Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 05:04

General

  • Target

    0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll

  • Size

    224KB

  • MD5

    0e0dde4655443c471644fdf4531d04bd

  • SHA1

    a7395cb1ac51a984d8e9a964675066092e906bab

  • SHA256

    441ca92a744fb75046b8e077dd7801e5619a96446ec64690cff9f7e00bc772a8

  • SHA512

    345480e127e66fac11256604ab65911978ef44f441860d8e3f58f9b97c8b916cf239efcf8362499f5d574055527241bda34c37ded9ab8fea8eebe8344fe8f499

  • SSDEEP

    3072:/FrGb+Qm+ozhCUrMKzh0Uh2o8ELiYcnQrsIze+08Fx+z+uTei/2GRnMtn9Evv+:Iozh0Uoo8ELiznoe38c+Ni/2mnMkvG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\PROGRA~3\lsass.exe
        C:\PROGRA~3\lsass.exe C:\Users\Admin\AppData\Local\Temp\0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll,GOF1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2472
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2820
          • C:\Windows\system32\ctfmon.exe
            ctfmon.exe
            5⤵
              PID:2680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      20368a93278a814c45f9c75fd53f5e29

      SHA1

      8a3b10596486ea8bb9e1d0c84e96d8e8e88dde69

      SHA256

      41722971764715963702aa3e7046eb8c04b5e713c3008de9a2ae249070234180

      SHA512

      191f3d043167324aeb877cff41760f7d3aa4a6cb64696c1e6df91072be49e3a265089d7e81ee1332dc9499d395126c85416f95d5bf1b97ce8432dcda7ecfee50

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a5b186bd65798bc844a053a4bb958cf2

      SHA1

      d2f56b33292f7597ea96d3ab81d5499e0370e4a9

      SHA256

      8b864b145de94d89d21bada9e9ede389cb43361c769ee3c43b888a02a06ac027

      SHA512

      c748e80dfb10099c40e7928afc298a3ac92e6cb23fd1bcf71f40fdf77858a670e9f006258fb69bf20fdee12060b04a740dbfacac6cce80958504b583b7b037fd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ab3d9cb5c3829d21b5641497e0d3d4ce

      SHA1

      ab46980fe761bb43e669e55006dfe16ba03b03a2

      SHA256

      e2848a5258bf0c3ed62a20a89a1b22ea1acc8218fd7e974e347af821aad499bd

      SHA512

      18d369a93d46762ded070121bcd96fcd24440cc89e47abe4c1875f5df7c4f4902c6459b0abc97fa815db8d3714917512c6fbb79c6f988cc69ed37f116dd8ded2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      de14d546daeab5a9f927d6586f59c505

      SHA1

      4ac46628166cd01fb232143a7a083c78dd3a31e3

      SHA256

      324a1ba81fd055c502eb5b124b3708769b3e89e756926c88f189c2ac22c4209b

      SHA512

      fe1538bce0934e22826fa922f8d020cba0e3010851ed1eb79bf2f82b782cc1fcc4237226e9770d9fec3dcd3171e4e96455bec70915dd6e731a18c59a829e5053

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a61f71be497d52453204d0817b089723

      SHA1

      bcdd794217b8cdae5dbf60d687a0c0d20b23bf43

      SHA256

      58b716fab3b90935d944c6e7ee1128e641c4167f9e967f0bb9c973d9d0af83bd

      SHA512

      a579900bc88024a4ad62a2ec93a8407b19ad42663d53d8bcccbbd1a2a2a145bb9c723b240fc928e87c535dd01c913bb7ee0bec44be023ba16afef642b195d0fd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      48794eb4d4ca2900713a85ef5bd2bbfe

      SHA1

      776a6729ecea57f0fa781e621a3c6c0608a01bf7

      SHA256

      ae9d82f93ec0c24d4d3f2c5e35b062f18c2813af3c4309a9c6c72b801cd733b2

      SHA512

      fe1dc850bd9ffcf99c36d34c3101ad171b76757566b54edfcc879b2bc33263352eb8e46e120085e2896b2cdee8be6b4bffc8aeeaf71cf69f5f5519f2fa1b1364

