace481d82074383fdf

    SHA512

    7ac82816efabfec56c48a81d465c979ad1895a34600d454a717a4d4add01fac7121e066feaf3484bea424a429018924f53cec5b59c0cced5327ed3787eb26527

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    2fcef9e428ea811d4912d5401673edc8

    SHA1

    c49f098209d2d83d4e9d11bf95288771a74ceabd

    SHA256

    4dfa964305e67bbc47c38b1e0fc92809180ef52f28430d3cd4dec68f111810c8

    SHA512

    1fc8f25ff3ba402ad2ced24105f756d89dbb1bc209d5f7bc65968c1ad98a6c589e96fa7eec6695f8018dac173ad92677fabeaefd107993b00c15361d34bab243

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9ab6f7b1d1ac9e92b61c6882b8aa50f8

    SHA1

    cb1c13ef7e3fb14974525503e4effa291e4694a3

    SHA256

    2e821a126a809b77434fedd61a1663726fc9a124876ad42171dd60fc3c3be8fc

    SHA512

    7179771de62fe6080cb38feb072eeaba7cf9bb8b2cda107f790d6322af6a962f2539806bb2ea346db0310e978146d77660cb0a6795b13118164da60b1f53226b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    be113cbf20289737c54adcdbd84be510

    SHA1

    8150f98c3f297dd74912c515907493f5be67682e

    SHA256

    8c76f71ce12ad82fdc561fb49677026701d5b4bcc8d3cb86db1672cba7ba258e

    SHA512

    971dd924eabb58aaa51418f01a2589302ba150b075c40d89196b79336d7598f8ab54e76a3e9abfc7142fc6d8442a755db971efba32e05033a5851dbec599c4e3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a86fe9549ded22834ba563f200169460

    SHA1

    5d84a1cf78f930647fdf91e42e62b1f5ebfd29e9

    SHA256

    efbb6a8837cd6660856593f873f7910a8c9ad3a73d8de69445a6b4e3fcee4096

    SHA512

    3d1b286ce1c3ba670a085d7a7fa4a41e64032e01cea9faaed1abffd04dc024d6c02d075c876a11a70e301ac66ce02d95db91a96127119d2681abc6519f830e2e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    120b84c7ec22e2708a13b8727b3d8ae6

    SHA1

    7772c37ab499c192bb948c482dbb5bc465f716f1

    SHA256

    1d02c1cb13c70da765188b261708a13fa0741a44752dae8d01793e31ec5faae5

    SHA512

    a6cb0f9b1bcbb9cdd69b1ba7b0d38fe1e5cc3c26a2cfc43678bf1933dcd2871eaf7b12b2823d4428adcd8008b08b9b14b6715e5a9422d3b97754c6b78a5ebe95

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab679C.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar686A.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\AE 0124 BE.gif
    Filesize

    20KB

    MD5

    cb6939883139c3e42d3929c5ad9d2835

    SHA1

    837b47e4fb2965f496f615139bb0f977a76f8e72

    SHA256

    7a592adb0f88f8b0e2e02dc63c6d4a1515e2306418c71967284fd40c5b93d98f

    SHA512

    e739ac2a7d1bb3a9fe72fa3f25d56cf9f4e8fdc053a64761dd7cf882228652e74635e3e8a20fe792f6deb7b0c0030bb621ae0af43032c32aa0984ad76c697204

    Download Submit

  • C:\Windows\AE 0124 BE.gif
    Filesize

    40KB

    MD5

    e8e58247e82ab01f6b632d8312ef1c98

    SHA1

    c5bc58b2572a0747b8320e094eb45f356619b54a

    SHA256

    1139c2f8ced9d3cc2bb625f50f6f16d2e89aef9680a229e3e2f6b7c680212503

    SHA512

    0dc880625ed703c2ba204b967b77260e45eaa33a44876ea0fdc91c8d72ef7ad66dab2f552ab392e889f1078406a96e236777537d45518f34b54e1eb7592d67d7

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    25B

    MD5

    589b6886a49054d03b739309a1de9fcc

    SHA1

    0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

    SHA256

    564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

    SHA512

    4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

    Download Submit

  • \Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    40KB

    MD5

    f825399e1fe984d85e4883b67fc01eee

    SHA1

    ac8e3d8e53482cdb0ed7fceeabb4a3bbc2d1f96f

    SHA256

    651ece11587162fbfbce9005128e320b3f6319310aedbb5721837e74225ed936

    SHA512

    c43ce49bb75a8dbb8397c71420a86b0d0ae05b991fc56a19f9b3139719cab1dd42d65d8a1ea8388d475c039ef847c7a5b85c98d4b6904f2f4278b2f64afa35bc

    Download Submit

  • memory/1052-59-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1052-58-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2580-41-0x0000000003450000-0x0000000003F0A000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2976-759-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2976-47-0x0000000003040000-0x0000000003AFA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2976-1210-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3016-11-0x0000000003600000-0x00000000040BA000-memory.dmp

    Filesize

    10.7MB

    Download