Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 09:47

General

  • Target

    e2331372153e16ab9bb75b558d9b3cef_JaffaCakes118.exe

  • Size

    15KB

  • MD5

    e2331372153e16ab9bb75b558d9b3cef

  • SHA1

    5ffe8c1982ad49af5cc8a3e1e1dc8a2f8ff17f46

  • SHA256

    477d403e314b96ddeb8a62530b3dd03c34693ac63ba198e24a38bd7dd2b1db36

  • SHA512

    093d816d4307e38bd3193e1952534ecb1414ee25cd833fca80f7ee60703b603e9489a3d63f55e3f5d3f11df96b744b29da12b6e0ca11fc7f69c7f18d42dfd251

  • SSDEEP

    384:VeHMxADbhsAPJUlUI8X94y8jEFOfhANKFwWe:9+DO2JUlUIc4y8juOfhAN

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2331372153e16ab9bb75b558d9b3cef_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2331372153e16ab9bb75b558d9b3cef_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Program Files\Internet Explorer\iexplore.exe
      -nohome
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1944
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c delme.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f5ae7c36acc47050d17f7ec1f5b5ef14

    SHA1

    daf55b9e9c970c93903d17ccfae9722814aa638d

    SHA256

    e77c5a6f410b57d01c7520363eeb3e7666bf01769a1397f0d1ee945ebe492767

    SHA512

    9b6c83d79be777abad7b76dd3c08749a1fc8353e49bb9ea41ab17b2b1cee3a370f3c4cd5d75ed588f2806ce6ffcdc61ed5427a7c8211900f09030207551ce38e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a939c115f7c0072d26194fd9af79094

    SHA1

    d09bd5a0152af6f45e35553cf9c80e3b4deb1c79

    SHA256

    26dc070bce7be105021d8b03b73ce4c78a5f7c72f7acf4b71483bfdb0eb69d6f

    SHA512

    a3cb6a4ce3c7ad55ddab7850bbcf35422d728b4cde3304ce3aeb4888468f4b3e06475d8e007c3b0bfcbec2a1ab26c1ee5d4cc634b4b3ff60cd1a5d5220f5f25f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3988ed7bad7e1173d2d7714a3cf0a0d2

    SHA1

    915754d116fc18ded74781b660b96a7d7a43ec09

    SHA256

    2e9c4c13b862f86a6b75cd823623d7cdcdd63b41c6d713702fad5350f88c309a

    SHA512

    570363528b8bd54fdd29a5d290d6738b89a977d6b9ed6595208d31eab168477ef5c4c8d1db9b95193e17d121be5e1f54654605d02125b3918126d253486babed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    907d6416d6f54e976316da9970fb57b9

    SHA1

    d8b177ae0abdc6232b6ec34d6bd65f94cf5d2330

    SHA256

    0bf8580dcb6451c811dabe9fb3061607e119133dacfaab3ac439d62fff685e7e

    SHA512

    a55dba3e46ce66c06f39110e7fe131676600e0ac5d02934fa65e2bc16b6a75a4e9b6f04d560817e6b4244602eea583519972e61c45090ca78dff8892bcf1ce61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cbff88b9992ad79425366d7838a9b117

    SHA1

    deb0e10b591d6afcb70f15735ff717955028f459

    SHA256

    3f7d677f8f17f194953f53b7376b6e01a9958aff342b1a7a027ee55f75746c37

    SHA512

    071ad48a50533a272d933901cc3c5f0792123d536223262d6e2218917aba767ca9b89f2ed04061b26451d8386fd73416a6684a297dae54aa46a2d1caed26337d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5b01045da0f8155d1c6669daf4e99864

    SHA1

    fdb211381d5c6aa68292c2868fc76209572681bf

    SHA256

    523f1f86193aaaaa58162baa6400f454b842a7d30d0381f3cfa111ed820a42db

    SHA512

    37cd4c8c8656fca5e069a88f19868f7cfaf698bdc681d9fb87af5d32f0bc281f3a8588d2ff5b57ef4b24ae2820282e7b1298dbc57ae0808a127dee67b2fa54f5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd84d5435ba503a23434e84c14980e0e

