Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 20:26

General

  • Target

    d064b804448a22524d6042e322c28282_JaffaCakes118.exe

  • Size

    834KB

  • MD5

    d064b804448a22524d6042e322c28282

  • SHA1

    622d5c03e5e7e689daf162804a5546252ee1f8e1

  • SHA256

    b4e9d76b65136f061a3f1897e2979cf3ca7972a3fe10821f5cb085fdd7c47f71

  • SHA512

    7fc551bcc8ce4a658470825dcadeb12ec0e05f35705b18f1bb97f7a0bab63650bb159406722d877a8885dbf987f3300269122bc2836ffa660ab394a2838c6f0e

  • SSDEEP

    12288:XaWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8MEFmu6KMWoLnG:qaHMv6CorjqnyC8MEUKMpC

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d064b804448a22524d6042e322c28282_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d064b804448a22524d6042e322c28282_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2324
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://hackgame.org/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2892
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://hackgame.org/videocrossfire
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f8a87d40a0b58fdeabae26a9152b2d9

    SHA1

    0a41368a02d81052f3d02599c9dcd2e95c365a2a

    SHA256

    b34fce39f14e825655f0b021a2e724e78776e4752be47d0d2592df5120bc5976

    SHA512

    7e6b9b4fb8a2f8f16c41866e3c82da07f7335ed27996fc7d981345595da3aa18dc452dab7956ca2df26c1cae8d11b65eba30f9e8bca34bd407be97cef17f9df3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a4c6ea0380dfe073f48b9324bb5bf848

    SHA1

    6406e0588bbaa9edac92543a659ff7406ee260d6

    SHA256

    518f79702b9a47dcfb548b7e3daf5d59b2d88e43f922df2876d64d94b19802f1

    SHA512

    50b60ae0374f86587160bc31e338de0bf12d88e97379fd9d4af32a864e149734327f8add119f16713a5a7ece1eb774d155e426aef0b48df60ed63b9274e22897

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3b54c40b0e65e41fa9f8f8f37108373

    SHA1

    eb98653f61b1d9d9716b6bcdc5dc00f7b43361a3

    SHA256

    74f50e820de667db63a31a74545404a82bc0e0509ef136c0b2043edc02df170a

    SHA512

    d5418bc738d42fc1f38fd4018a99b0eef0fbb1e6d01a5ecd18689269c8d714323aaec9a7e7412bf6366ab10d54cf95e883786bc3fda87b660dfbeffb6c91cbae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4cb4b88981abb99c6c44b83e9634799a

    SHA1

    6b149fe884a0bbff397bf4f6f45e06bf80d7a321

    SHA256

    938f9c376dd01c63692cc10f3550aafe3b08a325d0bda19296a7584c7aa5278f

    SHA512

    f93ad54c701f9f57269b8c9cbd863b593969339ccda9e08f9695e5c12200627dd66c23c7faa19d981f37b2f2bc84b8e7975be2b54a297b96fbe3dd41b1f11f91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    13934d6795bb06a336f49490aa93ecd2

    SHA1

    0fc8818bf62fbd89669c1e39687613771d609a96

    SHA256

    1deceaf397575f39910f3241d7f0bd96cd9f0b607f5ef5206c3d3c99e92de930

    SHA512

    59e613767b0df0be29b2410aa9b0cf99479f1fcc7d65afae3a020526d9abb8b5cd396a408a236075a622b323e83628bb5beda595142909618ebf9e6ffe7e7fc0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c6946ebaf60ae77de38730f8b879ca40

    SHA1

    db26630b325f981b58204515511baf022d1deab8

    SHA256

    21e7f5a04d4947d24f897c5f904f4bc2bf37d9a2446db1ed6cbee23a82de9b4a

    SHA512

    c4d3c4edace9c0ae51c6e2fb6eb9b26e1ba2f375118f03adb416ec7ff0ab8bffb205a8f5094c4945c55294fe2127709ccf87138bd1b1983f3b736d084e2d9df2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7db86d154eb278476015c9c3e980bdcd

