Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28/08/2024, 21:51

General

  • Target

    c7b5452c1ef6ec2507a9c81fb560d890_JaffaCakes118.html

  • Size

    23KB

  • MD5

    c7b5452c1ef6ec2507a9c81fb560d890

  • SHA1

    981bca79994f75e454760dc415aacee2960ae1b3

  • SHA256

    879b7f065ec22c4edda989449a2ab508b107f0e6a2a5ab0e8519913102031756

  • SHA512

    18323bdadca9dadbf3c8980b9d005de47026b8d7052f676908fb54d3662d9f166a7399732bf279e15cb64b436fbfe8874b75f3d0f0cd84a7418897e1fbd2527f

  • SSDEEP

    192:uWr4b5nyOnQjxn5Q/FnQieoNnwnQOkEntHTnQTbnxnQeCnQtqwMBIqnYnQ7tnWYR:nQ/qaZkb

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7b5452c1ef6ec2507a9c81fb560d890_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:288
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    61454176e752c71569d46ba6973f46c3

    SHA1

    cf147e20c3fae1a6272e190c9a68b3b84fe891ca

    SHA256

    3cb93b676569dabedb7f25aba7a60642c1a0f728c0a1c69ae4f574f66644e8fc

    SHA512

    494f10b705c4df51ebd76537f2b1aa067a49d23533555837bceff363f2bdfd1a52c866c59690372dfdb4cdf71d93df0416e89b4f666ce085703578332682fa57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    427f8715a1ddc9745b8adfd17d8ecab3

    SHA1

    d6eee3f753b578199a8fc64df6bca702299bcaec

    SHA256

    8acf744d2dfc89409b800be13ab85239327272311f4ca57d9a06f28407589908

    SHA512

    f7320898b22798149024b90a528a0761932f861ca10daf8a90e34a26a46c560ae97c8cc6773ba2609b9af0c4c388631e708cdc9a31e6f1659f7ed2723ea8f29b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    90a856ab9ebb6c1262e22780c55fa2a5

    SHA1

    64f5da0107804a34808dd13025dbfb55750d15c1

    SHA256

    1803c9976df5ad96e7cedcbdb4ecd0d1db4ec8163c1a22b03118bf351e23b633

    SHA512

    e8ae6e04d91b0e38d784d35c904b9adb961192f945a3da7313a6d6f0de852eab6225cfcb543d867a7b60b3e4698052bd63cb7fe1adcf6277019f02f8236e2f0f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c403c856894b3242dd9a2cb48f2dc657

    SHA1

    67740b8860e6c95e64c6440103a441233fc1a667

    SHA256

    7f9eae4888572a91456c20c83da763aa33b94f5cce9ca08be421173afc4c5a7f

    SHA512

    8a3d7b2b9167de798b170c3f2c99d576f71102889bf10391b8755f95176918930ad5afc3e7473f05af68454223fac83dcad963c54d84f0405377ef2799fd8b20

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8c6c8490d3414ab564450b6ef1f8fbdf

    SHA1

    d129cd89c5e6d2d22c24ce61baf591ec002bd79c

    SHA256

    afc90cf82c724b186cfcac650bfcaf35668b62efa3d427506026a0665508791a

    SHA512

    bf56827a45964ab53ae6422de0aff207cf97902a636878a456c9374a58c5947968afd463ead1eb9d02915539c47fdbd5064a001096bcfddaaea7ad0de0a467ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b84f52ed9fbbe5f1fefe6e0fb5b9bc7a

    SHA1

    7a4421fb33ed1cbc26421e7861305436040fb824

    SHA256

    f4f4ed5629e8fe95acffb13fddbfc1c68c0f701ca025ed7184cc84a5ccce6b93

    SHA512

    277eafa3e332640a4110cbbae9f00f46c1885ec2f319f86800449ab973317985e0b861c9d11f2f2af554464baad00a52c6fb9cab538c0e3a2d5b497b4e2157d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    916511b6c95baab9cc5c4e6d0e0229bd

    SHA1

    a150ab3e311abfc9d60eda37843ac11be31dd69f

    SHA256

    69cfe1d8185f3a2c81077b0a557e60f7be62d97373219de0b83202babaf83ae5

    SHA512

    d543dc6ef00a9811136643418d35d74a22ec4a0aabd4f9e4463f6a70b0addee97c4c5e223d7b0c86ae23350ad8991b99b61351a6268dcce195d490e9efb55c61

  • C:\Users\Admin\AppData\Local\Temp\CabAF73.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBB97.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b