Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 05:29

General

  • Target

    f9cdc5ea8b8e8395e48f1b4e95590c88_JaffaCakes118.html

  • Size

    36KB

  • MD5

    f9cdc5ea8b8e8395e48f1b4e95590c88

  • SHA1

    bf8ad812b34a0ebfb0a5842ef6dca5e9c863745e

  • SHA256

    b882c50ab561b64847ca082de7edfbd52423914bd61faf899611ed3299f8edc9

  • SHA512

    8952f6f1fb763c59cffc3cbf0a6da3f622ee8dc009577ed56a966b5fdbe4c61517be05df60e8046e9467088be61cedf56cb72cd02e20b260fc9941f805b68c8b

  • SSDEEP

    768:cPVpdEOcypQtUpDoQwYkm6RM/O+whkMyRoM/dXRr3QcFEYlMDhpdbln7rpddja0q:cfMspPeX1dPSJ/LMiWo1A2PAA3fLzaK

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9cdc5ea8b8e8395e48f1b4e95590c88_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    4f54ec1c23022688bdf38790fac7bbd9

    SHA1

    7528e8b370e6a3d1f6ed51d0a72488640fe85ebd

    SHA256

    356a2f2a8318b6c884a08f7831f9b14e30368f12961d28123dfad83f32c125e8

    SHA512

    0e1005d650e9569133091cd67b8dc3bb6731935a04627da19dedf05165459605ac95deb5199b4351ac1f212590326af9da29d9b3d52d35a3273bfe724506b9ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_0BE30C8E6128C0BC8455FF6A9904D7CF

    Filesize

    471B

    MD5

    739d4aa070989cf9a38078749ce6a1ae

    SHA1

    2a1f254c8e562f82f9ff322331606e29ba86447c

    SHA256

    fb61df803644c8cd2ac1a6b64de5a6eb14e11d8091aba548fd988d04c80c892b

    SHA512

    e2ef389501815303bbc2e5ed9b9d743a7ba4c6abb0fe9f523b6cd9ed98c40b64145cde7829c6fd4bba1e962d2a8a99a68181389d017a18de537fcd1c2bd6124b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    3870a124ccfd4080d23d57c77dbe6795

    SHA1

    a24d113c8cab49c91041bda285528854431470dc

    SHA256

    b3a8fd37c7be0a0b4fece6cc2ae801afef55c249348875600aaf3275c7831fb5

    SHA512

    a9c18efe93d249487377d3f5130e8285e39b8d9c4d99afca7067aee1ddcdd0090e6c31ec1b9e401b5a69cb43925a54602bf5c2286a45d0327561d0552816e4a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    3ceb6c1b1c0f1f8330b0cdf6a94ce35f

    SHA1

    d31bc914efd422980c67ab5caac3ffe45223f3f9

    SHA256

    0ce400eaf6c67b35d3ad756fc400aec7b42b00db96f93f9dc3e6d48fe8383163

    SHA512

    aba4fd60d1321e30828bc947829355b344b5cb8bc4ea0985274b91eac67ab082ff65df6dcf8b8879747f808437791c236d54b4118db18c530feea12f4098f11e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    15efab7f2057aed6a281655349f6bfcb

    SHA1

    d077f11acb93811dec26098ada6ab270a2573e7d

    SHA256

    cbe73305ae5c9af0a217592cbb187c86dfb74b70a364666723920afacd4f3d2c

    SHA512

    7226e69e44c8443cde1ea39cdaf36838910542ab4cca3cc8985f7f34559c08605bdf12ded6e760999e45ab9a2cde7faf21f1d8c85af0f77917c1862cebf534d0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    feec2d3838156ca0b96defeb15311728

