Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 04:21

General

  • Target

    3866caf110bd9a5ff87314151c7f19c2_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    3866caf110bd9a5ff87314151c7f19c2

  • SHA1

    3cbfa0827902913d9a604202b4a85869e0a7381f

  • SHA256

    1c355af48269bf0f2bb533aeed3457fc4bb4f86b0813e5ef781a61b6282a68e7

  • SHA512

    845fa60e90a200fca1eb85f8957ae6f6cc4b87fb096187dbd7aafc073d171a158ba39365717757483da6883f437c0cc29af46bdc6f168f298b6d39930b180685

  • SSDEEP

    24576:h1OYdaO8OBsFEt5hDG0SAMs9jR/jaJnTJdwY68+UhnWb3aQ2:h1OsJOEt5hDG0SAMs9j8nTJ2Y68hWGQ2

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3866caf110bd9a5ff87314151c7f19c2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3866caf110bd9a5ff87314151c7f19c2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\RHkqigS2cf.exe
      .\RHkqigS2cf.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:2060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\RHkqigS2cf.dat

    Filesize

    5KB

    MD5

    79bb08b02a04f2d75c291f377af86511

    SHA1

    f495f98418ab7c135a65fbb5dde7ff88d21b8af9

    SHA256

    643cb184e7ec1a005e982962a16734b6835710594cfbd62bebeb8b66efd8a30d

    SHA512

    122ef76a07420add0e78e6093d7312ddcc72746de4c37827507085d31663d4ca445ebbbde44e86e6e9b8adcb26e25cc57b596680c0d28c7cb7df35e7d5a76812

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\RHkqigS2cf.exe

    Filesize

    334KB

    MD5

    8300c91b40229b42301aebc6d8859907

    SHA1

    0b55e56a6add6b4dd4ceff475a0018a203d02a5a

    SHA256

    f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

    SHA512

    0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\W9FzfBdPS.dll

    Filesize

    258KB

    MD5

    e1d10cccd5dde588af8ee2cb7309523c

    SHA1

    0b9e805077320b0ce1e6620488bd34f1c4d7827e

    SHA256

    9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

    SHA512

    a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\W9FzfBdPS.tlb

    Filesize

    2KB

    MD5

    9156db5f76d48049dbc41fd1b58b3f34

    SHA1

    5eb1df59f9b5b06ab00137fc9e6451e323d3102c

    SHA256

    66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

    SHA512

    742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\W9FzfBdPS.x64.dll

    Filesize

    319KB

    MD5

    4f5c722b8686afbea6f09c53171d44ca

    SHA1

    184c60aafbb12d1023b1ce2aff4d3708607a75a1

    SHA256

    870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

    SHA512

    e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\mjiknpbdemgcpmhnnfcibmckkjjjcola\WqK6eLHxoZ.js

    Filesize

    4KB

    MD5

    59b58db4280f4bb532e5bf7f289f1fda

    SHA1

    27302d94657c41afb54867edc46c5c0f318dc82e

    SHA256

    78128ea6de4fca67fa1975c990ed7f3b0c607bf3ca0d77f031edd97f3a7e26d9

    SHA512

    3fa88a7d0a89c50c1719089d9676078e75cac146fa2737772b24e6dd768f7ee8c46871f2c712e4f9cdcad852790b1688ed2e7a430462dd0975084d8a43d81ed2

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\mjiknpbdemgcpmhnnfcibmckkjjjcola\background.html

    Filesize

    147B

    MD5

    60f7972124c3cbb17650b82af8d9bfb4

    SHA1

    271f08c09f61f2d7723b1d032fbdeba97d3a2403

    SHA256

    232d5b6d16976b3855be10eef293e5cd818f3812a898af48b0e24f34408c6465

    SHA512

    327a8037ca3e19653fc8a0a2a27d5d99ba6b72c1446fc4c1e331b78f71ebd95486849c9cb2afa089aa029836334cc5ce708c0b3c9f59fbe64a916cabfea664dd