    SHA1

    3a2faf74eaaa8c1fb271bcacb92434c36693ff0c

    SHA256

    10142584ff5957ba101db4e5339214a23b23002545bfe37341bb125ad2fadfdd

    SHA512

    2c8c8eac36f7a461b64f23ee81077bbb66c64cee59b9d5443435b14183e57e567607ce4962a7e8398276c674c406d2c01ebfde431cde5c1be6fb6564d247b235

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b0d454b9e8b6aa6771719d669c768df

    SHA1

    020237e15117282a0a45feac1e5401686abbef01

    SHA256

    fa40973706cf338dbd152fac6d4018453d6d0e6d7449e36ba0c0b91aceebd5ae

    SHA512

    f385219f768c6b591cc037508565ec5a564d33d9f32c762ff7feb8badf4570df60e5e5e6069ede5eb9dd9043578017f4c24b28a74526ca75d974c843e19133e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f6c390bacf57b5072bfca6e05187923

    SHA1

    4764f98f86928edd25482ca04c8f1885a28ff00f

    SHA256

    d9ad842c34719bbcb6b2660180100ffb2ca086e39c66cd71be10ee5cf7ad55d9

    SHA512

    ca2cb7013f6210d61720cd1b6068269a7f27115ce5b22da76757b5fda8a38747a8bf1de29c946cc142f2225cd0486b111779989cc5a0e8871bc311e45751f58b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a597c20e87fb0af4c8b97f85f1ae9c43

    SHA1

    c8f2a7c5674daa4ef5851f387ea91d26a6b6a99d

    SHA256

    5b7c66d63b6fabf38bdd71ebaa6ae915b7a65ca8188169dcfd07962ecda8d629

    SHA512

    250090ebc43eeda9b9afa3106a0fcd16b3a7a21ad7177e0723bd3014d56a9d12b7d51f48d967a2793f59432572b9ded657f80c22b21c0a7bbe073ed6a68e70ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    543fdc4aef6bbfe7671d65bafd9b426a

    SHA1

    9131aa27998390b1021a701655d29c21a06d3e4e

    SHA256

    8dff5a52d7f894f4129146202f68e9a9910bce6216c61fe31691cd18745b229f

    SHA512

    ee807c61a6372eab2e7641a14cd76147cc61c5c9a86b0b0488de605d8c634d2a73d74e0ba1513293ee6bf0ec838766df9961e9c33b8ee6f522d2589fb095c279

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a862a3abbea3d73339a87ee832f3cfb7

    SHA1

    baba9b775f3d55e5a2c58f31ac16f118700c5f44

    SHA256

    dad0348e20fa1f1b756fa2f53201e67ea73c426b4d005453ee79bfb038c53299

    SHA512

    bddddb8c7b159ec1c51de71cc9d6af5a9cbea783ef5d5f85149cdb4355844ef2c87da101c9ffc43f5551a7d2c8b4c809336d749a3fed452ae33231093c7c98fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1cb50a085ef55f37317dd6b71973b165

    SHA1

    00916d49f241dd2b7b0e107b066b73f49dbf2bba

    SHA256

    3696adb0c79ef8b05f1be657628bc34d88859a4cb0e969f96d7ad0cd3f3d7d54

    SHA512

    554acbff15e6d55c85bdc77178b87dca62217cd15f171b741c34421e2015c76c783630fa3d980539c4762d4acc4d0043e83adf7f9565f614e95f288e469e93a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9dded30e5aab27b5e913d3d1c5ad3ef2

    SHA1

    6f563e5cadb4ca41ce7a1ac841d03b90ada5d06f

    SHA256

    f0cf8d56877b8c919aa57cef9c70e3d7e9acc6a4cf945d0fb3da671414720134

    SHA512

    31374465b41145c0e43cc2b0ad8a31aaf9687e88123ebd6d8b1cb1a347a45f9c4e590a0606ba38bc1d62343ea2021758285bde5eb7afd356fbaee44ba2069ec3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28937fd57ca367359dcb45448d306cb5