    SHA1

    f21cd9ba4c013873cdcc8de912f8e71b3f205f2b

    SHA256

    6007b41200635287e25c9364ca75a6809d9580b400c983d778979f65ccbfb7a4

    SHA512

    5f5fbdaaf41a57e69dd59ecb93c46df0cbd39695c474dc935a2bc1577bb57529b404290c160a65aa1696b16d182c4608afb6029db0a02ea33ca03c334c4e8f4f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b0dc7ac4b968c8546fb3eefe65435a44

    SHA1

    03c2ae32e3b56dd155d0fcad558f2d8644ea261c

    SHA256

    a788f719f6244a37a532121f116b57a93a827ec4f999900615527542020d4dc0

    SHA512

    3fd88680a877f269c0464e4db34b51146cf8adebefbb3e7d7f677d0660c4e00ea952309c997e305c2579bd133435cc369a792c9b0c28a1bf9f65e3d5f50da5bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee046a57ff77c7894f3df3cb89caba51

    SHA1

    0f093a085f346f9f74918994d12cb5e8fc675aa5

    SHA256

    265a3d930209729910d50f4a6d42990c6642e153fa47c649c96c6cc332c5adf9

    SHA512

    dd235ce8171e815c11bfd31cc32a121784d35448fd03abc57af3a02c420adb4e7eadb24c10f59ef797720551c8500cf7a4dd971e18ce1787a7cb003ed5ba48fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    332af81ec618d70d26fe702d163b7e92

    SHA1

    2dafb7dac7710702a6493f3fe15bb3c0e107e9c4

    SHA256

    2a9adbe3ce510df7ca551e2be6b28a629e9e984bd2492c4819dc57c73f5137e4

    SHA512

    ad25c5e0f3833a455b8e31d783c0525d472b6392f309632224fcf7117c1a846d9b1debae7c62a51df1a8a7a72e840a47721adfe5c249bf5af4402648adf04f2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2a5ad244a1583996b1adaae5dd36a597

    SHA1

    499f3d7b76c91202a65538535df040240b6a7b2f

    SHA256

    aa6e4c37f3d4aaf2866b5e54e05e56c210b543969eb66b872e13034969453d88

    SHA512

    1ee0f7a042fe1c27bf8b3f72349835b81d32796021d277cbfec55d1358d5897d69743d43d82339db4a2df518337df8e5c288851f478d62def47987e945a267a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b5ab0925c88c4224ccb0e70c54383c65

    SHA1

    169a1031aac91e04363655a1f3fe7b20288330e3

    SHA256

    be6d74eb84d6af31d642f565ff9fcd1329826bc91b75a47223238ea487cb2503

    SHA512

    4cfe13d108c81726174dafc17b1b90ec214fc88d08857791dd96b95e8e8b64801b09ae0acf82c0b8cf087f3ccf307a4ed14e41d607a3de3db8401b745ca9154d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8aa9057b7870cc2c47c76158db1f3a8a

    SHA1

    4eb043693470710a75ab16da6293d02d2960204e

    SHA256

    07e785a5f7d30a04b7649a314c614144012109ee2458af6a4700183a451f623f

    SHA512

    5474210e7a634f4fb6c6a716f0539a6cf648cc45869a5c93dea0e605913fae452b48e558cff26380f8988cfc198d0511d42378b7b2e963310585593890f4ae30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    327015250a95103a39b1d3c3036dcb2e

    SHA1

    4e4d920969c7f12ecebe506bb2f27387ea21acff

    SHA256

    6defa9d4cddde9a4df67d07e1f88ef76281f628f6c1149e69a6d2dbe70409eb9

    SHA512

    de82e3cf65664666c290f32fa50ec2f5abb3ed11469988f411732a042bf6d42dfb88b48aef52b7c9c8893f039852a5aef3c7a8b0cbbb95879a0854aaa357148a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    acb1eb9bc7a421298d5b7aeb2a8aea20

