Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 07:27

General

  • Target

    d163e78e89569cc4164bf0ae17d49feb_JaffaCakes118.html

  • Size

    110KB

  • MD5

    d163e78e89569cc4164bf0ae17d49feb

  • SHA1

    33a580856d662b2a3529c50cd13a6b8ab5476c67

  • SHA256

    68e751adc084bd1f01863efae71273dbef20296bf861be49bb97cfd19d89dc9c

  • SHA512

    a6db7dee7c7e34ff6c4c91d346982fb2399673180c2746fe8388cc058fc3764bd3f97db245f301be61b2f0378f4d707cbf5889e4bef43c63b2ed5f55c32dc14e

  • SSDEEP

    1536:nn1ICXR/HOUBMPM7SheInewr5tpI8exUv01a2FttKZjOxwfC3eNHBnJH/2Nhox39:nn1ICB7O5eLdep

Score
6/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d163e78e89569cc4164bf0ae17d49feb_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 7028
        3⤵
        • Program crash
        PID:4200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_09E5FD68127B2EBD22C529250B8D2273

    Filesize

    471B

    MD5

    e400427ce8f210a9c3a85444aa57c72d

    SHA1

    9fb62bc3ee3254f0a6e2257b21c9c70dcc5ce239

    SHA256

    4332f5d8cb2cd04bcf054a3edf102ecb98653dc08601c4d867d663e9bb258c25

    SHA512

    ede559e81231e3e1f68ac03e6962218bf4a9020d3ee548c1b8fe9d1bd772a5025b8bf0a161eccecc6b4f5db20c3b27826000a8f21a987e0404bd69b62ce96558

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    1KB

    MD5

    7fb5fa1534dcf77f2125b2403b30a0ee

    SHA1

    365d96812a69ac0a4611ea4b70a3f306576cc3ea

    SHA256

    33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

    SHA512

    a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    6c65c227732deda0f0f67007f0870c4b

    SHA1

    e26811c4f1426e28b57652e012c96d63228a6b14

    SHA256

    506d83ac0a47ab0feb15ffedd6caa5f2ac076165469a714b5fb505af66aa538e

    SHA512

    3c0905316c0b5852865642a3d69198bda877434698a19ab2f0a22bcc1d9dd07c87b4ee104942e3a6d30e761352544e20a7156cd781760e5b65b12abd5ea819e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    174B

    MD5

    6707cbc147a62dbffaad4b291e00da1c

    SHA1

    1a4168b38ad3b8fbb490fc475d4ce343e42ed6d6

    SHA256

    70996cd9d37920488f7eaca4d73d2dd71e53a10e2824d93ac4e2940788626844

    SHA512

    305b486e8fd2c7aac00856aa063dc1f903e7b08078813bb1a7b39cad4243aca97edc76bdbadefc03403d3656f01412c747bae21d4fd0080523712df077964ed0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    174B

    MD5

    ef603f80219b8a54d02c58d6e2b6d70e

    SHA1

    35279caffe2fbdadae924ae8945f5176480b44e0

    SHA256

    79d75c78776e521f09d3ef94f5e03fd6e24dbc7c59474d649e851987e187a3cb

    SHA512

    d28c8ee922d9bc260f87a0ebadee7c7f376ba30ac914b821899c96b22717e92341712a276b2f3b009e7e3c83a075f2c607f38ae8ed2a85af70cd663b951292bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e3b8197b47dd683f36de1427715726c1

    SHA1

    a7bf066fc28d56b0ba061455a7a7a978e74180df

    SHA256

    e55103389a8b465f6a8174053ce6015cec04f0d3c1151b154e1046a18c4a2569

    SHA512

    4563cffae66ba5d985037d443e7ab554513512b977255c6ab1dfe5e96125dfef184860e08c8cade0a5cbfedff2d1a08fb55874a56d270af512128c2d670de82f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6213ec84cd61682bb1f88fa8ff35f04c

    SHA1

    2bb431b5ebb5e7c20222a9ad8cc1606b8ebcf250

    SHA256

    3aa4351a405ed59048dae92d5d78a1f077eed2971ee86a5414a77e6b35986631

    SHA512

    818dc202905daa8ed4d76ee2f7821667ad66847816256e8d60e8830b7839898280e7c94dbdae784a8f6fa0d001448d0b7af899ad7c7fee4ecf2c52277a687307

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    438ff2fa89f39454fad53c7a63f52e5c

    SHA1

    ec3c70404c3009939f61453e4f7a3aa6f9f2e89a

    SHA256

    0c234e28fea401263074e480c748656e90de861dac65776ac839df357acbc597

    SHA512

    772929f2962892aa7b690522ea9459a7320196332eec225d6e464c3f05be07b93b119ce41dbed10d778acbd7f1957037b139439fa286c4186d4517ba0340bbeb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f129427bd20f44ec88a281d318a82005

    SHA1

    a12d31eebcfd66eb034aac04df3d2626ac204c6f

    SHA256

    0f0d96fcf87695c2a6ac57e10d9d15df2722a8f5edc6976a685d4fb43878fa93

    SHA512

    ddcc9848afde60f67a921569d5a7726677dd8bddb4f3530bd1d590c20b2ded431619af56edf0d6db4f7474def5442250a7c039e41e40ef27951d6bf764941c7d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a12db74c1747230fbe8e4ca87c2fa9e2

    SHA1

    be085ccccf7ea61dcb5195f8330f3108ffe8c013

    SHA256

    4a24118ced233604dd47b69831a5b46b4c2c30f220519d3b5efdaa66a7f7185c

    SHA512

    d408e4b68bfbe7e5d02666c62180e6655f6cf601ef98afe1c20faaeb425627332a26287b53c25e27c569fb4dc59303e0542ec55c2b6a4effb854889c2a336e2d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8c39398cc04d79e19965abb9ef30ce0e

    SHA1

    140825804448b3d6c441f8c7d7f28b4ebd86aaf0

    SHA256

    34f0f7995b43769b00f0ce3b5c297cc764ffae4c258beef85dfe3daa70ef42e6

    SHA512

    97a2bdfc432396b0cf6e03c66e8b66687f813ef237240d89df962fdf9f97eec263d6fe6157549b168f3798806ff3a1aca4d6fd768e71c271ef59a89c9f392aeb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    442fb68c0ad8c0a328db50642302cfee

    SHA1

    f9e893f91bd9e7fd0988020f5a85695136f11238

    SHA256

    2a1c184fce7a3520015083b7313210bc3ad7cbfa7290c85c13be9c90fc9845d5

    SHA512

    6f0d6e0596ca1b726c47dd06e34490e7a86ec0aa3632760937efbc9cde648ff084deccfd7e1a8d6bf8788974b626b1653ea42b8c145049ef850f1ee2f2c91aed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4f2c3c0e9a35f619f3d28b791394b688

    SHA1

    3cdfc10369ffab1654008d5f4f6ebbfba9766421

    SHA256

    7d1e7f6cf2099970430d922ba051e996c3bb5241277c6c70aa3bbfd1d1633d0e

    SHA512

    57291953fb7d016c1a23cb64ff63eeae1e73560afee94ba7d77a8de439a5c10482e707801f8a94e99df01c14dcfe55e7aa5252204d4058d5b9f92ff535812206

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    00c06bb6d93d7f1daee791a9e32e4817

    SHA1

    eeb8232b688f7f010cf8a65b28d3e7b4d9d172d3

    SHA256

    ffe770178bb8fcfec93b6b591d0a253a30bcd54e2322d2ff92a8ba852d4cb1ad

    SHA512

    11e7b860347f9aac72b314b9ae3c4ce61c302f0494c9f7bd64078f9867c69d472d01cf151a2ce108a49f3155113dcf7028e0349ecb53ce27092a2e2b1fa0ead0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1257cd59b1d5e75cf20ec117af203fb2

    SHA1

    2d26e9cce7d4e42af90b3bbb5621179937720a52

    SHA256

    c2d7f427c1c7dfca68f730d0b38a3eb6dba17059a60629070467f2c8e999090b

    SHA512

    e6b47f0b3bde592df929fb79252dd19948330fac8bf8c450eeb307b8521f3eceaba134943b264c73bbf453b9d8d6ed22b12e882b6e860d652ae37d02a7971a8e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ddcc7cf257ec7f48318026a6fad21b62

    SHA1

    f974d3a68a9f587ba04e934745131cb383a8bb47

    SHA256

    dd4dcc2e151bcec932e7d26951ecd80fa4b920cd3715d92c39d46147e28fc534

    SHA512

    e7488e71d2369c4104593cddd38c474df090cccafa3169d72c5009abe8474836c9f961f401fba6bd6b092249bbca0fa81492fc479360d3ec45d0448407bb0eb9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    170B

    MD5

    1bcb1cef4d72210121107321d6802d9f

    SHA1

    f03e6bfd0e1e9f17f725122b94c0faa5823781e7

    SHA256

    0a590dcc0deaabb4d794629a454dbd9ef25956cce2850b2817d3447d9a423a79

    SHA512

    a54d72dc02b973c179a3a0aad9dfd9aed0fbd21b2765f4fa03a878e0a12ae3f57f426b5635485da30ae7c266030b9b4ada6512eb9f8b5a39a067d0ed0798e66b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    170B

    MD5

    e8668c6f2c5d25832c88cb5300e80a8c

    SHA1

    edf9f5f049013bc305ef0eb41c1625e61930db36

    SHA256

    7f4ad75b9dd1d7451e37b074cec7fe600cb16599ecb0e522d52da947ec595fda

    SHA512

    2849f3e735da9533ebf145349b8ccc1a101f1f772821bc2a31716a1295c16569e435372b277fb63f80892250de640d96624b5bafc16f481bcc459738cc94f199

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    8c077468cb88291b86507b588fa15d5b

    SHA1

    60e8af239584af4adee53e233990816b1b8db6c8

    SHA256

    f83ea4d8d15722edc300158158636776e6a0335aeed662eae6cb09bfee1e88dd

    SHA512

    13939ac8ae7d116e754de5b8f5918e9f9393a62796d2ec4eade3f001f45a8132685747109c61daebe5d1dc12a2d3c0942e58234d13cba334b15c7c4ae8938c8c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\e-202020[1].js

    Filesize

    7KB

    MD5

    12df00d326d9d7ca84ba60c0eca1f7db

    SHA1

    bc2af6354bdbe334c94b8a33d26357c5c3156925

    SHA256

    5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

    SHA512

    9b4e38e6b3bd0ad3a494e62c56cf1c59e52272fb77d86d7a46a1f873078ff154cda9bcfd8a5983ea1c980f3d92cdd597a9728a03658e13951f773a2299f96429

  • C:\Users\Admin\AppData\Local\Temp\CabBE71.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBE84.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b