Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 19:32
Behavioral task
behavioral1
Sample
68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe
-
Size
388KB
-
MD5
68a12b8739cd4b5990bd232cc4d19e30
-
SHA1
a0c2e99e5119739b2eb776c75f037de0d57702fe
-
SHA256
052b88adfbaff27d677852bb3baaf192ff88cc76c4b6b93fc92f27a4a145a941
-
SHA512
bff2aca4a5e484b5a8ca9edd328cf96a8ca9a41852b6837c69ce7ff50e7e9a39bcb3814f820865bc20de2d67d69bcb725c77e6b1d856c6e83e2da8ff8cead56a
-
SSDEEP
6144:mzzEVZVFyhU4T4MYdQEGgKfYsxT2JHoiwChN0lLANhCRd9qb1x7g8kJ:mcVZT6U6MKfYsV23hALANhC4jcpJ
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3040-9-0x0000000013140000-0x0000000013153000-memory.dmp upx behavioral1/memory/2976-7-0x0000000013140000-0x0000000013153000-memory.dmp upx behavioral1/memory/2976-0-0x0000000013140000-0x0000000013153000-memory.dmp upx -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2976 set thread context of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 3040 set thread context of 0 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe PID 3040 set thread context of 2776 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427925031" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54B7D2D1-492A-11EF-BB94-CE397B957442} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2776 iexplore.exe 2776 iexplore.exe 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 2976 wrote to memory of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 2976 wrote to memory of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 2976 wrote to memory of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 2976 wrote to memory of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 2976 wrote to memory of 3040 2976 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 30 PID 3040 wrote to memory of 2776 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 31 PID 3040 wrote to memory of 2776 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 31 PID 3040 wrote to memory of 2776 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 31 PID 3040 wrote to memory of 2776 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 31 PID 3040 wrote to memory of 2776 3040 68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe 31 PID 2776 wrote to memory of 2652 2776 iexplore.exe 32 PID 2776 wrote to memory of 2652 2776 iexplore.exe 32 PID 2776 wrote to memory of 2652 2776 iexplore.exe 32 PID 2776 wrote to memory of 2652 2776 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\68a12b8739cd4b5990bd232cc4d19e30_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575a34ed7302c53a32192e5c63e0a2b90
SHA190b470941ca67f5e61f7e45bcaae7fcb6ad0d424
SHA25687c26e1c313e4c6c0ff5c0b8f819a2070301458f0f39e94d43bdad5fe00acb45
SHA512e3262ce46d9c2234cab07ed733bb96cdb8b0fe77c33282e84a7d784f6a92086fae47886706b75a5d239b3ab1d5acc67f2757775eec3278f26fc42b8a4990e4da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbb246d252c4f110087e7104bbc57573
SHA1f41f42f411fd1510dfe23385526aeb3bc3ffe2a0
SHA2568833b0478d711df153bfb6ccf671d7043c197e3187790b9ee5713d9946be8eb4
SHA512b0999760b9faaad009d201c350d3d438e2b9b5037adf3db6a1dc666c40a6f301a16a6ba40bbe5062259f97592d8739052699528cea3406a8d440f5f7fe3d1522
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501d8d3bb978d6143a09d453f72d41a2b
SHA1ebaeb2fcae4b7189cd2ee6aab790f22dc6db479b
SHA25683b91bfdd3305387940df9082ab774ab3a52c665020ffdc86d4a0bc60e4766c6
SHA512da87503cfeec433cf27e2cd3db75d75eca380b73c293c72544fad4b2805dea6223d6bd359c8058a18bd33ba5c7010a13c9a2e0d2148a76577f2c2db77f0b3d72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5901157023afe520cde7f00a0b8749411
SHA1092428723ba6bd5646a643816217685aefa5bd09
SHA25616a6230158837178ca81f6d39cadfc434e71f354a332d82cbc2fe91b7c9a68eb
SHA5122f18972b1f6288147437eb9fe2cdad22b27a8b294f996424350f336f6acbe84ba4317c4217d158f754e1b2caef1e717201700c85b9c09c2a0c9fad2e8b7d7bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7989c9eff15986369c14c57933f5d61
SHA104912abd826518688f5d6c4cf52caa81e9098b57
SHA25699143da7309d62ff1f7e5ff24febb4b56880983c6190d65fe9641332748c21cb
SHA5121cc8b6743b477ab8870914e7326687bbe187e7c1d53dfb24ca2e614dd356a3c92ef46a8b6416bd13f8b87083c9e7c41373496a1690364a41ffe9bafb77b88693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3996b38a39ff77ac29dba582c37b1e7
SHA1253eb789cf96f89f5f548da3b8b9a04c58df9b79
SHA2568e443b7b5f969fa7b661b4f85b5c4b95c7a41ca178eaa77eb5158d8f78c77915
SHA512a84928c3a9d4eb419efe7eeca0ca8c97098949bc1dfbb2d7c4397d514bb8a304a2bad9819e4700711cd7de4dd31f9d44c6626cd9b80743c239380f35063b3c84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8166d72b259cc71c894cd1e34ad162c
SHA152acd5435f7d916f2113dee2e790b5db547986b3
SHA256338e2dc08ecafc3bc8d3fb040c8d4eb15fe85e99ecf70a25f6b0e8330b43b2f5
SHA5125a0cc3293049890d943686d1f111cea1c5b59ef50792d24b19bddbedc392af6a77feb8a5569af8f039c21ac0452ced934030b62949cc3760266467443df71efa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb160b7b8a13b5104a3a21ab71fbbe43
SHA1fed2bd5e0332da49986a7066f7b7d049910c5914
SHA256e5a70cfd5c317327f7ca8907eec8f61664a41c56175a7264b95172b243006353
SHA5125f0fa8313903431b103fc6e10b3771eacca224d3c8be1ccb53f5d0548b910948deb27b6c747c73fd72be49247cf5c0a577cf5780677b15c802e421f02bd1f3ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56300fec3eec7096448f63d3f33d73b45
SHA135f61335ed711eb10b6f3d3e3da7449ee2143bb8
SHA2568e598d778856f163af4a786f18c1590373ba6d66ef2e00b07889ae1f153fd4ed
SHA5122324c1d9dca95064ca1fa31a25b4fbbbd99c7480ad74ab57e03d1a56c2039dd773b6b170d54aa3a53666bef9b9ce9aa9fe4b16b934cda9f56850624f897f8d6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536b15619d9e2e5c96187ca7b5fa1c3af
SHA1b4f7aa2d7332b62f79df071019e2e3cfec3baf6e
SHA256bbd18e5adfbc84a63c575624e1b0bd08736be0f58e128f59666c1206e604ad12
SHA51272d23e044a37704893269885b1b0ea37a216f8bab28500df59632842d869b9af5bb44079bb8d2188f0a0ecc7fa41d538056161ebbbe3de73c2fc371eb1ca2532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5539e8b43b1f6e1bd0e7a9837ac6b04f8
SHA1aa813177084e2992bd7686ab3ba6181684afebde
SHA256370082710fedbc29a348291ce5701e3daa4ec0bc31b442b4085b57b0daed45e4
SHA512ced9ddaeb93fa93764efaff9edc9c6fd7feb4848b7b544b99e5c1d905870a90f139d50edf91ef2422eca598deb9c07cd55c95ea586fd830a8aeaa3ceab8f3282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5116234aedaf233d60e1d517b8779a318
SHA1253ff3bcedba38d22c4ecaf0c59abafff5d93eaf
SHA2568804d893013571a3d8dea7d408c937e4db31549f1bf3f33f16d61c09d270c5ce
SHA512e5fa227df9446209e4a8f84a51d64e3e5ada59ffa2f6660ab97ac883927d6280917697322a543ceec3d615b901090d13945d5bf0db9f8476e7a0535056fe4afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d933bcfa068a5d9f7c3ecde07833cb33
SHA112d7824050f8a367263e4100f969fdfd33de62b5
SHA256c86e8cc54bc33dfd2b4f211fdac1a1c897ce5b2b5bfae331dd1469a56055557d
SHA51268d6aa9cc8b30091c089743ce33b6d8af4f8caf72273138d77ab84da97e2d6f92476dd417113553dff5217262fbcfa2cb85a758cc3fe92f618e7a6e1d336a21b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b44c110d9042f11a61e42f249ff3fdaa
SHA145657c67fe63521b47d47076810b34d20f410f74
SHA256441054febc2bf87fe84ce755f30f3b659b0391a83ab4da56d2e83d8dd16d300d
SHA5122b978e2b637dd78f54ec9231cad7b99a14b3130c8cfc3979cf0021f457e7d5c86b18da84c220a6ae53fd53e3d08638b4a6f49781aa70a4bfb849207c5a1fb550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590821939cc4d3cb905a07c9219cea78b
SHA10d91f18a69776edaf5d2d3326518cc69f0b900fb
SHA256643d219fd6ccc6c417df84f3b1e6bc5c95fb948798bf367fcff120ddb730e1bc
SHA512a1bf628350397fa3501ed54d42a855fbe16d0501ec68d097a2e29ea14ace7171e1b53ca60a44748337686e410af45819a10d13545340f39d699ab5bfda24b4a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5995bcbfa6a5667fa834032214776f06e
SHA1199772dba16e0466d20ef823633aecc1fa4915d6
SHA256281b015bfcbd4e7910cddfc7d560bba6d10d8920db5cb7a05833de3cc6947f63
SHA51228626b237e869428b762c4fd5f1834b62b1e33cbdc5a25ec972040f08b94e8a4bdcf84ac2ede81eaaea39355c8a9cdf9b71225df8b9ff698eb8216e4db2d2655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8f57c4fe7eca06e079e447e8cbb889f
SHA168185e7434dcd932cc5352e262f07816ed4b236e
SHA256d7ed692b9c687e18710f84f9eb1cd9b4e1a5b0fb8e7054d58d62c3e6c807efe7
SHA512353842cf7c922f7c2134464c9d726eaa10636b55770305e2f11a7f579c761b6947b3ecebbcc3cfbbc8f2f735365082ee678bec7536776440660cc76cbe15b983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb53b1753b6d882248e6799c86809f55
SHA114b27679f9e8a031a62064b7099eae4fdeef59f9
SHA256847a7631b03c532ec6b7a9e9a64a3b3d8f0ef1cde27985b9ef0708c2fc10ac2b
SHA512336d48b298d44c8c48f3de45fcca6dd3ba97391d0f1b414e33a33e10d882219398c7bd42f0a9d85f5ab4abfe47f298461e329d3f09e964568ff075f748f08bb5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b