    SHA1

    e7e4e0996e41321f21a8e54f38e8d16049cfcdb9

    SHA256

    270749e8ed75f579cda2c3e1506794de9e19719d1af075c6de9798cc10a87e1a

    SHA512

    22f9391eb0957e391937f4a171edf09cbac1025b2c030900b979c15b3aa18e753e1f3881ca8c1f745faedaa0a52ede0846eeb4735bd7b34bd8e4cac34b49cc91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0dca7721c76996e9bbe72e1813502a62

    SHA1

    b774af79ee8c01effe4f8c1fffd792b7f52ad5b5

    SHA256

    7f05d26b5a19a2085674c2a3d7d6274cf9788af20e00ecc0f7c84633eb9083f9

    SHA512

    31baeeac93c4b0985eef161f69982fc059256a2f816a52dcb9a54a1c8b28a66452bde0f3cc15d59e0bb9a143609558c192b00c2edfe95a9679ed00f2a8299a74

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5843599b3207061b810699868bae78e3

    SHA1

    1c62d4d4c8cfe0697c8e1f691424e9a68930080f

    SHA256

    ad97cb521a0aed41835a639031ceb6dfcd79e988fc7b42df6cff84b625bef7e2

    SHA512

    777740b73c83aa930d8cec2690274d9faf98e89934dfd7df58e5abff227eee58428a32b137b49df40a1be4ee80bbb1ee135a978432cd80a118010366eb48ab33

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a58191b313efc08a82815b1e8a175a03

    SHA1

    69a75d6cfc1acac26e793aa87e7ea80ef8cb4a4a

    SHA256

    69e42c75a6de1f8e950e520de501e7b1b57e9a719027d57f8badaa636580fe33

    SHA512

    fd7a2be9e0caf60fbc8de88bc0b8d33623184afddfc1d7b17bd415d6a52971a949529d6fffced032fd84b6deeef8cb131f41dc880fdb72dcd27b15ba7846622e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a0fe7de7f1e12777ea8a393c0b2c6348

    SHA1

    cc079d13829762a0a659b6d89cfb296f21e3a0a0

    SHA256

    068233f8d58faa589a48e75148dd925851859b1edbc838e36701fe7a6b21778b

    SHA512

    4e24687699bfbe478b92af50ae5b726d2142c97eef61e6981bc00bbe870f6e27db29e9b919c6ed5f4c019bbf8472384efeb73dea4a43bf605b63f0a6e51d2ecc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4f7941eb455e580471fdfabab97b97e7

    SHA1

    efed2c02c2aa0d41dc201e259d7d49e9aa4c02dd

    SHA256

    f3ffe6a366f0281fe27151a0df06fd6866ff655c1d73ad2f55f9d988e9ebbfde

    SHA512

    28e2d39aa587435ac00c29d216169057b1743c39eb644ef8343a90d7db8d896cc544cf94d551f175e37b31b9efa328fc6f8d2f773b8deba6a241e06157257fb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c96c3eee6dd2710fca4cfc49406bc83

    SHA1

    fb0553923519f8bd82a32ef2221ff0904843838a

    SHA256

    a8d7986f58612de5ce0ef10714064043ffeb8a265813a8c8674932028eb6f2d2

    SHA512

    b45f45da520a2e6681e5587b18a847279c33ba3e9287950459fc398084313e047d3f298b64e24ec8b4731769577d298f5ddef6ca8cf705d78bce174b79c9cf45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9e2c12f151fc596b29b16d89074e9e66

    SHA1

    a6942b82a177198146e2078190b0b229ae9779ba

    SHA256

    5a903570741a11d4952909c9a0b3db16ea6223d0eab8b821dd181ebe926b95d8

    SHA512

    871c3777d9a2303c92eb6e751814917a2ec9b026f60794f0bd5508055600b31a77098710cc5d2d7eeb5fc1ef3908e0d1f2ca874c323677fa6a0e38711c81b766

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8161ca7e16255f668995b1057a0496e6

