Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 07:27

General

  • Target

    ddf48dff59608d9cd2ec04033fc82cbd_JaffaCakes118.html

  • Size

    144KB

  • MD5

    ddf48dff59608d9cd2ec04033fc82cbd

  • SHA1

    a7e179ee7b710db152d2356e6a8b4f40ebb6147e

  • SHA256

    cf9ca96ce6ce0cd784f39fc3ee4880f1d00dd41b8400e857bbf1f5737b6d3421

  • SHA512

    d7ec49412b6acc42912817dd53ec469b048fdea62d006cd7b9b31d1022a96bd91c9b1feda322e32c8fedde0d189fd7f0cde697c9af89aa0023472f0d983bd764

  • SSDEEP

    1536:Sy5+8exswp9Cqb8JVczVsEQIzVYlD64IeQI4OGDeMhC0j4yEN3o+Sg+Zf+HNy8D+:S+wpcqb6VMsAzVYlD64m/Q+

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ddf48dff59608d9cd2ec04033fc82cbd_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    1KB

    MD5

    7fb5fa1534dcf77f2125b2403b30a0ee

    SHA1

    365d96812a69ac0a4611ea4b70a3f306576cc3ea

    SHA256

    33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

    SHA512

    a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    001d0ee7466887e1e9cead476804ac97

    SHA1

    7226b3d89aeead976b9f2afc7930e9e4331b6c6f

    SHA256

    c8b185b4f824c1849690cf453193f79d598a23b6535cf44c9a9ef65dc63cb57e

    SHA512

    151cc69cb3d84f44beec510e2a7d320f58344456c3ff91dc1ccd5fa5a2b01aa22577cd84e9d6a5022435f140d254a738899397fd4fa0d89a3557fd540ba2b179

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c1cd5f2316f9e991f0dea6bdbe566b2b

    SHA1

    7118aada1d770032de2554594c5ca7381764c622

    SHA256

    c465a4e83f10daa3878d33b95f243b65703a91aa8ae024eca61f7f082d604de8

    SHA512

    4fce2a335aa9f0fdb6417e47d6ad870a116c18d05e4da37665ba51488e6145cb4a842aaee42848fcc05ce6338f3c46e5c8c74960bafba81dc73670de39add773

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    215c0a7507583ac219d9e4ea2da10b93

    SHA1

    b857539b03219ac96ec496deb58a3ac6f9f4e8e0

    SHA256

    4883186d6453e37b151ef2fca13723b6a459b9f3be207accb764f8188fd14a51

    SHA512

    cab4a9f45b2c8c078649ae051947b464ca1a8117880dc42f9557d37116894dfa7113cc31a795d7c742b9b36a027bfd9abd1b204a6f48170a215a2a37e1a1ee1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    78468c6f4a133682fdf9e1fd965dfb6a

    SHA1

    881e73e5d8928294e3156f168ed99f5a616b5798

    SHA256

    9a06dbb6a8fe8ff26bdb70433abeddc49f104d38b944a5f5ae18136d8b755c8a

    SHA512

    5a00c883855fc2157d4494b88ef5b9bb9e2806e85a75226d51edb395754bac56e201a9f0fe2d13679ee66f25a678664f241d6af6720079966d4ce45060772296

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    19b4d7e5975bc363ad4d3197f737b464

    SHA1

    968c4d71dc593876640f23b0b93c21b6ffa8059b

    SHA256

    57caba0668ee99b2761c77613670526c7a1a93f00a2a759fa9080b078bdd1bcb

    SHA512

    4a2fec82dce01b5a7d515350a833af2e386cd022bb81be71ff6c9d4c2b8031598ab55acf07de8aeaef0fae475829ae4e5bd2d4c2c5ad6975480ee651f116b132

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6915f4251bd579205d298f06575e1ca4

    SHA1

    9e36e876339572aeb6f82a408ff66f048174a781

    SHA256

    0809dddf39a748096de463154612453cb945c1ac9a36916da21a5b45de3b2663

    SHA512

    ac7111728459fe16621365c386fe1fd119ba3131fe49e0e7cb9f6607e3a6d83a0fc698d852a406c459f326dad2b65e604534463a4f8f58f3d331f612109d7eb1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8e462c4064306fec4f1e8327f81042cc

    SHA1

    91389c4a9f54665c69837d9d5e71e39e26266c6b

    SHA256

    0e0bcaed0e02be84a24eed8987ca170b7f49521e900735332d0813b126070b09

    SHA512

    336305ffb8c9cb983c47de78f4067bdafad118f6c2720da15f670722f56452d9d378429d46fad197352b300e95e2078fbc2e1307eda20652941558e3e91f7ae4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    683260940e953d24923fb201516f7ad9

    SHA1

    6874195ab9e6c3ace665ec6e5bb4f7d2b4c9d557

    SHA256

    e7b80762bb2766863234d5e9adb0883e7c3c484c4f4418dc99537b3a6619f856

    SHA512

    e5ee735e5a0cf80abec6cf3322ec4db84c83751195383f4d748f94ae874b8cb51c61844bb718516c28e5086c36ac8f70ce9f75e23a17232f0ebc81c4c821680f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a19b4ebaa1620398d0a11aed05d4a56b

    SHA1

    ae8f8df7a4be79579c25ce3dd1209ea3df90d42c

    SHA256

    ac41d57cd21cb4451dd1ac8e6f12a3d9ce4018b4a6bfa2a57c8613d36d4845c3

    SHA512

    ce12f09b4301a97ac04beb06bc43f00604d780bfff96065954b0be14dcb0d47e268f38a98c170d36ca80d836428497bfd997ed29e603c48687c305f62965a409

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    207499332e9bc88afea8f77beeccbdf1

    SHA1

    8d39d563aca7d40c5996a8c8813b6d4260d70a7b

    SHA256

    668e821cbcc9742a3116ed806fdd5f074ef36b585bab2c47a7751564455bdb9d

    SHA512

    7b9709e3c9fe61bee5b8de0ee467f1d0328acead1460a7b9d9dbd6b551740f3a7f85d7ed361f1d833e9e5b3a436dfdd0d26822a11b1a1e94a1ec47d50eefd993

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bf75d3d7919d9b1a2f1350972f11f86d

    SHA1

    e0ac119b4f2a07fa7d0b0417435beb1148a016d7

    SHA256

    ac78dd3a0e571eafd6d6c447c2d2b7805063b7018366f2a3d90e7f441f005668

    SHA512

    7a3ceabb847676f550656783dc43000a7d8c21e6a3e241a01e7b9fd88aa9a8d7d90cad915d6d977f796c8eff7db86df96a930d3da54eeca0fb477b1f908b90df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dfce550736cf848e1c43c07fec29a930

    SHA1

    65295a008b241dc718edbbd5dcb68df6e098f0f3

    SHA256

    1bc8bda1bcf5e1efb58b1a535e17c4ba0ba21bfee4be401e179cbc758d202da6

    SHA512

    7f8a023af502f649619993f0d5ff87c2422ee86eccb2d26c01f77a9a302f61b97ba6338d19a81e0e7c4efe4b832f2e28925fb23a27605cf4b184de73287184ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a4fd546371904ad4b3b713e110fa3f88

    SHA1

    347f37abc94d0b1bff2d57b4f5ca4764d57f3a04

    SHA256

    f617c93a5f2fa238699f2c3ee03dd57f7a81546eb09fb5bd772476de812164aa

    SHA512

    18c18ec478a66e061dbb5b349199082b5cb6fd8ba1308e65343468fa82f44739130da814d3db13447e790602f347b3f476d0d2af657234c8f9b58bc6e8c3e8e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cccae8c8dce7e7ecd59f044002ba06db

    SHA1

    db0127886347202a81f59aa01724cd8bb7f457e2

    SHA256

    f17fdf49564af8a1e7fb9784fe864d8004ee74f395bd39bf452c44bf95c74ce6

    SHA512

    a9d4dd5c5a22d7b29e4e4ac2348da1823fdc76c33a57e60623f1534e05360056a4e87e55466f1097ce5b89070e35560e14aef6c50e705fa8a96da90422e19342

