Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 04:13

General

  • Target

    2aa10c673f90a7e9db7f9862af58512d_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    2aa10c673f90a7e9db7f9862af58512d

  • SHA1

    37aa5a12e46b3fb02f4e2cf1d7e63365cbaf31b9

  • SHA256

    7652e33d0e625b59c84ae802bac6c7ff76f668e0606f3a5ea5bc71922980906e

  • SHA512

    e6bd01c5f4d9137e823b49c82c9742f1027de9395a60cef6e986ea32dc6267f85e3d3e9204c6c1c996764b77346ea1a2716c733007d08704e40906339963be56

  • SSDEEP

    24576:6xllVmuE1SgrU91hAFN0oMslXvf9N/Wfqvn/rkLY3jxgq:6xJ+1hEoFscvlNefkgLUxZ

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2aa10c673f90a7e9db7f9862af58512d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2aa10c673f90a7e9db7f9862af58512d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\00294823\odaJ9d7M.exe
      "C:\Users\Admin\AppData\Local\Temp/00294823/odaJ9d7M.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    1b53c596cfb1aa2209446ff64c17dabd

    SHA1

    2542da14728dcdbe1763f1ee39fe9ceae38ad414

    SHA256

    a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

    SHA512

    be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

  • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

    Filesize

    108B

    MD5

    8ee15a596d4fa6a3034f76b724cfa444

    SHA1

    69d07241a2116f960851c3a888659b1fabd948fa

    SHA256

    8a99a0344b37dbbe6ed77ae53332a6bf7ba8c32e57ba2e9e987bb475550b9da1

    SHA512

    ec8bfeac02e1b933f175d475c811c8f61329a43ce5cb8d4f612009c2d96f7a31006b751d4f63625c694343d72ff6048bab5c48b53a07bafe1169e775e40a99e2

  • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

    Filesize

    9KB

    MD5

    42c6b6e93f85423232d72dcc4d3e3812

    SHA1

    dd93fa635ffb44e50d3afb0311f25f72a5e8ac87

    SHA256

    96e9baeffd930f5f98a00020de95083783583d5815b27d4351dfa410788f4bfa

    SHA512

    093f4b929391f2a02d72462f90d5163e1b38e50a626162b78d011dd31d3bd6a26419d54e7bb8328ce640713143d6099baa3b11ad02d6ae208d011d5da7db3815

  • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

    Filesize

    596B

    MD5

    64608063bfc5252889512529d33300d9

    SHA1

    8097762a5e542729f7f2d9e21aeb7d94d108e1ba

    SHA256

    a6a0cd01584cedae751d19c5d24f0953dddf7aa0e7b8042596d62689e4e299bf

    SHA512

    699cd17c9459f91dfe77083d1d0ad36573a70252e601a0c6d86908bc5c87479f96644550014673b017076ab11e2fb96336c742d0f9dfcfeecfd703680b24ff54

  • C:\Users\Admin\AppData\Local\Temp\00294823\lmempffepkhnajalekhlpaokhgkpjhno\background.html

    Filesize

    145B

    MD5

    76b9d7f80ca7a2e1daffe330c1194702

    SHA1

    dc169d7e46d75f96a17bd477e46180b75bfb17cc

    SHA256

    83b479bf3ab54e89a6d855bee7f1d4f9f44e70715d6a576581a75749f7cf19ca

    SHA512

    8f1a749fac55b14583063c0eadb52efe756e4b345ef49dcdd74b745b702cdb1fe72c6a4d141751ca5623aa0ba23c47898b9fa29b0b370e808cf6c16fd06c34a6

  • C:\Users\Admin\AppData\Local\Temp\00294823\lmempffepkhnajalekhlpaokhgkpjhno\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\00294823\lmempffepkhnajalekhlpaokhgkpjhno\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\00294823\lmempffepkhnajalekhlpaokhgkpjhno\manifest.json

    Filesize

    498B

    MD5

    8f0f474d164463ffd696dbd4e7cf1789

    SHA1

    41470b09e1fd921ec527a4df79925e1b57bfa794

    SHA256

    26e1f3484c1bfe90f34fc1072176cbbb6e69da92239c44af6146485596c75063

    SHA512

    2a7f5b27709ec9431a722fc002846578d64b9ef1fc9f446febdfc539719629a2eb969597ca62796d6058e581c605038bafc36d33ba711b637d6c413c7e9cf021

  • C:\Users\Admin\AppData\Local\Temp\00294823\lmempffepkhnajalekhlpaokhgkpjhno\sqlite.js

    Filesize

    1KB

    MD5

    090fc9dfccc126184b33d5d9056084ec

    SHA1

    1a0b688f79ae33b0be4ab4a83f269ee4894c1d43

    SHA256

    d23bbb1eb30bf3571d71c4e6d4e51fc396c3ce1252453c7e46ea311ad6d91f32

    SHA512

    82a6eea83fc6c7c173b59d23769568e94061fb2bb4701769a85336fc105155fc7350cd8817355ead20334bcdda7ec56dffaa4d66c2291375c11ec2968778b4cb

  • C:\Users\Admin\AppData\Local\Temp\00294823\lmempffepkhnajalekhlpaokhgkpjhno\xlQuHYja.js

    Filesize

    5KB

    MD5

    26849d3c9082291d7af58689d1ba5be3

    SHA1

    8a9f134d246498dafbfa7d4920c8257866e8f4ee

    SHA256

    d33d943b0fa893ad388874d7e26b33cbeacb72a3f33359e11b38ba6e1c8b7fc3

    SHA512

    6981fcbb1ad3fcdde0740252d4c4b28e082980a14ba0811aa75cb95e7cc9a0b24b3bbb9f0ea0214efb1ee6a5f655af4828e840a24582cda14d8f2c129e2c7c61

  • C:\Users\Admin\AppData\Local\Temp\00294823\odaJ9d7M.dat

    Filesize

    3KB

    MD5

    b07150de99bf27ab1d732b96b52d087a

    SHA1

    ec441b92719cbe272710cb81dac95076a539da8b

    SHA256

    30a69c2ec0dfa5caf4defd6ba69113969c419d115ca4bd07f1f41019eace9fbe

    SHA512

    0f1734e41c3d802bffaf38fb30147d60018ed62e8b0ced1829c45ca906040e9d0fdc345ae1f1f2117b82c54718873c2eefa636f54de71c4e5b0a1829fb707cd4

  • C:\Users\Admin\AppData\Local\Temp\00294823\uRCrVFx.dll

    Filesize

    258KB

    MD5

    e1d10cccd5dde588af8ee2cb7309523c

    SHA1

    0b9e805077320b0ce1e6620488bd34f1c4d7827e

    SHA256

    9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

    SHA512

    a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

  • C:\Users\Admin\AppData\Local\Temp\00294823\uRCrVFx.tlb

    Filesize

    2KB

    MD5

    9156db5f76d48049dbc41fd1b58b3f34

    SHA1

    5eb1df59f9b5b06ab00137fc9e6451e323d3102c

    SHA256

    66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

    SHA512

    742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

  • C:\Users\Admin\AppData\Local\Temp\00294823\uRCrVFx.x64.dll

    Filesize

    319KB

    MD5

    4f5c722b8686afbea6f09c53171d44ca

    SHA1

    184c60aafbb12d1023b1ce2aff4d3708607a75a1

    SHA256

    870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

    SHA512

    e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

  • \Users\Admin\AppData\Local\Temp\00294823\odaJ9d7M.exe

    Filesize

    334KB

    MD5

    8300c91b40229b42301aebc6d8859907

    SHA1

    0b55e56a6add6b4dd4ceff475a0018a203d02a5a

    SHA256

    f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

    SHA512

    0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f