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\mjiknpbdemgcpmhnnfcibmckkjjjcola\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\mjiknpbdemgcpmhnnfcibmckkjjjcola\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\mjiknpbdemgcpmhnnfcibmckkjjjcola\manifest.json

    Filesize

    509B

    MD5

    ae2fe076289c2f9eb2c49a933b06060a

    SHA1

    66cbca5f8a77558c88147bc7b2b3c14137035c7e

    SHA256

    a99e59e3e20d834ceae209c0811148c3039bfb16faa9caf0e80cb0cb10efbe11

    SHA512

    b3efa5a43a3e4a2f2da856a1ecdd2c4da664384fac64cfc746142057c2cd1dfa0259c140936aed5fa4657ac1e5ec250c66c877752b481f01e2938a73a23db8f0

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\mjiknpbdemgcpmhnnfcibmckkjjjcola\sqlite.js

    Filesize

    1KB

    MD5

    891c367b5215632d5633f84d35e367d7

    SHA1

    fd83199b30d500c6cd5206852424bfabbdb177c2

    SHA256

    fc1b943c5b9ed36b4ac0528e8ae937c1f90bca8c39eff82a8c6abae9fb9c0a98

    SHA512

    55f903c967dff61394c5f8a0d61902f0d5932186129ab5d37c59b5f02c30d8abc1e083b49144467cceeca723c8dd6cfc97f490c8534aba5c06dd764d6f2b3c9f

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    1b53c596cfb1aa2209446ff64c17dabd

    SHA1

    2542da14728dcdbe1763f1ee39fe9ceae38ad414

    SHA256

    a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

    SHA512

    be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\[email protected]\chrome.manifest

    Filesize

    112B

    MD5

    6a8ddffe41f64b38ed045870ab59036a

    SHA1

    17689476931752418c2bcdae0c50b3e4b7c0d005

    SHA256

    c8c2249359f3f6f01cd230eb90948fc435250136f57ab6b39eb2a20327ed29dd

    SHA512

    88d78d8fc87c7e7e6f44e0f95074d065fd83b3a2a6b0106288ba912a7085f4d3a55be8fc068a15426fd4668d967b33c9d124db7afd4aa04b8db059b332c398a7

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\[email protected]\content\bg.js

    Filesize

    8KB

    MD5

    f97e900279c2ac02067626cc3836e864

    SHA1

    be458edb10c90f59f195d043eaf9ea31defb33a8

    SHA256

    7be19dfb8199772a81028650c4a153e59460c225773d981078508fd4e4ba26cc

    SHA512

    a7530dd6d1c3b55a839e2be7c4f52e74b76ac0455cf3fdfc87cd30d07c0720b2176ef7f31eb7d53cc27e56e3c3b1ab81e642f0d169115aa4968903e912d6db77

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\[email protected]\install.rdf

    Filesize

    610B

    MD5

    c5633129cd028d5d8024ee9073d9ee1d

    SHA1

    ab72f0e05209760c70a2ed7540506da429888fc9

    SHA256

    2656c75e317744ad28afd2c88ccce53974919ca7833bc8464c38a4ee64e558d6

    SHA512

    0abc0645c33b8bd343bd7e574000ba824172cc0db3d5d81e1e8bb34bfd5762fe1a6ba1e970cf20ae6ac6173f1827177a01e8d4785ddc592e36c151b43baff656

  • C:\Users\Admin\AppData\Local\Temp\7zSA16D.tmp\{C1A27135-69EB-8D44-7358-34727DD7B820}

    Filesize

    3KB

    MD5

    a455d0b70103d7924ff00fa23a0cb640

    SHA1

    ffaa5eba17894f7f5618d75ff96679548149a6ee

    SHA256

    ae586374a48108b6ed0c0272f83438e72376b368a8c9085c652aabf4fefa605b

    SHA512

    e91c06a73eea8602d5e54cdbe7a003c19698520588005f00db6cec3ae55bad458b06da84ee037ae32af6fa6aade7370684d118f477a89d56d3a2e05680b77da6