Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 01:20

General

  • Target

    c7fc96e1394d096a19d96327b34e657e_JaffaCakes118.exe

  • Size

    695KB

  • MD5

    c7fc96e1394d096a19d96327b34e657e

  • SHA1

    ccb5b3b3769c58e01c6b87004f61f8e3377443d1

  • SHA256

    7692645d43dc89de9af588f247b95055242b54ab76efd88f7dd5bf1f45b2fad6

  • SHA512

    89000defc25459ced3ad8f949e121a559f3f22777b8209542b17a7836042c837ae412d3d82c71ea63abb48b33061185ea3d7fea4f0640d3a83c84919e3bdcff3

  • SSDEEP

    12288:OmDslhIwKjutLjJaCVNjqlKQR14WItuM/9P/K5:OmnwKjwNWlKOw65

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7fc96e1394d096a19d96327b34e657e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c7fc96e1394d096a19d96327b34e657e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
      c:\users\admin\appdata\local\temp\\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2708
      • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
        c:\users\admin\appdata\local\temp\\wmpscfgs.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
        C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2848
    • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1116
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:209938 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

    Filesize

    723KB

    MD5

    f7c11752af6b7c1440cf34b712f1f89a

    SHA1

    ba1e8158c6a44e8ef0970c93e9f86759186bca09

    SHA256

    e29b11aaabf72bea3aae7e238396414730ba96dfd1afeacf6a7de20a381fd59f

    SHA512

    1846fe65edc56767689290767831affc5a6a0ec088b534dc0d5979a4aa861eaec51e6084d04b2aeaf4fdabc2f4917d01b745ed9e9013d8a6358dc4a3c1ed7483

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b52c088528e81f193f9d4d4e0048560

    SHA1

    3882be9ae2d8aa3019eb2951ead71a4f43cd43e6

    SHA256

    5dfa1156a7465ec5ee718b8cb31651b87e52fbb746f85f94e176ca3fe2ec64db

    SHA512

    29c318aaeef79eeed167f2e8782d858d6b2b0b0f27cce7d7eadf4aca4c3dcaeb2147695678e787ccc841c259f8aa00ff4cbc4757c6d54ca415878e38ef83e358

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    52beb312ed590f7486c6f31e16444be4

    SHA1

    517e0e2ac38bb06e3347ac58c6f3b72c35e5d174

    SHA256

    5db2358b351e4bb9cea64a588d799a79887fcb8d36fb3b6a228a45f147bb79f0

    SHA512

    5103be9a8f743e6dc8651fc4170a9c259f8dffee143cc97340604ff9c02bb831d41384d12b8b872a0cdc401d60e263bf60db8db7b8ee5ea9102a2a3a42131319

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bc449b3ead4cd7cb83b63aaf1c79a4cd

    SHA1

    a4609b93cb292bbd92d9c9e531294ca5d0f452b6

    SHA256

    bf6e37037501826f84be25287d45b3b4925b7099993c20341ee25a33578aa774

    SHA512

    1828023cb2bbd1be35005c429a4b71df10fbf19f81db27343525a496e1478a3258efb1433cdea07216f135caa0a1baa49a6d5be2c7c8274db7189fa779fd68a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    71e22ee3ce0bd4c8a95121f450359431

    SHA1

    15266251e5726345b28bd5f6aa14a5b9965dcdb4

    SHA256

    a19aba8e5da2c61f16cec7bb868b28ed0b40847e5bf221ad4a36b99d0fb101aa

    SHA512

    9c216af808095a7c999879c96a88308a0b7c7ba5f101a787dc44b00fd55411399f538b08c2299835f0f127ef7b884d901e6bf26c495aa5e8c14a577890f26cb5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be4f63bc6c39eceeb4fd9bac13cc0f5c

    SHA1

    935b84d8a9ddd6e300c3ca816ed30f746c422bc2

    SHA256

    d24869e8fe901042e9b621a527116aa4a137a5cd309b29f0412b28474bd8f1bf

    SHA512

    43c39b259fafbd16d58e48cd91c0a42e76a7cf9c7ec283beeefdc470da401c97c012651496847d031243c01f1d4255b763a4f1270e5ea0049cf76b8bc9e3d03d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8cf305576a8010c4b547137e40297089

    SHA1

    e989111634af233463f38663fddd23c2cf7b2106

    SHA256

    ed01bf3d59f66ac2e81fb2651cf91988726cf6d4d5e2432538b92b327a2b3888

    SHA512

    d126d765c28d46f5169db5ae332a535d1320fc3fdef66335349f725e64707a2a9466abc596138d403c2d2e5f52e3fd22d7c6fc5f18ae5beccac82c90c7561128

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b487b725969b7d3ff4fda69658672f7

    SHA1

    4273a6857299ff6a6fa7d48bdff1966a638af2fa

    SHA256

    b3dd0bda55d1127b029b9933f14e68a055322080d33fdbc07d909fa198c1d6cd

    SHA512

    f4e5d2d52f061e0371309e66e7f26b5ad12e5eb2df5c5170c7ace5c5191e0a9a28f0f54cc633956ce7cb27ee71ca6e679d02c275cbf9f736e00af1ba9497145f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    956cc632dc517049aebb6554bde2aa5a

    SHA1

    4563019888369b1426ab7969e7b8c6f3ffd9d889

    SHA256

    38a67ffa15fa95b656a6fc66e81910bc718fcf5bc1574cebeaabbcf09ac1ca40

    SHA512

    4145af4b45c30f51bfaf34874be81840d8e2c38b184b9eb79c3ca179dd52011f411ef7f2daeadf9684ef0e49c11b24a7d5593ff7256e90ac59eb0d0204ebd34d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbed9e325708a0b79fd332e819877df7

    SHA1

    3c9f06a473b6d6cef53b99baa948d6ef0123384d

    SHA256

    499b12d51f0d38fb5fea338bec01da71770d53c1b1ba239ba140b4fb43c0c30b

    SHA512

    65722af3b10f3fb8a618ab2cad01cd3fc865a1e46cd4e526f9ad282d6384406f19ff7be9199e04dfd5e1a841b98f07f5ff7acc271f6cc6cb9f2344fc64f69ddf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b9902b1e0c7235f5dd823784a3384235

    SHA1

    5ed63d772160fc08b2f247c5e813c6baeca0b085

    SHA256

    eaf5ba92d32888d00075d5bbc9548331b1cb432608f0a3a5d0293ddd6a0c79a1

    SHA512

    136c94f71702b3e91460939fc97a2a5d6f0c55e61489eab481cf7f82b23cbb01292697738d1879088ec415319e49d7c8c6266a063a1ebb8f179cfc7fefc7e79f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e194640636033527a71b3d6a56c14cac

    SHA1

    ebd16aa0714947ada29ee3b6c9c368eb921fed4e

    SHA256

    61fc7d0bff41413d1c984f9b1b646cb8b20531aacbdf0ed21beddc5baeed3725

    SHA512

    972e6dbdb6307d62745f6b46032a8bebab680e3ebc77979a0fa933e1dc188bbefafba896313950cd9ae4b6c7d755f70954df61eae1a227674aeea914244aa02c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    20877194feaaf237d77014d054b744a4

    SHA1

    245bd8caaa966d669d647940309d32ba3da86c07

    SHA256

    af1e02b82c2d6613b1bf5ca98fd5452dfa774774c30161a69300faf97b5ac8ce

    SHA512

    007aee0f37d36e8f0c60e988160729d5e051a8abc66abd4e8c42b7a4738275c2580158c6aa250ad7f47060f0bafff921c7cb815131dbb78e2befb3d484ba3efb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ebb001c150fd0baded23de52b2c4807d

    SHA1

    7ceedf91e0db96c042cb0f097cd4e9f4f9410840

    SHA256

    998869ae296369be0f03ff7f4edaf1ddf857255afe217e24a1169cde4c18599d

    SHA512

    68146faaa17fcb9d861b96be0d09dcdd15ce70e7acb884cb8e4bdf3da6b765ad20d5c66d25b4676f6481383dccbfd4501fd822374a34e32af9a80ff0717da9cb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    79a6558fb836dc0cc98ca406e331889c

    SHA1

    f7a90a90c758bcc5ded25ccd2fa4e242dc93efad

    SHA256

    c035e3dea05fb80ab22bf980da1334807aa97e991c46abc022af402c12f2899e

    SHA512

    613a9070d8dd363bf5a308770d5c12a1f278e59adbc6b73bcb2ae7d72b3ff88dc79e7a963797e160a740a16c7404ce14c7639d6a4cfffe40e9424092cc887c2d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d5f7efc0612274d521f2220f9de7b130

    SHA1

    6344788551da342c46c1f102e74a1621d4b269a6

    SHA256

    b8c56e3ed61ddaca71a1139d45c2913aecc3b73fb89d1283acb17aa5bb7a6285

    SHA512

    51026520a19828445ab5bd221fb82bfc11e2bcd606037464f6c46c4205bddbed6dc31ea4f62024de9d2c1167ccc2602eb5c1b0600f45610adcf9a0c3933e5b9a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bc099bc9c0e6eef03732873432c14055

    SHA1

    358a748082ca5bdf8c18671a14f5e0b2190ead9b

    SHA256

    1cefe5ca3281225e98393716499807418df4617b86b2760033c4d91cd03ced7f

    SHA512

    976f37e485d5182a2c15a27d85538c985b8dc5c35b027bb1b56a37430e527a1de4521619bbdd7be72b1815e8edd86da17ca6e7e78d0096bb668dd61434aa6701

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5c3b34b65c81ed172df3c8e18d9878be

    SHA1

    2005f900c520687af26704a142eb2b5fa685ec8d

    SHA256

    bf73f33f2cd58ff051a898cf0ddef4117681d5b29fcc829cd54f7db51902002e

    SHA512

    65183237384a12bf808fe9eef1236f33bd063945645e3e4005212581176dcf4e936569533745b13cc3137023958feaf53608b6d30fec9a053ffbca069a218692

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd857b2a6752623189d74799de73cfa7

    SHA1

    43befada023dda3fb4ed6e00f86568f44cdf8f85

    SHA256

    7dbe916b10a62d9fb7127232e9546278fc4db79d7806b50999171274380f73c2

    SHA512

    22f7f08da517c033d2b688abfae741b026511693bd165cd9f7ce231b0f5d2cecc886f03f72dbb8455f6996bcf728078979a8adfc045f0fa24a870c5fe74c154f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    51fd6ead3a8481f89157049750ada58c

    SHA1

    989e6863f33963f260b502c9613967ee889eb5da

    SHA256

    319c224cdeac9692454f4c6bd974302b26f42d53235c2beb29179dd0663d6fe0

    SHA512

    8ff40e5befaa4cc03783148f1b13b812fc2af9b9fe75229426263e9db56edad7ef282398d1ab3c547247240e282b394913ac38b963a793ea14a1f37ad0373e6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f9e2ba87bd15d1e7c0b7c5d6220a97fe

    SHA1

    21983fdcddeddd264d9051002f26940f4ecab1dc

    SHA256

    59f48ea92c0475e36ea2a5dedf468d0f0ef473f87568896636a02398891aa205

    SHA512

    84f474c8f4cd3df0716aa0ac28966fd9ff44e05b643f88373ae1957e70d0469658acd3662ab2c667cabb38959b32958cc20835cd8c3fd4fe51a554aca8b77740

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YW15VCHK\biUiKvlAD[1].js

    Filesize

    33KB

    MD5

    e2ec36d427fa4a992d76c0ee5e8dfd4d

    SHA1

    47ec4ace4851c6c3a4fe23ad2c842885f6d973f2

    SHA256

    36488e81afcbc4d7018b8764c18032b10be21aa45521c9671fde0cc77f70b2d8

    SHA512

    d1ae29d19f65ce74b9b480c82b87315634ec2e96d199f5feb423918af9ad6e24c8b436e03904d452f71562f04c42acbb250256eed73bcd592a79c08911c74976

  • C:\Users\Admin\AppData\Local\Temp\Cab70D0.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar717E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

    Filesize

    718KB

    MD5

    f401d0851fae3005c32e7b426a3db08d

    SHA1

    5e05119b7baad1add0da3cd3ef078cb52783e380

    SHA256

    afdfd97f48165eee872201b3fb3888d89198710b5810b8b8eb7e05da8bcf8b63

    SHA512

    7b88bcee5c41c5c2028aec579b3d3f1e171d24a92f44b914427d4941731def61fc35aaaa290fcf187fcd2ab5ebe36a76e9af87ed1d23f0fa50c1c6bcaaf5f1fc

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8RO9AC75.txt

    Filesize

    123B

    MD5

    695967c74a63267a9180921e874d1658

    SHA1

    4829fdca4f6c8409c6db442fd9e04b37635fb775

    SHA256

    cb5ff849085430cb5174f1488b0abc6f65bba03c661220706967edbf93a579ba

    SHA512

    96353d2ef5526b2f87f5afac6ee4dee702c89109c7963ae044012ffc0142e529b39cf0fc762f0153531ab3e51a4b71780febc060f0ad32b8845f32b33cd03e35

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LCT355AI.txt

    Filesize

    107B

    MD5

    38e6b4d46edd3900c708bbdce5f621f8

    SHA1

    d86e9ba37ad7b3e92af972b4413c0e896adc84ae

    SHA256

    592db12b6acbefd94bd80fb21e94983fe63c0ed3a572222adc39d374c7908f1a

    SHA512

    e61c8342f0e10cca855ce3afb8e9376e1986db971b4c2c19819cde3e9f35a63b2bb35bbc360c006ed4d9fc091123ea44e9a7a3306be8eff4df6680a196a6d38f

  • \??\c:\program files (x86)\microsoft office\office14\bcssync.exe

    Filesize

    728KB

    MD5

    d90325950d2aebec4be2ad546a4a4b7c

    SHA1

    a8499a596a8dc24c03a8378adc42fa5daf9cd333

    SHA256

    f2afe72ecb544052acc8e84e76764a82367c0f5f2156a27f8592ec6a831d250d

    SHA512

    aa5e963e46aad08a3b9a6b33ff44440e276f36e8a22a168cf326e7eb791fce867981f4bf023a2403eb82328d85e189986510295a9f570ec4ddccc0538eec6592

  • memory/2660-1-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2672-35-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2708-22-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2708-60-0x00000000003E0000-0x00000000003E2000-memory.dmp

    Filesize

    8KB