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    af779e15faa23863e4d03c021e790ea1

    SHA1

    9b27e01a5b4b4210d1239d2ad0b43152a366c4e6

    SHA256

    e59d9f96a91aa88f35a031e5974aad754e5323680e7738ce3b7961e11c8cb9fd

    SHA512

    1387a3c1e389ef92171a895d33f7839f3211136193c98dbf82e090b2b77351e72f2907f6d58040e7b8509663f872d08bd34973a24ec177dde05ad135ea8190de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8f36f72a69127d162b7c856acc1196a8

    SHA1

    1ad1a6cc4de9f648f9da179d6787f478234a393f

    SHA256

    9eee642c52ad5bf619084ca709805e9ea4c5a4d2d03e9068108ee9fc23b11662

    SHA512

    5d8c974157b287a87b5c254200d778593d27b33e48abddfc3286182e6fc3c66b2965e260fe819a94d9ebec50130e44d80916e858ce5503d87fd3068534ff3dcc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47ae91f2ea7e1eb036ec5565c4c8eed2

    SHA1

    dfcc2552cc9ce23fd2a1d16a803759b8bbf5834c

    SHA256

    f07ec47bf0adbedd339b16f745bbdc0a92e00ec7a05d56188e3eb02f1bd01cf8

    SHA512

    4def9ad5ed2cf0b13dd892233382483e239a27449342453d5b45a733c763618a44a6caf9364b5e713ed93f8ef4077c44198cced9a33058d582d5a45569f09664

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5c202ffda345ad4b0dd8c856f53d9c3e

    SHA1

    fc0cff75f1ed2dae38c9b49587255cdff9d41d9d

    SHA256

    197aca369359e62f18911ec7b8678ebf6c190611e8bd77415d30058b0e86398a

    SHA512

    03721ee2bb3540aa82e7ee164e6d42984012bfce985e9a9674690397e192418e68cea2236656c3fd8d789ba9aac6fbe839f69d2ade7676fafbb0e684f8d9b7f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c5209dfd8867f34609c99103279cd0f

    SHA1

    8b6e44413a8e16bf23983f5ca306303064333428

    SHA256

    16167a290241d0fa727201a58b205bd8cbfe1a0465db8612706ed4eff51c93b1

    SHA512

    c38dfa39ec7431a915d4765620e2a41a92f096902ad8a4eb651c24c3600d833027df69255299a667f42155e6db84b77f7edcc5ffda8791286caf406bf909e041

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    931aa1af5c2a3ee3dcd54d63230324c3

    SHA1

    a469447d691a91bbe81e4eaf338c6049b60920bd

    SHA256

    a4cb630f4c035174ad4296225905ab2e80ba1682f1872810bf475e50c0476998

    SHA512

    a1bd1c88be5cdccf107f73a9dd394027df8ecc09ae1609abefc95a3d867e38c0af7a1086c4bbad4ba3d5d55af366d8b146672e357e2d5b525360273f816922fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    b0f05701b97da24b95f330acfa545dfa

    SHA1

    0963496109b533fa41a8ab018e199d0eb6e5bb7f

    SHA256

    403b093e29351815b0d92d0f7564303e93ff6c97cdb266ac7f38d495b2461a31

    SHA512

    ae53514d0febcba66d06f819ed610b7b19f32be74d7dc095f734875b6aab0551e8baf7655d8411adc2b8186a0abcf5218890a36c9d021cd18db51a151eeb28ac

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\domain_profile[2].htm

    Filesize

    41KB

    MD5

    a4c5290c00246be89923e382efd52192

    SHA1

    44b9dc3ba0f5d1b317e3b167cc953bb72d8474a7

    SHA256

    3e4282309c9621263f7b9cfa9d3593102444659a80922cd21bd0b0fe8dcdb40c

    SHA512

    3f3cdd54d7c1216f27b32fdc03de6af845709c7c396d80f296f66bcf5f1925a7853f50db9eece90d6d646ac7d2def24a0f4be7773d7cb0c2de2c19743cf11c5f

  • C:\Users\Admin\AppData\Local\Temp\CabBA9A.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBA9B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b