    SHA1

    22fcb33cf086a6e0db39954966998b27d4552f6b

    SHA256

    8dc0208c094a40b03279ec910b1428697d3ed2648c98d77f33bf7e27d823119f

    SHA512

    8448c4ed6e7f821b1f43214a7513ca6c5700fdccda21865972d822e4811bdffc58b83ab34fd2d993440f1d0f55525af283ba462d61ed52b2ceca7f5b9ebbc19f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    22c84ebb4e6495151c65024b4cdfeb31

    SHA1

    5cf1e91d506e2995ad4d85f5980acee4605bc8da

    SHA256

    3be84110fe88b33b8004e49e02489a615ccc814acc0097e6a6cbbebeb47d150c

    SHA512

    b9f045c7cc5b1605ecc8ef1631829d1e3e3de360bedb3d391e0c9100c8c6b8bc1f071114aa082774eef9c396301723b5001b59926d41585c3522b8327a8ffe22

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    79e96ec7c56450db9cd40dda9eec0b37

    SHA1

    7eaf47bad1bd2ecddb2d53de437a624e4f12f54b

    SHA256

    82422db9d8d00ace0131295fb628ac1c64f97ae965af7dec1de584ed76c3be97

    SHA512

    c7fa318c99703d0c36a303b77a03a59e742f788e259c866dfb441e2bf3318d5e30f557750496bc2631999da1e1e7793ef7307760a6435baf69b284d606b67c85

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b30fdf3ba78f5dfceff85347c3f6a007

    SHA1

    bca14bb6c1f62f6b6c7a72f8f22bd79c63a4520a

    SHA256

    118a9f0c320044ddbcf678b5b79004072efa43bb443011c84abbc23ab930a79a

    SHA512

    76d59b94c54fccd110f19aa4828c9a95b4d7a11d85ba09f8df25439b4f6f072fcca4becf6bf05e18a0f670eb3eb133416efae11eb595933b217240e1328c564e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e072bec96de2c03a44d3f56809779e06

    SHA1

    0124527a7ce9a93e6b46d9b3736a6b3994cfde61

    SHA256

    d13a797958c1177fe5b2fe8b1d5358231b62c93b4bc9ce164fe3f0d6bd607321

    SHA512

    f0bbff0a4be216d5dbcf3908d417df88b86220fc32234e503d132f66795cbc1e93d1b09269ea1cbd317282255a2aafea9bc183cda2128e2ac854c5554481f495

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    46627be1d76eac618dd37cdfd56315d7

    SHA1

    71d8a1a7ba21e9c02d49fe36a710a2059e46afba

    SHA256

    1cfa8a02fb054a1744ef8f799e976af767722261e3a323fd4e6e6a5053371ecf

    SHA512

    1d5bf0208c338543af1d6d7f23ac57a71c419ceccc34969e330000bcb95176851ec5a2cd4e663e2c9208ad93d528e737b518b6547167f2bf3bdbb6f846cb5f06

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1d3488cff14fd5725a3be0df52bcf83f

    SHA1

    171dfeffba4dcb91299db75af66110acc19cd07a

    SHA256

    d11f8a7bf07d41715b6b00ab20e344058494552a0244fac336861ad703cd36f1

    SHA512

    e01bf46df395cd42070c17df6bf7a005711b239c363ca5fc7bc4ceab5be01e12f843eaad523ded56a95a5d89c0f6cecfb6b414687da49c759e923537fafb9992

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2622167caf730755d59b4eb9ef6a5dd5

    SHA1

    833d61d0b1c5ae817eab9936236d40efaaf12011

    SHA256

    fbb29cee346778b20be23e961a3fa2356156324e40d1616e326044df5c62bcbd

    SHA512

    cc72fc81f45554cc515044548cdc17b6fb42f8adb373173b61577159d83e1f4e3cc67add7147d320ac4396de5be96d694407e619c6ac3d277f675b0da9d02b6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    177df136914ed83fc2c6e6031e315ec1