    SHA1

    9bc01922fd237d6ea5472f2f7b39a2aceb276417

    SHA256

    56354d6d33ce13652b6414d085ec55d5bd9445b986c32b99956eacacc4007a72

    SHA512

    0a51eb54fefe8f8fc29c8744dd94a60b0067c4428527e7f6beb0be4abba380a6a30ca42df373f4ac9673a50095d16531e62d7fc57db3f3977142440446ec8422

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ef5748d911243521799ca2c1f769b51

    SHA1

    cb69a3ee294f7d67bda06006bbf52ea8d9447845

    SHA256

    510d76147702a671a0ffe4ff821a65e312d6033d5f685060d606b1d4534f41b6

    SHA512

    ef565c98db82a5bb2de9695614a35328e44248c8865638645136de1257c1f465eff90fd91153d4f64d886004fe3fe92b450341d8ec78fcbc36a961e1cca378d7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    52a977b2f8e480bbb3e81ae98201c78c

    SHA1

    ca8f860bb8de5b46d37b2e4134dce2d9a2e192d1

    SHA256

    e37e9c84d46f3632b7be825fe577f7cb56fb5daccf5e56e712ded0e3037e5b52

    SHA512

    229114408f7038af90b626cbf7051e4b54a43dc572ce37f26bb826cd00922a5d936772c6186409461d2cebf4659bfeabc06e52a9fd0b5974b726135943bcd4b6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    183332f9df1e90a14f16ec7d01179075

    SHA1

    3609c234280180e7c7385b54bc40943b6d5b323b

    SHA256

    77b3d3b0603c63d9429a46b185fec865f3741a49d86dc6210524ca417e336dee

    SHA512

    1f469ce21f8295f7e23b8c869fb3958e9c110c64c5f3c21fe530dddb74e75db7bdad51295f7fef31dc0f3b36e12a040fcd07a2aab9878d4e83c53cd4066b654e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_0BE30C8E6128C0BC8455FF6A9904D7CF

    Filesize

    406B

    MD5

    022257fcef0af8a6f286fdc28574a496

    SHA1

    634968db5ebe9348603a0d003b85ce4a653cdd22

    SHA256

    b95369dfb4fd5be80105a87c4c4a83d14bfa1baa0917e89678dd1f78cd1decd2

    SHA512

    d740d39927edfcce47c259cd11519a067e15c7ae65a6d6c5eb2a0ce9ed23dab4448077ddb663dd8307bf477b9614ec7fbe1f7d87cd73c941cac95297fdc70eb2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\3138155095-widgets[1].js

    Filesize

    142KB

    MD5

    f13f70c4a6895ed49aeb58acea233cd6

    SHA1

    e8d7e6592f1707710b0d88f0cd933893c51f6638

    SHA256

    f20887a6ab86b0928cd8828e294b9a6a4d09a27df5383982212c10314e194f7a

    SHA512

    7128f5e50b200c960b87106a8e7fab88cef7a96a4cc1853290deb9536c5f409cb37d873e12e5bafb3be55785d23093d0a442c878f43a06c95a652292ebb3ae52

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\3566091532-css_bundle_v2[1].css

    Filesize

    35KB

    MD5

    1e32420a7b6ddbdcb7def8b3141c4d1e

    SHA1

    a1be54d42ff1f95244c9653539f90318f5bc0580

    SHA256

    a9ca837900b6ae007386d400f659c233120b8af7d93407fd6475c9180d9e83d2

    SHA512

    1357d702a78ffa97f5aba313bcd1f94d7d80fb6dd15d293ff36acc4fb063ffdad6d9f7e8d911b1bbe696c7ad1cde4c3d52fb2db2a0fcf6ff8ef154824e013c6d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S8GI6B9B\cookienotice[1].js

    Filesize

    6KB

    MD5

    a705132a2174f88e196ec3610d68faa8

    SHA1

    3bad57a48d973a678fec600d45933010f6edc659

    SHA256

    068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

    SHA512

    e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5

  • C:\Users\Admin\AppData\Local\Temp\Cab1864.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1863.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b