Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 04:34

General

  • Target

    d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe

  • Size

    440KB

  • MD5

    d38cf91a537cfabf451abb0364a12373

  • SHA1

    d508bac952cb07634128b7b529e66c36529af0a7

  • SHA256

    1c20922d342bcee8fcd2200643cc436d94354821417606b82966a351dcc05530

  • SHA512

    7a5c4fba36441a2a4bef72b75931d9888c5e1d23a4ac7a197dff4785d73350e7d5b3dc20929dd8db194cac4cc8dc83e9ad89257cf5625f36c96f1c1c0d2d801e

  • SSDEEP

    12288:nV6s/WNzhczofNu/l5GMavm8hdMD7YALsMY:nnekzoE/lgMz6MDJsd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\SysWOW64\explorer.exe
      explorer http://www.52hln.com/
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2876
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.52hln.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5af94730352606eabaaaf406db5d16f7

    SHA1

    dfd45f3f8644b5bce872de65dbf9a413930b420b

    SHA256

    56c721d618b7fb53aa1c1744498c327e02565fcd4e66db0b23340a6fb62daec6

    SHA512

    3424814107567bff6396408efb4ac11b114a4c53d75a445b47446a5b6f28c05aec3d82c5591e64c3fc671701b542c0d8417bed125d75dfaf90a2d4d2c510a2b1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f11878d6bdbddb2926b7982c0c12e4c2

    SHA1

    dc9ece393437a5f53f1305bd2089b0e0595c6bd6

    SHA256

    8a7328dee4d3b470c52f16fb2ac864bcb987d79be8f9b0a529506729a384fd8c

    SHA512

    5614941eb764f2b0d10669774dfbb56a3e9c19151b6c7d4cf3dd01d0d2ffd4a0500bb53affd264bcfae2f32f8fa3720a0cbb8c05ef09ecf2525bdd0c541f5518

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d90062d21ac7dbe64d337b828f3ff65

    SHA1

    3b734ec2d18ae707f53a3932cd65df1b2749066b

    SHA256

    bcffcdc0506a9fa17833538c795b6232f8298c318b4db70c17f9c8bc9f027d98

    SHA512

    a2dd89dfa16d739076a709bc8860b188c64cdc4b2c776a5b0e5de07b104fe6f78ec0fb8d965eacc9d026edbadbca32b26d06af055c51d766e90dfad9e4765638

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6e92e2aa8b5438e81432de1fdfb19356

    SHA1

    efd8ec52a33adbae9288444e1edb9766e6d9caf7

    SHA256

    2d40625c258e3f74abb51ad12725335a16cacba325c961687583d4634f573b0f

    SHA512

    99e95293202322bc4cf7f7df9ffba60d2e465fff97d5653341960a2b23e76a2c58c111aa9d747935d8bd7e97271f7f00a5340b65acf85df4170b0beb46aa4aed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    074beca7fadd5f2857a2a23a20ecca93

    SHA1

    3a6486d62f61bbbf8ca9cf588eb26753eb05520d

    SHA256

    c30fd4c7f55ea4202eda6d8c03152fd03d4b4e14200f4bd25ee96aeb101154e8

    SHA512

    1bbdbea7a866397545f6bb17fa5441bbd13e703695290832924643b8b8ea0ae30f499cf5af3badc9e9e4e95f00ee26e21dedf3b3974e51f568c0fa5f28b2844a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6b2ac4a173c29d535f48b01dff5be60c

    SHA1

    32b3ba850a4fa2057c087a261361ae2e07bf4915

    SHA256

    610c2f45a73e52257e356f58935fd0f1746d45d69a0064ea4c2a4cbaf2041f04

    SHA512

    d8d183f9c293bad99a48ee2de52e766e00a6d283bb58382bdaafeeb73c87d5880ca3c6b1dfb5ce1298eed9443d83de2cf7af37d772b936077133f2d5235e3970

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    067d4c59b63ff47ac1e01c203e4156ef

    SHA1

    36e590e4d86ac85ffd8de7ab7f9432804356be15

    SHA256

    d167867abaf662f83c72fef4ecfa801d78a6991d97536e5e8bd823fc01ae9132

    SHA512

    a2e8d629711fcbc34ed8ffc6800d07bbdce7c7fc8a4c9cea82bf18bfe16890c06d2fe98c5273b3095db694840d06737f20923beff1121f2c5481b32bf9419b82

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c7e0a9162d6205a75a57074dde22ec63

    SHA1

    dc0837e305d117e8f839dda6b32574e1b1c0c9fe

    SHA256

    05ceb5bc53fd10318bc4bf79befd69e94065f424e12b487e7572286da2036403

    SHA512

    2e21c38e1c9ef2dd068e1f21ec6a6a7aadd4f1d5b96181ccba8c72a5ca3cebe6eaa96d7f65baf0a537851cffd53c7a90ae29e2c62d87026c66ea5afe6c22abce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9f9345959de2ddd5f1b435fead4abaff

    SHA1

    4a87b397e2bbabb82b0f407db96ec79dd53a323d

    SHA256

    2844270fbc1bb451c2e44165801b913d1e8dd6fa6764cf9d45a984d93bdc47e5

    SHA512

    ce03092a3be727e5dbca9d4d570bbf17b7f8852700d21ed2f58c1c910aaab24d597b1c20a3cc78ac384a9be017cfe6d37c1a218612fdbaa800f6438b00ad9f09

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1db215b8569175c3360f7344acd51aeb

