Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 14:12

General

  • Target

    dc6417bbf10c63ded39cc412437baf09_JaffaCakes118.html

  • Size

    70KB

  • MD5

    dc6417bbf10c63ded39cc412437baf09

  • SHA1

    b2fafa9b807e5164d03f1bc3876781452897606a

  • SHA256

    3f1d2a053bda9d7828b01ebc15f5a2d5f6844f83c1fa800ebdcdba1a121ea352

  • SHA512

    b0a64f80d50a3f4847393e571677485e728372e6faf0d8e690b1c83f231b3a842f3bc5d2bc246b02e3592e23c7f98f5fe7c5602006785742548d4cabeb5833ec

  • SSDEEP

    1536:cablmYga37vnIUpBk1II/C3CYsZ2svA+8XvfnP4x/CRY/tKJzak:cablOCvzpBSzyIZ2fX3P4x/CRY/tKX

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc6417bbf10c63ded39cc412437baf09_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_4B65292BF8E4474E2D57D38A629C5318

    Filesize

    402B

    MD5

    9ab8c1d59006d35c89e10091529fc7a5

    SHA1

    451ea1a7e3e323db6985022e67fb9341c64df626

    SHA256

    ca89c35366fc2488c4696e840ea3dd2da7269dda2b3ce04cbec668debd878d87

    SHA512

    80c1c2b56394244231539279c7ae49acc56de28f69436630de6f04e17e0615001d48a5a62aa2c08f6803c9410f5861f7dc49385c484c74b5c0261cf343af05dc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    64fc313b6282a4dd35ead3aae8c3b295

    SHA1

    aa38f5140b2d5ffae5cf7556e1ef8b9e9d412ded

    SHA256

    e13581b203a98afd521b57d330e798cca99255538a7363430a704ba5fc876e93

    SHA512

    415020ee3baa0527f27e43cf3f694e8e8ff0c8fd3b61a90aad145c4cd768a306e0bfe4a39a10f32729eb07a347e1e3c2fee5e48751d68332cb5dfdda62c4aa94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    773722c5ab516c0ef9a6702cd9df8bfb

    SHA1

    c406800816244a7c87c9517730ebba33e5c4215f

    SHA256

    b5f7a4e0ce3bde773d019b49f67136c605216aaf4d3045184e4b26dc64718d3f

    SHA512

    f2374ebb1a679104a1ae0d176efb43f77284437e867130708339c790d4cf6e4cce8b33725dbb19cf9e604568a9c784ca36506693b9cf3786400c0ea300b4a158

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    632531a47c4e0f0af775b8be1da7c919

    SHA1

    7251270dade05b43fb3fea1a237137fd6c56ec1c

    SHA256

    b5b76332c98e1def578f6b9f34b4d7e213fdf7ee22c78ca6c5a27958feea8b55

    SHA512

    61cec925722bcd035625e40a0d371617669f490a5f086ad64a98412be31377770b68a7d0fd54ec149bd7c1c04dcd4c11d23575386befa271be83aa0ff3402f8a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5b8eea093587d13f00c55fad9a70713a

    SHA1

    98cfb93495f1483bddad933af9cbf1f3aa530dda

    SHA256

    7d93ae3a48e9d07ba064628422eb7561a371d2cea8ca73400efb3baee986410e

    SHA512

    f1c8d11fda445e51fcccdf67c329de894370eda75529733885fede927bad4f6393b12120051dc9dc0fda4234b7540084bfa30fed59425aaf072677d591a36326

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    35db111bb851f188d53590d0e8e5a9e2

    SHA1

    65c9d9d198805876aa32f7bff456e9348249abff

    SHA256

    7e989d17b7c4f0dca9cbf1205bcc23de5548be7cc22d3509d6c9edac132816f8

    SHA512

    4b5aa0bb981dbc616519bd901ada1d748b8f020ddbbdf4df36d9b75f8e8f161d10dce2a9593011b31265e8a0b44f827e32719a7f2062fa42ec5a2e3d0fc0e76f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ef57997efa27498dff77d579ff15aaa4

    SHA1

    a02a53316e934fa412f311f17b23a114c8f84d00

    SHA256

    228719a1457dd7b16b51c12018bd453a6eb09f2f2dfc177b6c73c126c2c9cee4

    SHA512

    c072e6b611ec46ba6b822d83e2b748b119fb91e6e607ff5f017208b196d671bec0309fe42fff57ed938695af1ce0915364940ea4f39b1f6673f3b9d847b539c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    633f5b2f05af115324486ea3177d0ce8

    SHA1

    97159832182c4495e17d24c01afb8f5395defead

    SHA256

    226d44ec47b6540981f26aba04a0cc332e8a92b998713f1c12c503dd744a679f

    SHA512

    18e05d56e25bbaac846851a033e9396ec89b480e683b0ea2f77c43fdf53b63267fe8728cf09a6872f3b191fecb9e1827832b16ba3e52abcdfc93a090612d5230

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8588a4e9cf7d3f1f221029374b88f525

    SHA1

    8cbc79481111881161429ea20f661bfd27aac581

    SHA256

    c816f8c7881cbfcadf711c39e85919f19a219294584594abd741b3ba2eb2da4e

    SHA512

    1c82f1489e6e3a55156848e79439e24ecbdd353d97f99d0f59c47e974ff2e89719bd6e03f2c4f56b0f641cad5677a4ded8ce2c891889874f03e41140063543ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c458b3e87a6a4296d01e426eb32ba987

    SHA1

    7f8005155fc95888dce21b5eb641877cf94e688d

    SHA256

    baadd2d90f29e802bc0e8a67d0dcd99d49c9010752c25f129bf480bb0eb9b686

    SHA512

    6468d875aaee78002b686c357a46a36bc149ec5f488e015634650442ea6aece68ee8d606edfa14e32daf9e41a64362686286c3e0fb13acdc1522eab63074d5e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47f58e424267069f34aa80a1fcd1d38f

    SHA1

    ea1f274c5373104142ba330f1502a5e47a24a342

    SHA256

    e88a8e32cdfc17abf62a358e421be3b5dc1651652bf586afc444201580665af6

    SHA512

    f997285a5de9eae283a78847d269d523e297ec0b65daa5431b2f69e86a1be865e316c163b0a371fa8f558ae57aca76004aea9d9acbfca1092eb396fc31b8d886

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3377d70b3347fe0c933bf72be957640

    SHA1

    084491e2e68f88c0801f2c98b6b7d2d3b98eb539

    SHA256

    cddefab1422eb88cd7cde0412b4469d2de00899d1f9f8476bde8b8d298bfac70

    SHA512

    cb55f0e2432f5348d0af7c27bdee018b664b1a7b228eaf1b127bb28b2ff7d2be7a42e4f6630b38d876dee8159856e5be5bcca14ee72041066db629306ad94c8d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    74707a888917421cd01d27f917bb6bf7

    SHA1

    37755242f31dd31d0f85ad45d86c84d1bccaf17d

    SHA256

    e2db1ecada72917d8b7eb911074f066a4ab11d58b22ad58906a66e047cb188e3

    SHA512

    14b2a3f4a02288779eee40cd974ff677e396a2f86f9d07eacd65fd6c0a07d179e7b0c3f752fe1ac4a8979170d773a867161b027aee498e277d77c1fdf713c57a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b6dcd1ea631887c8ecf86466bdf7e805

    SHA1

    815e7c2473c4404b97d5c0cd90468a2df4e64cc9

    SHA256

    3e855303031fd4847379c5a2971be64a464f3288520faa3aaf1148e771193c3a

    SHA512

    22428e751037f68ae00b59c8b5ae07cb61d2e6c72036bb63d1202ceb22f4a05f469039ec37afaff6c398115550f81689f8ceb084597dda1fcb88edbd351a190d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    33b6b1f9b082975ef5db09d23680ac64

    SHA1

    f4cea8c2df7a09d0c15f351c38c4db3811f0b504

    SHA256

    54626a2be4239bd65c9922c989f5950594770a43e54dc055a561ec9853be339c

    SHA512

    702958998d7d4196a9bfa4a59d061b658bd496127eb8269a45b2ada8709a38661b9e142bb1cd2a46aed514f3e80e33185cea909855973853394dcfb67fccb35c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b33b5d32855a597551cb75e74f27f639

    SHA1

    7d0aba22173d13d43ed731dec9f469403a12b063

    SHA256

    156843a74634349e2230b2320f28c332153da6e8e219ed5873c382215c8ed2d9

    SHA512

    4a4cb3d338d2615178c96814dcb23e93137b804b1a18bc3712b6ea311f21c74a9c9d080bf2647757653d6a9b67541677b3e1bef0653eaccaa46f766e70e73191

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    675cee793ffff67de575ad2f757ad441

    SHA1

    a95c80caa809630fd44c4b5190d7f8baa89cf9db

    SHA256

    429a39ba30dd16d81e11ebe115c83a2888925400a83cfccada7d8192e74df581

    SHA512

    2a47def73ed6c069663bcf2ff3725dcc1b17584bbc4ae804fe43f4021a641d7fcece36169de5bc763700c1caa6534fb73d0c569d2a2785eb052956cd4c5361c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    523c00846c0b3def557b059763b6223a

