Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
6915918fdd0633eb3a0f91bf7b687e5c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6915918fdd0633eb3a0f91bf7b687e5c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6915918fdd0633eb3a0f91bf7b687e5c_JaffaCakes118.html
-
Size
8KB
-
MD5
6915918fdd0633eb3a0f91bf7b687e5c
-
SHA1
0ae8888a11ea1606c6da828faafc22fc692000b0
-
SHA256
5add75f537b1f15af7fd0af9722966beb637435b061ddb73780cc1422de3df82
-
SHA512
283c32dec047307d16e2933816c4ed763bebc60ae828f7b516106d69fe3cf00b2b5c4dbf359dc6086370aae1bfffd5639b594615d5e0666712ffcdada565e61f
-
SSDEEP
96:uzVs+ux752LLY1k9o84d12ef7CSTUiyqUhoU9gUdlBdvn99JcEZ7ru7f:csz752AYS/q5hV9TdlBdvn99Jb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b3b9c752552f94f6694f1f21c97e4c79448dc27ada1293e282a449b0060855c8000000000e800000000200002000000037b6668065b795c93db67f0c6ce1d249b397603e74e0e3836dda0ac4165f9ab490000000344ddc449aaabb7e649393654e1981ccfcad96f5025e734aa6db415c3191fde384e56856808e245df683ca1b5d0c6dedf309e989af72de7818d3a50e5d4f50dcb9a40092a903db30edbc3abf64c25427ec41078a8cd2cc037fdf7b6f1a0091ccd43f670fc83bd2e2198b44c7a4926bf3c575de8527eba98eb6777237592869a618bf29d2d71cc441520467b7eecd364a400000003a2756a5af579f8ef44a1ea4c306fcb2905a61131fde37a7f1870adda4265cec9c0f212d0c4ea9de4ab6910794a82eca43bff21c1581c8f0c1e27999da97c357 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a96f47359bf68cb251f6050b384b70cc37f692bd813591c6f5ea9e25b80897c9000000000e8000000002000020000000d9f72eaa5b1f5bdd6eddead6c9d528a04bbb52a068f8114bf05ce3037615629b200000009a2e0f1b478d26be2f844c1cb1aca2c2fd3fb469e832e536939b380ebb640c8340000000ac81ec898069db3312dbc3f9facb219522def55032faf0613eeffecdc020f68e02651fe1a44b1f07b8da31b8b70ba37b52774570fdd562b1b791c20dae0dea32 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427933465" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5DC31C1-493D-11EF-880F-D61F2295B977} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00748ecb4addda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1292 iexplore.exe 1292 iexplore.exe 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1292 wrote to memory of 1248 1292 iexplore.exe 30 PID 1292 wrote to memory of 1248 1292 iexplore.exe 30 PID 1292 wrote to memory of 1248 1292 iexplore.exe 30 PID 1292 wrote to memory of 1248 1292 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6915918fdd0633eb3a0f91bf7b687e5c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eb2fd08585bc923bebff4116bb3206a
SHA107df95bce041b2c0954bcb79a13ae7e7e82b1ebf
SHA25613613841c38dea6aeedb04a31d4bdc75a62a4dbdcc74bb35856e5d1922588d99
SHA5129b009c9561ab5e3603c58a881082496eeed96cefc72f5a0ab13b792fd7da8ed156a5903b2c86bd691309c8aee678f21de6820898b3f20470e60bbfd90db4e6ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1d3faaffbea865aefd370c2eabfc5a6
SHA15678a9e38e3b91596940efac6e171a0553c5c0da
SHA25668c02a171e9702262864e9c88e9b3102366ab2c9d543039aca3264d42b78e1aa
SHA51244943ddda074ec5f073bd9f1cc39fd3a2ac1eeca40b9e9ba4ee08e67eb957cc8472dba141ad56c4cd43eb9f023c17329d724a014a16a9741733197728872a464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5456ef539873a374454e4e1bd9fa36b6f
SHA1cfb2299eb00cd50cc7d8d46dfc16f4dff215101c
SHA256b3b3f08d98b61ffa5a4b06d2d14732032070cf2d321221b4d579e2c8d69b918b
SHA5127ecc217e220b0297efcffa0cf3e2bc3db4e898384c6d5613f520e101a3ea99ccfd29c53771deffa666b3d449c2d520c043c22d79ce3f436ec3dc285a84c16d17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed82405c23e6657fd49af7c9bf7da369
SHA1aa5c0df19d7bc75176ae5f2ec33ae8f616d02deb
SHA256403b55a13fe2079c4d335fe5b0a98e7d04b88391e26c94bd8f0853467e7ee9f9
SHA5122303dad61e411dc4559474b5f2d82c3d76b663e2582a6eb92a7f4c49fd5f42fd93a83ee2fdd263b100e341ea7985ad5964b2084669a235bc1cbd0155c5d5e57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ff3fc2fbb6da3be4709893d7deb75f6
SHA18421cd59a6f616db284033364c5694572192de1a
SHA256b272c4613aa0a600a8e218a17afcd36849d27b233e7bc993df2c47cdb72e7857
SHA512c0b9081e1b5c2274dd5a4a713a5599309d18a53d87bed4f8c56d9831c44848bbeffc11c02619d94cb59af2a7fad66c0f5741e58bb88bfe5958eb3c88aec46224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550f467602196939a5148e09a1ff6d97a
SHA1bd4c849187b3fe593ae38c37d3d6d48ce9c3a65f
SHA2564b3aa1c9440c0bc96917aa527b9bc3e86ebbe016decf9d1bf37074e01b99b9a2
SHA51231f6d161cebbccdda544c52280d057d0118969af5c3682cd12efbdd521ca9e8fc7b35ce318617d64c4951a48ab9a0d29e5158ab0e866c8ef1377f995d8cc3238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfd8b959b4a926e41cc0280c03c6b816
SHA1c692a0f1e4dbc367a136e38f83d451f4ea636636
SHA2568a1461a2ab1fbd3d4d3b988a8a9fc994b6f3baf25628c8286f6eee09ba707631
SHA512387b9eda6f17f969be539eb7dfa4b05e70977309c159945b82585a61354699ae4e5cce5c4c8a8675c014ae55da08d6a503e351642af7fc1f1701e1c566e6e9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6327e408b81965c8d29485621804358
SHA143be09edafb1d2918ad3dc95ae4228e051bee1fe
SHA256a2ee94f328ef6daa52d2e693e65d9618d5be91f10dfd1659dd180846c0ab3bc5
SHA5121e7a1c8f42f6a47776a8956eb68d0b3e1a09775423234e0798e606e27777cb270e12b692717878d1032f46bfcf35ee5d13cbaa974482b11f6ae497ac0afe595c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d236b99183838f752fbbcc2a8c483be
SHA17943d5a4db64c81ac80c46b601b12a0cf81d2a21
SHA2562187ff82a315012f512d846b25ae2ee8217873987b75c147dc309a2fc0483146
SHA51284780b9305c6000a4b7eced1c7bd9f37849cf4ac3038008d84567a1ba57a21fc19755ee96ef0c0bcaa077d89c5c17eb62299eeb2030acff2851ec78f7bcfe416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4ec7173552941470ece64748c99f2ac
SHA1b5f93c6e632634a372e0d724c5f305f3c1bd8c2b
SHA25641979c1d8bd84d0b8d3f608cfe98f93501fd243f673c361f616ad879451eeaa9
SHA512e618efb3ac7d1113c705602475012719d088266b393192e8cebbb1f1bd77c5923b4df227e9313aa0c8511ca725aab42aee41091b110d37b8e946ec1e575621cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5386d4b0bf683971f32dce9517865a36c
SHA16016fe603cd1969f536db0041659bfab8fb94291
SHA256d3f5b2921f5258e99467840844af41429e3ed71800095250bf23c665b3c8e584
SHA51292cc5523fc63b263bd88fc2a98d4ffc069b86a048ff1d78ee87c7d7aa713c1f36afb3bdff915913eb005504e70f4ce7240e8aca7059bc297cfe719e532297b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1f2f9227c6fa7cc1e57f04903f7a927
SHA15692aa528a56a0dd561ae2aa506998f97e2ad2de
SHA2566d9ab8e01033ced6826cafaa5f97bb6f6d9ffbf0af76fd78fd5e7327253f79ec
SHA512af2c9698c30e1aa9e4338d3c09e43b6c177e91671ba023ea04ed2aec31955ba7111b60f2ea9ffbfbe1d499d82258b9bff8862a90e08e0078e1a17d8f5fee0fd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595dd17adf85809d904d6639229b57ca7
SHA10c863a9bc28e6a6b55e7891006714544394edfb5
SHA256662236fb507b8af795a077d0ac6442ef3a6509b177a0719031055b6a76f9a4f2
SHA512c9a017b97dc01e5a02f9801f7f2dc23f5d6044ad6d9e93f45d4137513688310d4f35b5179e9f8b1341b8e57ed5eead19ab926689ef499540770336b42ac3167a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f5db0f92dbe4800eb30b2cd1cf1e241
SHA16d4ec303eb03b545e8539886ebed332e7a579753
SHA2564f2c5404c43436d2765f5f133c40efe5236b20a93d8c2413780c7efd56c7b3c9
SHA512199ab1ae9bfb4af3ac835c5f7695139605826c5eb7e2cd1f32f1462fe04aaee773a4552fd89ed3286071a1de4e0922960a04b86fc8d43c769391cce4912c0024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5697abc5ed4c2e74c25adb056648de6fe
SHA1f241730786319ba1c78dc566f99678cd812af9a7
SHA2561cc1ad713ed0739e56ae1d0381ebef9577ef3ff4fb2b5633cee1ae7d1b4871ac
SHA512fd25f5010d6c39ee9e4d05aacfee73219fd12274c7e6fdfc2b213c5f0ef976f64dc325d63e2e10e179e69211804bd59d7630aafbb6b6e79a7e0d56c758780c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e48733e937a4f4686b6bd57d850470c
SHA179fe8e8e94a1e3c4211a477224189b9d6fd8f0a2
SHA256c30c491ad7db06ab4f77e7d7f5e4dcf0e23b96ff746bff8c4a8a4dede13b55cc
SHA512fe44e8deac749e41e2451ef9c58fdf8138aead2e7b0d93af175ae882a71367ce3059781385245ae2a9b5ef2117398bebaacc9f0827f3d24bf0de922516a1449e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5895fb6b49d0ecdfdd35a6d977742296d
SHA1b87d1caff9c111be00f43dc54fab4039d1f15057
SHA256d1b4dd7ca7b5138376e50f99d60081fcba29cc56a2c405528d3e1f329d32b466
SHA512c8916d73e7682d63748e3e93d7b6382faf6384c0069d4ea04a00d5391f3e815120aa5beaeb0bccd5c1329e3dbec16e9abe8f08a7e38384686945971a37e0ccf2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b