    SHA1

    b2c10a2a356c754d5ce459f7371e8ecc553123e1

    SHA256

    948e89c36cc15655d8f90ea726cc9ffcaba6c84b463195838cd3896570113523

    SHA512

    825c35e15cab9e4827cdc3d9014be7dbeac70d3c49469d9f67b1bce642b7a68202efc84c7368a4610197f5df3dc74c6a13f1eb061266f7dafcc9251cf1dd9d12

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3c8dcb292a8e246d86a1327d6277d68

    SHA1

    20e15bedfdc3a9c3164e1e685779f1ede058fd92

    SHA256

    a071cb919b70ca7c4306bc1e4f81f5290911e6a99f54e893783647e7b49bac33

    SHA512

    802488fdabdfce9230f2c6d3930e4ec1d098498d933e75525b03737924b99b7b8242ccc6f18e05170fdaa5a69d8bd1e616d3e0ee08fd98bf91e293c3cb0c5f0c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    642296dc36d6868627669bfb4664d125

    SHA1

    b44810c469a7fee71459578290e73d5176278ccf

    SHA256

    8035b4dbe2eb21be711d6130eaceb7f6129ae657e859f8f7ea395cc93dde79bd

    SHA512

    34cb4695f40e3f5703b6c3f3ffff4465f1750cf0ff16614de580fa0aafcf2314e052cb420e36b3dc057a225e854900877ad08d6af3334794d20ae63c04b15a7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    27351c0cdaba1a0408bcc06100cbc9ad

    SHA1

    940e974f96fc096e408376811f9e70c8d44b83a3

    SHA256

    71c81ae4f8061bdda5fe258170c25a720eaad555a9df9a060f766c5a2bf55eff

    SHA512

    9003a80f4a966977a764bdb4da013eef678b4911baf76874897cd792123d947654b99728b467ea066c1dc696fab44aa0cd523ca69a3664cf96505855f6a0be2a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e5d3c71cc626040b9be15c27dc034d8b

    SHA1

    1c5d6aab5dcd64faed209a40efb16a96c518c91a

    SHA256

    6dde36e0123c716289bac9dfead67c8064b752560fc59584bf1777fd239d640d

    SHA512

    6e78aebc5b3df4f2f980dde6508e36e6d03aa9e9b410f72d53df40bb48f73a6cd18173d1af5741403689762abf985d234e2898278e31cc1e5e57cf442adcb892

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a8e72d732b790509e64dac594d19e0f3

    SHA1

    3a78db2b7471446db1d08f988a754679b82234a2

    SHA256

    191ab41632e46983889f1b03dccc3d4eb300a3d3a11f6f91597988aff6b9712f

    SHA512

    a3a20a6055fe92acf3403383f8e53c3b3f838225f8acde77abde652c4942c230e6a9fb456070b1f890ba58854f9984b8cd4b1143961a5494820d04b5c61d59a8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    198377757ff5b98041b6434fbcf608da

    SHA1

    8cb0433d167e5b6e8f22a6c4f2de0993558caf85

    SHA256

    d5dba438338fd3d10454ab8ded64629bc1423c67ab5a40e22a2428202b0c457f

    SHA512

    b941afff0e9bd09d5847e08365ed5010ed7a894bddf22051c4674570a5f2a6a2fb986ac27d34700a10f6c4f3d42f57271ededac59ff572135d10e828211852ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4aa2b9e65c3f837d3775c331cd611596

    SHA1

    e1707de0cfb7505ed1c687d2e17373cf4edbb5d3

    SHA256

    4dcb0af4ad37343772f983c613e1e8cafa8ccebd7448a71623fca31027c247bf

    SHA512

    944e75b5609296e205b7a0c1f38d2eca5c88e79b0ce5899cc8771d4df2fd35465b2752c2fc891a9c0db3ed68d5c2a34a70d2d4f7f44c40111a7e5adecc52214b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    acfe9dd3c96ba4c6c3a1572a20f10869

    SHA1

    53a08109125fb2dc6ba70915978e248bbe85456c

    SHA256

    adf5e60c14a39cab0d4c9d61239dcc6545891e07a93dd7abbb916df62af4b151

    SHA512

    18127a32ff05725044376541eebde21b8352db77863fb1b013d917f35874c516e07a187755ae867141cb1b444af025085370084efd5225e37c72de073f8a5b75

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d5bfb22dfd6db7e5fce9d555b3b11f81

    SHA1

    aefdb6c28c4dd683e0db68bdab92592f212d1e17

    SHA256

    08e8073fbf528f3ab6826a7e4f5330022b9ef628d509670f6ff5c1e665811029

    SHA512

    d0840a7e0bfd29dac2eae34bbcd760850deaba68fd252765c186137652936a7a11dc9481f44be07cf5bb6338de309bd6a3a2de9d3fa41d1197d7ba2345b27eee

  • C:\Users\Admin\AppData\Local\Temp\Cab1641.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1653.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\SouGoo.ime

    Filesize

    52KB

    MD5

    b60da4e2e5aceba3ce3d87ee2cd872ee

    SHA1

    9bbdbf1f3ce2c000a86e0473da756a4b1031db41

    SHA256

    b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

    SHA512

    664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

  • memory/1896-0-0x0000000000400000-0x000000000054E000-memory.dmp

    Filesize

    1.3MB

  • memory/1896-1-0x0000000000400000-0x000000000054E000-memory.dmp

    Filesize

    1.3MB

  • memory/1896-65-0x0000000000400000-0x000000000054E000-memory.dmp

    Filesize

    1.3MB