Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

30810519c7...18.exe

windows7-x64

7

30810519c7...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2024, 15:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    30810519c7220ddc034cf2632b147aec_JaffaCakes118.exe

  • Size

    113KB

  • MD5

    30810519c7220ddc034cf2632b147aec

  • SHA1

    5f02b96ebd361386e450b7565dd2b7818e5b7029

  • SHA256

    7058dcdda6e626188e9aaeb78ef460f66311ea6d04da878770b9327adee2adce

  • SHA512

    91fa51608cbc43df667163008f7f959075e021db84c312c90c910715509e493993a19255c1a46402e8731e248b2f71325ed5aaa564a90ca6781b1938ddd9959e

  • SSDEEP

    3072:h4eYZ4+1JXJJbdR87s9qY31si4n0VR/yPY4gNE0DD:q5O8tssEY3Si4nQyPY4gyO

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 62 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 32 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30810519c7220ddc034cf2632b147aec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\30810519c7220ddc034cf2632b147aec_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    Filesize

    1KB

    MD5

    1cde9e759f350a6da2d832231ebb48a1

    SHA1

    02a898fae2df4c872790a95fe213fa9baf067fb1

    SHA256

    a0029e6f41874c4d5ecde07616b04e667618f1504b378550f7a2c44fbafe4c0e

    SHA512

    62dd878de13b4b9480405f45fc1874e96fed84e781c6b17740eab8283b7cbee3c3ea3fe46cf522f20a8f5890df10ceceb5864d4036ed1405b04c20feaced702a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    Filesize

    1KB

    MD5

    3506fad0631bc92e4f26944daf209b01

    SHA1

    b07f87901074c8ecdcbae722c714fd1069e07378

    SHA256

    70cc3696cb1dbb8341af0ea20cb2ba48b54c827d21d490cb72701c06119e8762

    SHA512

    c716607231d222233d5e9e988d7c951c2f64f045fd73e5aaaa999f1bee8cf36dd1c520191180731c98e65711c30a48678aae40b43dccea650d8e01cde7dd97eb

    Download Submit

  • C:\Users\Admin\Desktop\Internet Explorer.lnk
    Filesize

    1KB

    MD5

    013a8e91b960c5d19e7e16ba5aef4554

    SHA1

    bc11f77f5bd74a3020864465b3c67c6c55fb7ee7

    SHA256

    35b5a150ff8340e10fa50574e455e04a3630e244420f6dae84a86122c60bd1de

    SHA512

    bf5c33c9620250266133b10018d8f1ec1358a557110500e7a95d7caf1ed59845f0da5cd329ea6820493fc4fd82d696389b4b2dcb71654ee4778ca759e460da5a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Installer.exe
    Filesize

    69KB

    MD5

    5a4e76ff84eaf2f7f7596a6e0c675b33

    SHA1

    4d8623f89812fb8b754e3582d73ac97b6c54d98c

    SHA256

    751099188bdaf484ec2d754beda6ad8a798a9f6f80e4769465b2ac9e02595b27

    SHA512

    30151d7fe609ade1a8a48d310c9be4dadc8d49f73e6818f2cf807ce30319c78d67d4d92d47af2ab36ae4ca6a38eff264af5036b6c873a8864f5aa6f368c05b3e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst8132.tmp\ShellLink.dll
    Filesize

    4KB

    MD5

    073d44e11a4bcff06e72e1ebfe5605f7

    SHA1

    5f4e85ab7a1a636d95b50479a10bcb5583af93f3

    SHA256

    b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb

    SHA512

    e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst8132.tmp\System.dll
    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst8132.tmp\inetc.dll
    Filesize

    20KB

    MD5

    8d8fdad7e153d6b82913f6fdc407d12c

    SHA1

    aabbeed33cd5221e4cb22aab6e48310df94facfd

    SHA256

    e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b

    SHA512

    42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst8132.tmp\md5dll.dll
    Filesize

    8KB

    MD5

    a7d710e78711d5ab90e4792763241754

    SHA1

    f31cecd926c5d497aba163a17b75975ec34beb13

    SHA256

    9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

    SHA512

    f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

    Download Submit