    SHA1

    2891f118ff2d9069b59e977915b215ad3937abe9

    SHA256

    49498a3d3d6b71b92e51d37bfe4d117da832cddc37d93f1c94e4b2b3572503a6

    SHA512

    4f195b5a69d79cde119cd06ffdd6c2855b8fcf77b89cf810799b0c25be07258eb94251bf5dcf31a2b113498faa2901d872f646d7c16f23de1b2afbda97615d1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bacd128961b340f7b0e507baea915c21

    SHA1

    aee757156b75d78a947eed37fa09ecfaee3d9358

    SHA256

    cf3d2146eb092b0a0b6517bd0be28f90881ab8088bd8aa297ee81054c5b5591f

    SHA512

    44e167444562ce052d5d447c4fd2f96ffa31d85f8458701ff078289d271984c3dcbe4f41bf35c45d6fdaea0b41b0dc475abc04614ecff75db6ce7ece49b6a3f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e16d1d96c1cda3dbb854f2e8d9a79cd5

    SHA1

    6e28319e950c4b9baa47fda0a71ea4b19d41ba66

    SHA256

    6470374168bb205b77cca87f4974c1ed8aa5cf9f6c28394d7a51b87f59dd8f32

    SHA512

    86e4ab0e0ff7b274f268194189b0ec8ca6f942fc4f914d8382cc005d40327343842184a33d0146fc37f2eac61bda407526e269bb5226edba2b3dd0f6515f0359

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    43a6a26581f2ae7846ddf273e9a4d51c

    SHA1

    796966f8455144a4458a38f2159e0da43b4dfc17

    SHA256

    149aa96053b265e404d9c6503e8e273073fcb410fe193fc882ac0ca2c46992fc

    SHA512

    8d2ef8ccc08b139c85c3b70840ca4d0c8c0bc73187914215e746ad5bae1d6e7f47de722bbb88b0e89358ce2ba4feba3955e60e7c94bcee0fb9f54701ce093c5c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c4b77b33494eaa369327b69268caa86c

    SHA1

    5e2ca6465e7f30050bc6bde6339f7e6523cffdfa

    SHA256

    efcaee22fd04398cd0eecc95df7e4784f6b24ff15a0ec302b02685097e921e1a

    SHA512

    b6d621a0f5bcb30d2824fad3bfe94e5afd1e9b55589392116f7eca38840bb537906fffe589928df20543c73b28699a807ea4f7177bf0ae727bc3f3329b5fd8ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_5F8ABD199E1CF2EB9B30F8FD50D3DB0D

    Filesize

    402B

    MD5

    6aced5241df668adb89f998371e9770d

    SHA1

    ccdd6a3dfb5c7a8a3386260d1b36ac38da0511d9

    SHA256

    324687e94667cfcc1462e3ab497fd49c213e9c0421d3a539e856ac881bfead3a

    SHA512

    5fcc2f128740215eae01a13d1f77063aa195a9210a6d51883ce5d0906a3b07a70bca882a02ddb4bb7275990a7f930213a039564e8939560bd20d40f6d55932bf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\4140855455-widgets[1].js

    Filesize

    142KB

    MD5

    cbc16fcccd76b8da62f369af9349fd08

    SHA1

    6c0f1ae26a91ac3628f82ce004bca9d31d46dd17

    SHA256

    f177adb4507fc3cbf3b0fe04b9bd95673f21248c2499d6808cc41f75af812571

    SHA512

    b9ddd1812a67d66bd65d63253dd891aa473257a0e9afb11feb5861f1cb7ef85f7d8d4e5d33816c7be61272cbc13d2e6f0b156cf42aebe7609a5190d1d3b58783

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\cookienotice[1].js

    Filesize

    6KB

    MD5

    a705132a2174f88e196ec3610d68faa8

    SHA1

    3bad57a48d973a678fec600d45933010f6edc659

    SHA256

    068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

    SHA512

    e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\3566091532-css_bundle_v2[1].css

    Filesize

    35KB

    MD5

    1e32420a7b6ddbdcb7def8b3141c4d1e

    SHA1

    a1be54d42ff1f95244c9653539f90318f5bc0580

    SHA256

    a9ca837900b6ae007386d400f659c233120b8af7d93407fd6475c9180d9e83d2

    SHA512

    1357d702a78ffa97f5aba313bcd1f94d7d80fb6dd15d293ff36acc4fb063ffdad6d9f7e8d911b1bbe696c7ad1cde4c3d52fb2db2a0fcf6ff8ef154824e013c6d

  • C:\Users\Admin\AppData\Local\Temp\CabF604.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF617.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b