Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 00:57

General

  • Target

    112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe

  • Size

    551KB

  • MD5

    112dc26f534e4e55fefddaa621582eb0

  • SHA1

    5597de93bebe233e2e1d7e945f246a071528cdab

  • SHA256

    76706689031f218ca95e49d057039a983362a549aced4071b079f375c758b93b

  • SHA512

    deb4c57bdc7848bbeda69258928cfd5a36c7ee4a4eab1fb6ad80ee243ac20ca3f4541e4faea7a153ca74e85cec6a5670040729adfc56e66d5286b082b5cb39b0

  • SSDEEP

    12288:h1OgLdaO0Wctn+MEfOUgbJuMmFcouJqks:h1OYdaO0tMOUgJHJJqks

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /n /s /i:"" sLlkS2.dll
      2⤵
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

    Filesize

    5KB

    MD5

    546b345f7f9945dfd0dc2f305c24b19c

    SHA1

    809b176a86d66354b5311fdb47913b0209f7b8d7

    SHA256

    ca8cf75fb5631267b97cfbc679133bb7c314146ff3ff9daa4b1c8e269b0fb2b8

    SHA512

    27710fc946b671e34393d4228cd6e85da476cc17bb7e460b4a8e657172b0a40f37214b8a4b0e63167f8b2ae971b8820b6f6fe2eb64581a5ae4ad41d1aeebc0b3

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\j43M04.dll

    Filesize

    180KB

    MD5

    0e093772550eb9541dd715c016b5584a

    SHA1

    20338dc859a5652f5661280dc508f4e5b533e76d

    SHA256

    028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

    SHA512

    0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\j43M04.tlb

    Filesize

    2KB

    MD5

    48e9706fe9f76731f3576122fc3e9e33

    SHA1

    387c8c4898ead8ace488a7df80fead429eaf167b

    SHA256

    7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

    SHA512

    e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    e302eade9949c6e4ecc999f454c61497

    SHA1

    17b84af250f821a9da87cc26da87abff54fab87b

    SHA256

    d0393399c9dda621e88f0ef460472970f0c590d38a3067224d00c1fd12226b1b

    SHA512

    3b3aadd02c25b5b68b976eece4a160950f1a4ecb45cce36e3545b25efa6d5e8a64c3ad398bb4602d8e80fa48fe4a57c4d3e3f8efa040c72d8175b9acbb4e4d60

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\chrome.manifest

    Filesize

    106B

    MD5

    e6fc5045bb7aaffe4c69b6131fb1cf34

    SHA1

    5fe1d0dc634ea39a8744be530ec7d72cd9bd0d20

    SHA256

    35c27ada4fb4e210867ca8fd99d4088d3592a3e51bd4fdae708e08f304527a3e

    SHA512

    8a412a7b6509b69f84b53b6882edc37fce720def54bb60cbbfccd3bcbd8a20fe00eaf7d2e4e02ac32e06e1fe6ed3d4fc554a77cc10dba2be5b844725c587c175

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\content\bg.js

    Filesize

    9KB

    MD5

    b756a3f0fa7135274f8dd7eafbd1365a

    SHA1

    1ee64829f159da5e0b7c20260ae8cc2921870826

    SHA256

    0ce5a17e74f96a5df9a38ad37a8a1247b11c8979ee09f6c1d93254f02c0abb31

    SHA512

    0a2411b430ff7b8e2880ef58325df865cb069b16754e4cbd4ed22aedf101e1eb3986dca5470d319df30ee535669f176fa33bfcdaaf39e5b7ccc86ebf63b02758

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\install.rdf

    Filesize

    600B

    MD5

    50c2d2a701f0e1b5e1e97a5ceaa054bb

    SHA1

    2247ee1e1af9dddee1574a6af0b3f9bc2028f5de

    SHA256

    9e2b7ae5eb5ba1466d1bfa5ab3ece371b3d005f70da4e7fc84942c874782e9f4

    SHA512

    9b95d22047d0b61a5054efab1bcb9a5f816f3ddf834615c6545eff8cd0d54d77d0ecb9ba8ec59e2ac2967e99f804d9e524629f28b5883b68d1e60ee3a04ea53c

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\GN22afr.js

    Filesize

    5KB

    MD5

    b01a499868ec838003d89beeda475524

    SHA1

    fcb760445adac3d46cd3df380c9ea5a18e4f9799

    SHA256

    b15400dfc96ce05056f4ebe45b008cd29a16bdf44905526d13dac0102138ad27

    SHA512

    d0718409bc3e6f0a7e11fadd7ce3767be8dc4275898e5f9fbb79e14f792457577998694e9151ecb7d6660fa98d5e5a32773e219f8265635f5d85bdb55e0ee02a

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\background.html

    Filesize

    144B

    MD5

    fa990da9f6f58d35adb6202d8cde92be

    SHA1

    09df4badb9876df8882000b15b801afbd9d26e4d

    SHA256

    4efc59adae6a9dfb672788ac98d465a2256181610846e6c0eb374277b3b269bd

    SHA512

    c7d45ee21b4e032a32d5badff8bcf3ff0181e1791272b31dadf6932449fb35214f8e07c99a7e9ba66f7b139141bdc543c3c0a83ee9420d4ad67a57ff475770e9

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\manifest.json

    Filesize

    504B

    MD5

    a661344ba03dc31dbe48ec17e75846d5

    SHA1

    078dd3172685f0f0dcd2e01901267d2dabb5f657

    SHA256

    c47666baa1315c322a85e01f4c18ca1bc89f723a0224fd1b499fa715eb92c196

    SHA512

    9022c5d63db00505cdc5faa2a1c63e5f0d2cbf49086b90e78475c75e437d9ec5fb66e8d1c4f541eaeb13d76f349de54648c51f61e0697aec5767d18357acd664

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\sqlite.js

    Filesize

    1KB

    MD5

    b0058cef80b67e4ec180c85fa456ba25

    SHA1

    c0fefedccfbc36e3f1730ad614bb90fd721a2f17

    SHA256

    707510a3f9795f7386205fdfb7c07335879c835c21e9cd81a315779fb23763a9

    SHA512

    cac111a5898b2230a23669e2afd57c736152392f59f2c200f370165587cfc7daacbf50ac54400a4d01376da7cc22db5ac0c284de61921110f66ac2bf56e2b0fc

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\sLlkS2.dll

    Filesize

    203KB

    MD5

    41b13b132cb601ecc466654b90296353

    SHA1

    245258ddccb48826f22d57444f49fa30be1b36fd

    SHA256

    7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

    SHA512

    0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

  • C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\settings.ini

    Filesize

    7KB

    MD5

    30cebf4f79c82503fb6d3fd63c02ce58

    SHA1

    723361e564a83bf0c0ebd70e42e15b4c3168d2ab

    SHA256

    b43878aa7f4377df7882058f153bbf548e6e4daa8213674c22e11a2a91f282c4

    SHA512

    86df63cfc2ffa2af343ce1a6d8d9e934a8aedfeec4058fd2a4dccf97b87e716b7408772128e38eee457ef51e684518c8235a8654b38111e77db725c29c608306