Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 18:35

General

  • Target

    439f9b28fa6936b6148dbbf0caaa43f6_JaffaCakes118.exe

  • Size

    48KB

  • MD5

    439f9b28fa6936b6148dbbf0caaa43f6

  • SHA1

    bb161b880fff2b923b110937f85f23d6c8a63b57

  • SHA256

    3f35110bc799dcf91e8588dd0cbce97dd0ef2910f0977855f49d984e783aadd0

  • SHA512

    0a2752a05542ead85db3d436cc2a97f9d701b144c357b56f80d84bf0b66635bdc2c4694722f25cf706245d09b927e1deea999c4938994a6442e5b1e44cee7ada

  • SSDEEP

    384:d4u1ocncoDZSw5Zb/y8xBbHiD30ShQ0E8htr1iDJjJBv32o7ZgYwzEWtDW:SgRRDZb508xBbHYjS0EEETZp+mIa

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\439f9b28fa6936b6148dbbf0caaa43f6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\439f9b28fa6936b6148dbbf0caaa43f6_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6b95c12b8f0dbbac6925a24249892a1e

    SHA1

    cd5d3e70f398e454fe60c47eef12c0442ea250e0

    SHA256

    d48f5c30453d51fd6c30a4ed39f3ab89b4e39141c4e5d9b3268ee3e556663241

    SHA512

    636459d9db974cf71a83c4fc1ab1c16cc9ec83e80393b3ad736b3bafb2097456d3ff9af21774f876127cc2fa247c1acc76821853a26a5facfd4627e9fbb13743

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fc7ab287663ce88bba9fd5f526739baf

    SHA1

    ace2daf363612ccbd49ec7631e1f70ee26b2e7e6

    SHA256

    b7eb4558d69ee24f42a6722576f1a4cc28c55a0f5539b80717f82ceca6542511

    SHA512

    e94052115e987df12a38ce9e212776b1cb36c34031605540ffbd2c76084e461a825e72938b09752374fe0fd8cbc66c122252627f0e46224bdb8b45beee907109

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c733bc8f5d56b1707ca11ec11e9f7f9b

    SHA1

    064bba6ea7c1c2fbc8bf852f8045f2255bf93eeb

    SHA256

    4a819bbf965d2fc16db38acf9a784b770c378d0b1bf425c4983ef111dab343ce

    SHA512

    e85d1f3e847ee8eaa39b143b66dbfd9fc38478bb0b55172b56decf1dcc8f038eda49ce146c420c22f9cc9c2fdf928adef154fc9b82fe26714af90c6c1d2f7d99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e27e3fa9a470fb71404314493f2c207

    SHA1

    990778157eedf226d8442d8e5ac45eb8e3e2e1bb

    SHA256

    757c6d59376fda83e66b80fb2dd0b30b4f193fe67ced7107c642b23f6ca6ea5f

    SHA512

    51e8e089e05c8f1608f6bf540823e99f688092cb54247767cd7f5df208ebb6af7a29c1830e043a3c93966005ebde5e3af0fd2edca4991e55ad7b0ab194be9de8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40c210eeb0ab9f3d8827b8ae6baf7974

    SHA1

    822d57b393f282e61603e884f3bd5c2977d27613

    SHA256

    9fa1e8a8d2be68b9a8454a9b942ccb79745683eed71192f04be745a5b482189b

    SHA512

    dac42df23e9c9ec8cb4fbb39547bf576161d5207f58dc08efb80c9c1dbab6a2dfa662e08ca4b84c286ef4faf49ebf16e179a63cd698303cbde701a93725628d0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    add355d53c879d7fbd3b0e8e0d3b2730

    SHA1

    05aaf425434217eea44270d94e7196033b56099d

    SHA256

    b611806dd0d049e40a420f55fdb7e7bb7587020c3fe4b48611bb9a4025f90364

    SHA512

    c20b6fe4406c6c2af3491ce46d7bfa98219cf6329049b786422888833ac5e789403e554a9c697708924a23b33d444f6da465a9a66b4d84f1131c865526c868ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f317a4c5f1716b161b147bc5db741563

    SHA1

    23315e45ff66108c0d19f064350404e6191784d3

    SHA256

    7823c0b6612183a59986885290c5b8dd8b005a1ac4152c5958d2dcaf7c130ec7

    SHA512

    a198b8b80acf8fe5edf25e7c41f94353e91796ab0efa5b8926dc082b461a49653b69478420ed0ac0b7a448ddbd9934da5bcc2958d7dbe8a162b5ecc08c8cd0c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cf7d1d41b60043f17cb8fe44410f1f90

    SHA1

    ed1cb3f4c9788a66f9751a47ac1e46d636c8c3bc

    SHA256

    d67419b3235eec74a204524503648d8c204f1a4b5690ac357c321d01314d3bea

    SHA512

    d2b548b54c814f9119538ca0872dfdbd3310446b8a765e964f6e5f8e085989339d1905e0f8072bde1c60550bf859de8942a46d66b903ecf001338c0880d2d66c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    576ff164bcfcdea8f98e454b5b5562fd

    SHA1

    8a4f1d61f1911316dd2e3e227ba6ab486cbcdb42

    SHA256

    45dff83104bad7e2637fbcd87c3e9b3ff0c4cae9bcc61d5f19f421723d18a169

    SHA512

    2864a2665cc527d127c81704cc041850fa8b313987919b959efaac21e298756c02baeb5a8f2175b8f6f0a91218a1a48184682b57e30c9a6e51d186b8fdadec7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8aaae04a764ef34be2f631623dc7fa0c

    SHA1

    2441376aebc139d5e7e521d4b158de6003d6f483

    SHA256

    b8db74b5e33759d8306c0fb405ee093106817bc2d439e69c8f966f2574302948

    SHA512

    eba61e7cfcf44160377db231b3fb8a039d850450f60bf66430176633680970d76c5e2a335125fbd6e8c64686a77ed7e7bbd61fdcd1e63a68e690be654eba1543

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8e2c0f0b13e7902e82ba569e6350da76

    SHA1

    a757a78d590cfecd1164995d5b78cc3aa0a789b1

    SHA256

    08c8d79635509a7bc2defda1d8d3bb6feead030f1001406373a743b729f32950

    SHA512

    6d939adc8858485b95147b36c217857748b4964aeac03d3a63960345685446920cc1c963b2fe7cd641cab53f7f5ba2131ffeebc94eb51d01a3766820b330c9c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cb6a5142d64d7be3cb0a1b27f379b4e2

    SHA1

    c2c466f1f1b738bc29aabac723cb8fdf8df74821

    SHA256

    84e3f035cdbc8816efcfe4bb2674f1f0732006a500f2d60d5ed0bee1292f5f43

    SHA512

    c1265ef2dde60354f1883d23714762e8b88c6a2fdc82937c9e00e821063e0368110b82c3cdc5a2ab46776030179b94558e57fe10ec55575b68ab41732a95c087

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8724f7647879e7d6d3f5155cc822901f

    SHA1

    6e88f6676704c9466c4188ebedb8a1260b977753

    SHA256

    09f846cbd08d0d67f1fc16de0fe92956eada1753c5a9859fe8d21b404945bdf5

    SHA512

    148d01978c578432a80582965570a0be1d1d5f1ff2370ef10b66c2940f8e481cbbf3d52810079a2bed98e00368a2287c48607a0555dead3db7eb34f68b8473c3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41863824830c72f4ae55e9066d769c78

    SHA1

    d1207baade77402ff029af30fc8b29e8b63c02d0

    SHA256

    d4e3c6a689383b813e9b43aba181168057be16a7b9da6cc3afc73c8101e82137

    SHA512

    55e4f9cc4c9aa804ce880ae2592fd4f7f28581f0106868d6ba89ad6195df8ca28400a9107d46dba58e2c49febfdb5a43624ad4b649b5c6b0942a99b390639c11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    926caa5d9d91fbdc227901dec59ef491

    SHA1

    8259baff745ee1264169498a93802a13ef6cf509

    SHA256

    e595ef6e9dbac1d655a5ce6163e748f2d745addb2bac5d60b128866df969769b

    SHA512

    39d849261e652f5a5d751989dd14933dcd078c444ef59086fb0927291e12fee441d68a2076c28c096b54fcdec42e785e3329435435b2dfecc640615842949309

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c5411881929b81b48a45cad370180dba

    SHA1

    66b4f5a59b63f7d4821c5f13ac7b4d7f2ae6ad77

    SHA256

    c4ec27d24e7418de455b60cfdd5fdd6b9907c68b43821aa84d7fd5577e3797a4

    SHA512

    2a5c154deec7617fb3f3ee3e7633132cba6856cebd8925e3fb4807289fb6444f1602c7ddcb1a86ad3d4db1a9c8c9853d7a1fd8975c0b6ca2f1be4772b41891dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c505cf7510e99f7e579a6303dd306c5f

    SHA1

    f1845ad075d5e80d7ad2c865a2e42837d6688b9c

    SHA256

    aceed100fcf60f0fdba6442c8def3cf1b65fa66497e50fcd59bfeaeece708549

    SHA512

    34b521e98f4d423cb7cf05e7a71af2f29e3955a9db419f9e4486268d07d5dabb0902b99a26e65fbb6695e4fb53885c896fab6061f82b4fb5d783f250699b84e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a644583673d2da620696f18ea9fd4a77

    SHA1

    aa2d85f66d7c0781d0ca612bf4549adc7ab0344b

    SHA256

    8744917312723dec33e92b81d6fc87dbe057222a0c7eb50a445a072b3651ce55

    SHA512

    531d79695b382ec69a18e3c0d6b523d231d9c0596980ac9b653655332a04e3c50849a992a78425af8c1030088861e475a252d63580a962c6678b12ec0dfec7a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a732f156a1a7a5b7c5a3bda4cba46fda

    SHA1

    e554f61dadc9ce48e7ccf6edcc7e7cb8890540bb

    SHA256

    1e7d3093a852023590aa7ecce771cb284eb14af559544dd2bad318d248c10e80

    SHA512

    4c1cfd7e48a59f8ca0b08adf35b430fa02306d3d672a060f07162d9ab3c793efff6a34d30cc4b0f72fa1d0dd28417352c9fa8532d82df22bbfb08639ed8c4c08

  • C:\Users\Admin\AppData\Local\Temp\Cab2BA5.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2BF6.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b