    SHA1

    27a90e58337d4d410528d9a6001e46b6500f1274

    SHA256

    8aa31e6455db9848b3198e74346316cf5977179e5249280ce3f42e7b15335554

    SHA512

    34b8f52d778262d1be435229f107466e53b82681f9bbce0e6e75e3b524a8b4492b591295f14680737cdfe5cebee294733fcbe77a8613053e7f89ca3b4067edfc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    256cf033b1aea0ab70bb0038e56d1948

    SHA1

    fe5aa818d613451b29af8bc62f0c66b4258ff81d

    SHA256

    97f74243931df4494f270549e6a3c73b9a4ea9598da62dc4a1f991705493f3c3

    SHA512

    ce3a13c08c33a02276174c9ccf3a85793acb583b78e6100229b437b2f0d42ac770bbb3a7d55e20d1af0ef7a5a728e151d83f4b0d7f56a354b3c6c0712f71b809

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    61a39eb723713e02a2eb89823d4cf561

    SHA1

    fc121f2f913e50b02cd81e931e293c62828cb199

    SHA256

    e72c1c9ff5d9149632b6d6149e6010d7d30d1446419626e6b4eafde43781180a

    SHA512

    5fee301901270abceadfcf2cfd3ac708f0a9b698a79524b05337b9491e6d8ed03ef85c97c4da1d06ce1e4d12dc9c15b38e233863d64a01b9b28a480b54002c61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9d92928dffaddb227a4ec96b223d75dc

    SHA1

    e3064318a38ac29ba631e7fdd485c60ded41f2c9

    SHA256

    d8e81ab54d9969f0fe92eecb31b96311e5941d2c24a581c8a4f0301c03a436eb

    SHA512

    52215ebb8c79d16c169eb1cb150b765d3f951d9387e5c423e9407f9929d0d73b636f74112e51ad3781214a000afb7820a1f679961cbccb954fe4c539a7549f95

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    35f9510ef5ae7fa3f6d2871ace09d2b5

    SHA1

    198f854d1f2e2a0eb4bbfd4969c89a1654e7b587

    SHA256

    23db84a2515b2e29d1e40ba370105a0531b4977de14a400def92352f48ebb95b

    SHA512

    28cace3f5bd6e1dbf696b973888018227ef141bc147c5faddf5839b70d14b2947e5cc4db6a7575f84133bb49e2f68e49645adb104d3fa4eb6b4074b6ced04bc9

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A875871-6C8E-11EF-AAC7-FE6EB537C9A6}.dat

    Filesize

    5KB

    MD5

    58d8ad1d7ef5b63dc2b407c98bcd1969

    SHA1

    6b6ea7b6eb4e299b3a87e2f90b6bb03edbf03312

    SHA256

    1152447346bb3e53a6c28fbaae14eaac2a81c03212c073006047d15c679d93c3

    SHA512

    aaf1cc478524ad0508e6d04f102e1d7858c68d615fcd6277820d9e75789257016832ea7e183393e096ac4bdf55b0ed50e1a87cb6eb2397525ca6525d00804b36

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A877F81-6C8E-11EF-AAC7-FE6EB537C9A6}.dat

    Filesize

    4KB

    MD5

    7560f134db1db2a519c30b649efaedb9

    SHA1

    e9808c7f144ed45a81b427c195f9753b91c1ef73

    SHA256

    52f48a734c67d8962cb4d0ca5651ad52d4eb79394cdfaa910e2c09a2ef067a51

    SHA512

    7c3a87e31d084bb064125ec5ba9f6e5014aa4e87feefb5516b7631fd88e329287d5a10ee271b423854ec4a5688a0441abedf3f15a3a57980601f90e74af3060d

  • C:\Users\Admin\AppData\Local\Temp\CabE987.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE9E8.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1908-0-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB