Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 10:13

General

  • Target

    2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe

  • Size

    552KB

  • MD5

    2f487de624de03c1df12168d08ac2e54

  • SHA1

    084424d72682fa9e2d981431a18a49d5558c1bd4

  • SHA256

    4fd93bbb21d237b209ff133b6b741f824e1bf994183abf5f71217aff8c98ba3b

  • SHA512

    3ee0a5f4b928416b33ca42202a183a56004a515ffb35cc5c5bd3b923f5d7e75da32beb5cb5c394e7c6c663dde717a98e40fe0168867be11555934e9f8077ac82

  • SSDEEP

    12288:h1OgLdaOKWctn+MEfOUgbJuMmFcouJqkY:h1OYdaOKtMOUgJHJJqkY

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /n /s /i:"" KVq1.dll
      2⤵
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\FuGe.dll

    Filesize

    180KB

    MD5

    0e093772550eb9541dd715c016b5584a

    SHA1

    20338dc859a5652f5661280dc508f4e5b533e76d

    SHA256

    028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

    SHA512

    0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\FuGe.tlb

    Filesize

    2KB

    MD5

    48e9706fe9f76731f3576122fc3e9e33

    SHA1

    387c8c4898ead8ace488a7df80fead429eaf167b

    SHA256

    7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

    SHA512

    e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\KVq1.dll

    Filesize

    203KB

    MD5

    41b13b132cb601ecc466654b90296353

    SHA1

    245258ddccb48826f22d57444f49fa30be1b36fd

    SHA256

    7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

    SHA512

    0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

    Filesize

    5KB

    MD5

    9a723d1f5523d95c8526ba00bfbb7e4f

    SHA1

    724aa6ec8cc13ce3566ea7e85e0501b4b7b0a7b2

    SHA256

    2fcbbbb90bc2a4f31aa68073b9321038ea003897284e89f2b83d0f2163cd1905

    SHA512

    e713bbef1040e3c50cf61bff56e0ec62eed279c8b5ebe3299b170d51c925071b3044435cb988590ad8576baef2b9c2d80d1f522c2c8621558f09352b42435d6e

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    25e275171dd65b607c0695a3345bd503

    SHA1

    882cbc32bd04ad12bea2a895d958a6c25ad6cdd9

    SHA256

    6e83f1dd075235b51011a059bf4d526e197aea6cc24994ea3abd9ccc5473a4a9

    SHA512

    a67cec650bc6610298b32b1af65e74d3b7a36ee6d5548bab3aa0e354502e8fa39ea59116e0bbcb19479b74767799440b7caf8aefd1ba47c89e4fe19d1ef48a56

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\chrome.manifest

    Filesize

    102B

    MD5

    7067c7411686222d29cb0181daf18922

    SHA1

    28dae64c753f7569a9d070f3a5a07a0c1ef59950

    SHA256

    bccdbb158e2517ff7fc0e0f2fcaeba26314a63c0dae29392c093803f3cc55ebc

    SHA512

    30fed41a63bd5dd0f124500a64863c0dd9ace6c643119bbee867531f8449b52e5a7728180dcf09257adb8ec69ca6b58573129af8e257dc9cb215bc1ae3c195d3

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\content\bg.js

    Filesize

    9KB

    MD5

    4684e4b7f717feb66da79c2f498d1764

    SHA1

    5ea89e5e4fcb9644c110630cb9b59513253e6ad8

    SHA256

    27561aac183134f1b0da0e188c632427404146032b78c0898faa405051869024

    SHA512

    59d9eb8086b866d84693b98673175ac75fa0bf81cfb3a626513f5ee4d7cdfcaf41f4a2d7dcffa185d6cc5c0a1159021717efda083744916a96abe4f82dd46d57

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\install.rdf

    Filesize

    604B

    MD5

    ed01911f8f1a607c8e4f691739bd4671

    SHA1

    2eb7354ba5a79e7ddb2a1a4ebbd75a05588ea858

    SHA256

    b780d233970109220701f4c2a3e5de406b01d1985df6d50fee96ca16431a870b

    SHA512

    fed8f0e263668caec42d97cf42f3bf9ebd5f1b1ad5c8cdd789f74587db75dd8630823dec4a34a3d55d3ee9608048467874ec747b4e2a6ebf839f7a2bdcdb6532

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\JXTx4.js

    Filesize

    5KB

    MD5

    35cc5c49efefe26af80e1cd0ee48be0b

    SHA1

    2127e09fe14264f6c15e246c85debf31e060c938

    SHA256

    9201db5d9d0a360f641575c0a0d7d203d35363883294ba289460c5caf4f0d107

    SHA512

    6ae9bddc2ce480b48479f3559f660182d78fcb18cded9ee19bdd7343b70c66470258ef9706d707a5390d5abd576d06ab87cfc2ef42047f3be4af3ef90e4f6e33

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\background.html

    Filesize

    142B

    MD5

    d3c5fe34c5c3efda93a8893b5154d79e

    SHA1

    8fbec7b7ef45e74275c94cb4c46b5d6cf44eceff

    SHA256

    8a0bb4ed4150955c8c457d4fc4adf2e79eefba1734e0f381cae96b5b3b27fcf5

    SHA512

    ca6cb22d277bd7def2584c4eaec11868ee79b3aa6138fc5975eaa3ec42312801b082bc971eb340059a685de320268dd6c7e1605906ef3d1fb40eed467a663297

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\manifest.json

    Filesize

    552B

    MD5

    8071a311337c0df23f4b7d417f6db406

    SHA1

    b8ee3931a76a601ca8da7a58a939dca9b308da41

    SHA256

    77c6657c4667649aff331bf26872dc7d1d7377c34567edc8cb995141698bcef0

    SHA512

    339fc43b3f56beca9e486ba457c7f567020d883e750f644b2dfe7a7d1949c1ef7ce409220686cc3732ebc5da61ba084a90fc659356ae649fb6c71c364c37ed9b

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\newtab.html

    Filesize

    347B

    MD5

    78a7fb965ccd462afb2b3804f81ac18d

    SHA1

    192ae928145c8a910533644045dc8841591e7fb3

    SHA256

    95aa5d83f2bcaccd50cc327a27afef74a0d4e0616c167d82332a4617061bd7cf

    SHA512

    102faf219f0ac26c451af0ab9bf13f5165a9c70c248a5018a0d868ab2e30080d4f79f1c975bfdc716434ef0a53cfc8e5d821950233c7ddbf92c1e4ab466dde14

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\sqlite.js

    Filesize

    1KB

    MD5

    44aa2f1757980f94db00bc0292742639

    SHA1

    176522bcfc5f739d7229be4cd546d6424261ddf4

    SHA256

    bfb0bca4c34a0980ffff653033dcafee22affa43f805e2d51f707c13dbb6fe38

    SHA512

    9c2ebca202c7a10148a7ea4b43a5c8ca2ccc2582384669385187bdfbbcca1c1d3a08b87091fc64b488772e6660523baaae156a5ed3edb12ffb6e5e7a8d66f0c7

  • C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\settings.ini

    Filesize

    7KB

    MD5

    71ac3d62417081c39f1c5d0c1e2cb215

    SHA1

    12a5d74b6d7caaea3e6e676fa5e8e8068245c9ee

    SHA256

    fef6292ed9de25dd66d72a9d26f235775518777fd9b29547ba2176b93a71e516

    SHA512

    6ae3c9ca16bbd3d4622a647aca06e52650a8b4de748dabdf8faea946339c89833412be77a2525d01ba4d074621c941c0f72866229647a8b0264a4bfaab9289f3