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e23f708d09057067417ebc92e9ff4a3a

      SHA1

      e2ffd67448d735125ab85a462f83b82f524f0564

      SHA256

      aa0644d6b150071555b17de8fccee3ee8a96d52eddd442009f5c04db08ce42fa

      SHA512

      ad1084fe6ac504720f095bb01928fc94b26e3c521033418de0952f13f08135709f49de5ab3bb392330036e39bf33ea544fba812117999d24d41961eef974463a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      acaea3e16d9b763f8d648e7aeb8fa48c

      SHA1

      1a09b7ab17eefd4040fa74d3227259adbf278852

      SHA256

      14093edee3966b655f27cc8afe0db1a553db52cc68190965c815210ae1ac25a5

      SHA512

      6520fb449eef35e2410e7ac54b1847491f9002d7be9c7eb5a424a06f5ae20ab9d17f91427d374e1e6bd091157d5d8d5c31f4fd4257fc7c17b4caed98a442cdc4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      52095b3c109cd234a2b6b57bb53bb88f

      SHA1

      ab9bed5ed115f6a9652f7723fd853e6ce23cc4a0

      SHA256

      67ce6be7bb12a71221f37895a0bf5e839786b981de2cc69f2dacb3c31b2452e2

      SHA512

      c13a257de4936b54a2d3cbdeac1a80f1c5f1f43bfd20ba6bc3b2395fc08d2dcbb1abab935233ff74ac2d274e6d2c59889b5ac75729419d12abf5ed8d0debeeb4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ebda99202ef427d59f873315c8031734

      SHA1

      7e5a551b17e52bd7a8f2695614bab0e4a5be7981

      SHA256

      84ef95737b6fe869c76074225d6f9e96262844506640ad6067189a7452dc0261

      SHA512

      269478dca7c97c6826eee8988589bd76437cd52f4a47e701f091e0f8ff5eb5ae6b829e763a8b7a2e3b922da86198ef7cdac56ae737f19ba964b155fd3d132460

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      38913cc7876b9c97daa3e2607151b922

      SHA1

      b563a5e86a6bb882b9830c5188446528eb6de913

      SHA256

      505ef7cf9c8baf1289a5228f3e4b035564f25836be3ecc3f7ac94965f5e1f68f

      SHA512

      1d8a1c9c103788f674ae5d47acd8e0ec63c6213d6700c92bce7f8bc84d9c5ad49e75253477b640c6b5de6c43fc665f103c8de0763ffe0373c285ce8be2ef4dc7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b28c8f9c0c7295047de9629079956d26

      SHA1

      7154dca8c6c09c3ea2498bcaaf160aa1e5315965

      SHA256

      96d6ca489bda25ca1b888bd2355c85c419fd9054fedcdae66886e202a767d14f

      SHA512

      250a4094e2925284812fd774e0c8c5093cd30a7009c54738ebec054fb527f2c154fbbd45c2b5d26059bc6cb2a55e6da6d22d1caa0a7c2d9afc722699dc10ff28

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      798bd8f56521f516cb133da45c942c4b

      SHA1

      76dca870a890c0adc8665c2da6ce6602d18d82ea

      SHA256

      54c4a2847350030617d29f59fe9fbf0c98c2021d3d2b1cec6e51dd6f9bd39956

      SHA512

      0270dc6fc310c2de9753b3a2567a00a7679fd16640e2a66ae3c81f58feebd83ed3f968e3d4563df443cbe67be420286f9849166c8718da227bca6865876fce61

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      486ac31f159e995021126a3872ad17c0

      SHA1

      e29c54dba4c45702290ba8a9dccc54b41a9ff3d4

      SHA256

      a8de7ea70ba40b60053152a15d311e9074b05619a24ce60eaf899d1aa2ac0cc6

      SHA512

      34f578a30b98a5f7211ea21b6af37d31fa5288bfa040f2c73bea061abb239777d438ae749a04b8c2d468d079214cbc0d0f6e065d49f1e26452fadb8f1c608e71

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      aa62b425858f63e1c1b7dbdb36a7c39b

      SHA1

      106a85be7d377b757ef232f88da9f3dad1be770c

      SHA256

      c4fd6791f1669553c13bbbaf27e2d74c53dca2d084df1d7e712cb64da67ec09f

      SHA512

      92c20bd51216de9d9bdd8315f331f4d36ad42855b5c7746104e4c9a965154e2e3cb24578a696021ccce00e511e5819c9bc7d528b48488c678c4c4e3cd734c8f8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8813deff3697540fb631dae07fdab107

      SHA1

      a25660cd4447e933603f73d0d408e2e2b82af96b

      SHA256

      e32b3379c0cb467fddf6c7295923411426d40e9b6144ef3567c53e6980d2556d

      SHA512

      ff20943f93d048600b9e49b03430cc3404e8dfc841604dc0306cfd4eb513cf6f88719a9929fcb359020d982e4878dad588b214d966f28b9d9397fc551cd2adbf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2ded5f89954500e9c8ef4c00188d7d70

      SHA1

      58f9ba5e1a203ea811e3b44d7fceecbe31cb38d5

      SHA256

      64f0a11fcf25c9464ad550d9b0d12a6d561ce1d06084669d4da96601bd887c71

      SHA512

      c6224d1421ac91928707654e95a009c2fe859f8db37d3dff8e2fe46a8c5ad0448ef2c3b374b6c39ac1e4686dc13cd0a20e8c4f947a265b91656bdd9e94c739ef

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      95136768d3c4eb588e57f834263c09c4

      SHA1

      7acddf3ebff2a4e04b16e2e42b6f3ac45737db34

      SHA256

      f38f17fe1d89b95ef4f65da027aaee170f8d5561b278f75804329421d698fb51

      SHA512

      08963116dae3982d4ba1b925484614b6331a6a345a7c9e3d17ad49101109ef5a7c0126c9d0a6cb1b8c2dc05ab52f7f0e710db88c5aa7668f466e1805163e2b8f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0c763dd1c1f0629061c64a3e341b200b

      SHA1

      7f8718d507e58e33590ee302bb80d95aab0f19ea

      SHA256

      b86c837a1ea67a6cff890c916ee2c999bac0ae128900e075954028f9b6523017

      SHA512

      e7d995d0c0f6cc068f95629320e39810bc63f608a75a74328aff307104fb4211b8effc69e5b48212f37c608a54492daac50ae65fac343658a737312a26e0eb07

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bac08abf88662b52c5d2a7b80cdd3f11

      SHA1

      ba4698a1058d7571f812d4de029b310612ae4e18

      SHA256

      62e3edec1402d51c826b610a6743caa8386f1d74e59ce79a1f7eb54191c1ac6e

      SHA512

      3da977df09505d9c1c01cb44d629648f7d44e60e0e634461bf9818d318408bae6c2dce0e0ba76a95b6a087b67fd9e7d8582bd924d770d7555fc88d9fe0760e71

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      008ec2404edbda1697ae1e2c6640ccf2

      SHA1

      29fae34c31e503a407ca2318d81d3329142b87d1

      SHA256

      92918300b923deb86e2da654bac6b69e3321189b194099259656b2742ea3a96e

      SHA512

      bed977ae85a241a73769c67788c55b51b1094d00ed5b20fd35a210492d33fea84d947a9ee13977b5afabaa161f8b2c3de3d9a57ecfb6dffd01b8e492d25d50b1

    • C:\Users\Admin\AppData\Local\Temp\CabFBED.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarFC9D.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \PROGRA~3\lsass.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/1088-0-0x00000000000B0000-0x00000000000B1000-memory.dmp

      Filesize

      4KB

    • memory/1088-1-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-42-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-520-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-49-0x0000000000180000-0x0000000000181000-memory.dmp

      Filesize

      4KB

    • memory/1716-497-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-476-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-561-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-540-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-8-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1015-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1037-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1057-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1079-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1101-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1121-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1142-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB

    • memory/1716-1164-0x0000000010000000-0x000000001008D000-memory.dmp

      Filesize

      564KB