Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
6a41738ca5ae6083507bb0a0c6b39507_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6a41738ca5ae6083507bb0a0c6b39507_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6a41738ca5ae6083507bb0a0c6b39507_JaffaCakes118.html
-
Size
5KB
-
MD5
6a41738ca5ae6083507bb0a0c6b39507
-
SHA1
7dc35403532119fbba7b558df167be77ca9c09f0
-
SHA256
fd1da1ed05a31c91f36805dff481006c41f5578b3bd56baf3a42a8d80929d16c
-
SHA512
2236916380356795df87a0f1245ef51cf5676ae5b38987ba2118b7f17135285f45f5b85dbaa6714d1ccdfe20addb1bfe063e7b75735ac8dd9e7d0d69eca02175
-
SSDEEP
96:1IPyCQ6oISUKzvehCZGaXbrI/zvXdS+ioAaKLah3xVFBcD:1Ie6XS47aXb4zGa1q
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000a6b044901adcc4d91db69c0b8a813e5b23801386e8c5492edaec9901f7f78d46000000000e8000000002000020000000a5a9c7ae5681da33054fe5b723293166b709c85c6af684f32387b4f56d01e61b900000007964b5cde502be0ba95f76493035a13ce4389667b26f7e0522e5b0986d7cebab3c433e1aea4455faef76b3ac42d1107f18118e004552cdc088bb8186278cc8304d561bf6983c154c1d0b7eedae1f36f6dafc98b50fe46b99d1afeb1f6769657132eaf8994347ea03ee7dada8f49c8e3e74d5c1770cdfe81871e7b49580dc0456ea3fe547b9ccac863df48e65dd2e04e4400000003953b604bbe3d900f99b231cbc627c0dca527157efea9fb1f98c3a51152abd2520ace3b17aaa990aaf2e0140334e688c1b7a3a255cbd5e4cb1f0594a22b490a3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008ea2ae676a8c073e50933f45f23427dbc95d4fc567bc1c72af080cf6dcfd5f02000000000e8000000002000020000000da0089ae660e0daa96ca6de68697ada29265a2cd7731e491cdbc6f6db8e696c52000000058cc790b18d57fde46b8598d24c90f7a13144b66aaf52760d685a2b54c4b3ae840000000867fb565d572b1b7db0610851adb2fc6922e8cb3965fced167fd2994b9c8543a34e1350ceef9ab97bc8e181593b81fcedbcf5330cb96af6f3f22ccee55b9b3ae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22F5BF91-4976-11EF-90D6-5AE8573B0ABD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427957589" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40380bf982ddda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2292 2352 iexplore.exe 31 PID 2352 wrote to memory of 2292 2352 iexplore.exe 31 PID 2352 wrote to memory of 2292 2352 iexplore.exe 31 PID 2352 wrote to memory of 2292 2352 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a41738ca5ae6083507bb0a0c6b39507_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59f504eb74ca097fea80fe8b5a0974cca
SHA198f6d6f82b03f1c03cf46138c171618e1637fc8f
SHA256f433c4394a8b0f37ae1d9a9d87c00c8140699d96c64afe8fdcea48f05b324460
SHA512611c457138be60101a8528b7b708c3596ae8ea885d6d7a89efaaa906093c3dca2a442a7bf287570964a0e596e1086eae4bd289797d5941b0d7cb615ad8722635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50bd589b5cfbdee1387d1a8cf61fe81bb
SHA112bb819e163ea73de1004d55699edd36d2b668fa
SHA2563130c1cb345104770bdc7e7c5726611f9cd3b31406f0cc4282f7f69231c7a5a3
SHA51254a48f2e08a56600845c96883293dce9aba3c2ea72b5c8d6b563e580dc7a42f4d850db79e0ec03da889db1b139385713b39467b43d579cb9fc2579fe3876e11e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5227a58bc6574666173b4b3174c449420
SHA125e03e535c4bd6fc3cdf4f5998b3d173cc0a4692
SHA256c0f47eeeff6e94ede626d5943ad5316dd01790bd709a4be14f4219d5375c38a7
SHA512ba8ba109fb25d8f50cf1b15aecc41f3c463978c55957abf9ef6957432070e6ddf5575acc348d57253b549c742d58624db9e648fe3bbf9fd0b68cf865faf42af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5500d220ce1a8f1a4833230f75fc81565
SHA14e58c187d124d2bc814cec11084ebc5d395712a5
SHA256e8e5ca1bf7ae989acb54310175444c6e19d1c1c223a5a1c8fc03ef93d07c4368
SHA51244a097dbc532a7ba140a20d81d58275aa2dde9e776c275d8cecbeef244ab4ab174b5d914dbe8896d3f664a85cd0d6a1752d7760778777c297a2e441f378ccf27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD560529e9834d0567361893b9ec4db295f
SHA12b52d098df923b25bb6e2e4dd8844488de1db2d3
SHA25668f87c297607a91225dbf6556e14e85426cab0e0757c17780d0e6003d0eee3c4
SHA5121e24627ab614c5794235623ea4b75b503264d23a0714b24bd4c7e2e11ab6c55ed7503b29163bd1198050308d8679ae119eb762c12d2522807bbe6ccdabcb468f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD570904fce2da9a254dd1042382ed167ed
SHA1d128f71159ba69e09171abd0f10fdc283e5105cf
SHA256beee49b07033344d9eb7b8f532fbc636f3dac6983e1ecba306bc09b1396479e4
SHA512d5c58b68d141e2ee4b7213c45168143ab58e7d8ce02e692a6a87c3bd904126617e1dbeb346a5458d2410a5c190f8a4c65c6b8387484de39ef4cfe3dc9aa6f081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf48a520163d9b0c26dc9669497aad17
SHA17d08ba63be76312da60ab9d98a805a0fd0e262d3
SHA25626d990551a0b4d77109bdab92f1202f0bd19f988feae1eb070858867d10b936a
SHA512d7e558b5f4b848b7721dd24a5d4b961ada00fefdbc85fc733b701d8c9ef6912660a2a6ec8691dfd45c6763ea39579affbec828ec69bb65b2404641f5d1ddf359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD568d288ee812e7d020733519f120aea30
SHA1533315190ed81f0b385145288e32eb00b2bf33a5
SHA256d2aff1f88b8db5b28f273d515b214cdcf951229940601b60d087714cfda7777a
SHA5125d5cdcf61957d03f20afbbdc5d9f1fdece27864c30b1f43df0437189ee81d2509423e173147f912c1aa924d82ccb5d42e8e30a1895c3fc46100880ff9c2e4a2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5111f24af054a97b037e10e71bd965e3f
SHA1af2513cd2e19d516d9cb2503c896a28c77ce14c4
SHA25629d2ae923b38c9472a6a601adf18b0de52acddf280c71d415e996a0b955da6fe
SHA51242dddfbb2843201df8f22427e6f141f418563f6e91f2b40fb93d201ca3689d7a536867a2bee3f82385efd8f21933d6d04f8269fca01fe7938f78dcedea41e3ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f2501d7eeeae145d5de4d4f00cb98a4a
SHA1990a89e1d7626543aa456868b26dc59068cc0aa2
SHA256a8b6a0d68041bee3ccd0e3fdf83bd7b29ce53f34be9fedd0c1a987c09dbde731
SHA5123849953c98db94a478a247f1ebfd00adc3817858591fbf71f7ebd2256f6c031e0f1127fa0e272a1a328b8ada843b0cda9c14b2955f37164b346987ff6ecf1f0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5030af3b7d365abd98fedc79798007762
SHA1b5c4c013e62a8adc30c709fe35e48a5a62021339
SHA256ed7cf0e3dc73501647ab67850a242e616d3a5645c792405806734c7fff717dc8
SHA512c5a99a5d9433756e1cc0ab35b68ae2d62cfcc4909fa2a5981144ed2c3ca4303e9680586ec8dfe458fb8118b4291958c0b7e6f2d2be4d0725bafe523b4b4555e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fe359d7fb5aaabd44459c424bb455d83
SHA15ecf2666cf30bca678e6fe72b60de49f99ea1c2a
SHA256d6e7391352600fa0aea47c6e8b7e1d7de3f3de67c1147e2ac5847f740e23a948
SHA51220e850985245c0cc26a40886e6b49f6df582558bcef94befbed3929d5b84157d57a8116e3d7b3a36cba40ec48e08897cbc8fb9270f610a352dd98fd257858617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53330222f62a4e23066e6de97755dacb7
SHA1074f119979f2c5063e54c492a298f619b54b8670
SHA256b7ee2e55051d63d7a268dc49eb14e2f2379c1e65504beaf786a7f3f8bf981b09
SHA51282b5d4bf422e768b860db47da26b8ba7d103d637a388653c1c3e4faa755caf22bd310cd694d0edec43d35f9943db29c692965d76efca9c00e4377e2c68dcff3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD573d3854e54aab12747be31ebe2ab62b6
SHA1d5f1b96c2af753d4425e2e11257886898fc944ce
SHA2567ad548adc7108a98be2feea2a4699027c640e5ad3394c950572adeecaf802c08
SHA51229097603d73f7280d3f708f157e6fbad61d355330ad55a54e20402a43272707b73dd0f6a24c7e6e96e7e862451077ff52814b256d6278f4ac1521e6ff0962753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD538eb9eae35a1b791c165aa161611e567
SHA1c814426d1b4fef6d6d828fd71d04a676a65853bc
SHA2566abcecb6a62a326b660df4c8aacc87dd1edaacf1ad0ffc20ee8aaa27e3996e19
SHA512d4b10e79360896f03ff2701b55e9e0e9ac7b5c2eecdadc16d758922f6183c2057e0b1353765b77369cec9608f18a2404d90c3b07026f413bc96e29ef6cb89ad1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b