    SHA1

    c40e5fe7ecb335c137ce7856e2d59244ce4b0ab8

    SHA256

    75b9444df96c30489023699d6007797c142ac6049f7a54f70bf7424bcd058f8a

    SHA512

    66e1a68f5a7797bd295b59de2506f09f949b0fde48ff6b9aa1d6e4974f55a1e68527e362388fe7bf2533c110b4518791094475db71ca9e98db50386e78935fc6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    de859ee89b86f97470801fc2cb480e10

    SHA1

    5298c76ab602588f9541fe97e4625f035e17f493

    SHA256

    1afa7fb7700ab2c89a10d95a3946b73385ef4d38c4865058d1d1dc81386d7942

    SHA512

    5334462be69a713ca50bae965891bc04fc257d81aa3199160f603725bd15d5d8ec93895b3131af4fafa5e8f809fc80915edda1856869ff0fdf7b5aa52523e730

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    166d98149662ebe7d0c686ef39c6ac78

    SHA1

    256f319764208492259dcd9c554afe951b7f9fca

    SHA256

    fa7c05ee279bb5b988a94ce9a41e63545d10328e52b5687d7a9ede90e4397676

    SHA512

    8de56f87974be91d79c5397bf78f4dd99491affdbc7a1ddfcdb448de07dad36cf9e5dc0d674f1bb175cf874c4b9f45ca99f3d5b7f744f1b9130fed4ad4a0bf4c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c3852960cd58fd33aba56a793e8739d4

    SHA1

    3143ee6c2c98898918bc53b69ea21fc6b3bc1413

    SHA256

    514f2a8fab991befcedf8ff22f7d28da5418424717e0cf8a0ff2ddcef7f51745

    SHA512

    4ff9416214203e813d4f3e700189a7a95adedc49e4367c877d848396fc1dfa599cef6ef192600f1f1797834a71118edb25fc1bf1764afa871690fd9c4ca10f4c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aaf2ab4f43ed7c27cd7b7a2497f29436

    SHA1

    c5898fff7fd4e65db53af614d9a394ef12a693f2

    SHA256

    7a72aad970592d7a71a1947f43e5c2f5873706690c3ee2c5994d3c872d97b53a

    SHA512

    3f7b010252f4888ca21008728c3a26e00578c777dca92909134fb4e422b9f2911b32ba06f45f0ae09db2dd6d85567245d36dfe0c65cd74c7c3b9f720ecfd0379

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b78bfe6d15398b954ec44a68377c54e

    SHA1

    a34abacfef49d6493c859c55b8e3cec7dbea1e8f

    SHA256

    95e26c8bf771c3becc8fa3cdc277f05792b5e4d5fc469f5e0348f1bd58680974

    SHA512

    d62e78c1f6e41da9fe77fffbbd35a272b2c3fa2d046d28eff26c9731cdf4a6e7e214c07555f7c29762e5a4618ddcfb41a6920bdb9f0aa721e4671cf848c1b537

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e57c7c3db518db2b90f7f6e3a32b0dd1

    SHA1

    4329bae99e8a53901ed847fabef17ff77bb2f299

    SHA256

    cfff688dc71980d90a23ceef55ecf0fefd4ded73230304daacc81f15dd08f68d

    SHA512

    cb889036d3fc230b454727dbafc96991b235b2d6fb2ebeb142f21beb92276cf691ffd950b9c0028c7bfe237bcc5bf67d4928ca1a0bdb4ec7520f9da817bd4f2c

  • C:\Users\Admin\AppData\Local\Temp\CabF0A8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF167.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\delme.bat

    Filesize

    210B

    MD5

    cb7ff89f648ba5c5bc58bba9eb0e818c

    SHA1

    51a5ee59d206d65137f7c2e31764c9447c7bf1dd

    SHA256

    198f999c202e82ba78219ddeff263211c80f609b4fd3f165f6abeeb6468ed71d

    SHA512

    c643a69f72c887dcbedc9d9f83e80a5248b9d19fc840591281ad107cf961aae66d8b4cec06c404563f31d4983fde4faa1cef3122f3ffe400abeb9ef8fbfd8ce6

  • memory/2348-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2348-11-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB