Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
71123a04fc867079596c1e15a2a277a4_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
71123a04fc867079596c1e15a2a277a4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
71123a04fc867079596c1e15a2a277a4_JaffaCakes118.html
-
Size
10KB
-
MD5
71123a04fc867079596c1e15a2a277a4
-
SHA1
3f01afae1e0a18d9769b7c6d7c8eec8b4fca8feb
-
SHA256
c0bedc5dca47d280f93723b832d3ed71e3271ef7cb81e5fa997ae63e20737dfb
-
SHA512
70089ac4afa16ff961daf650e8b1f7dcd32411478467bfdbaf83bf9de2481827b9c8db3ed31db942d4eb5c05909e29af69efa2cdf108aeb79d2ff73191479d02
-
SSDEEP
96:uzVs+ux7HtLLY1k9o84d12ef7CSTUcGT/k0xpFPDiQkg/DkyxZrLkKlVHcEZ7rur:csz7HtAYS/pOxSg4yr0KPHb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1B781B1-4AC2-11EF-9245-EEF6AC92610E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428100475" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000080488433136bd0a184f4f3932266a12045abbfc292a45bae77e1649ac1e9e3d9000000000e800000000200002000000000a1e68bc73bc206e575b718d1ce2b8c524f59e646eb02ff60094a563a6d961f2000000011abca681ee9335c55e9a21eeb04c1b42ac0b9db165d85db91788f75b94c00f6400000002737eaa2fc67df0e5a06b2aaffef2763b54bdd161f0945ad5f5da6fec0bb4f96e86755be15e1eb0e22d9775f2a9342595f2e1bc407104d4f6dac9595b8198ae8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50df47a8cfdeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b7b18f1a092ed10c5a79272647fae7f1f7dfc52453c68ca95a514ee4c3eee01e000000000e8000000002000020000000c432ac28299e8c0ce211e8eaef1252a7f745e6cda7ab805469b300bb56a4e2c9900000005b89e99a9d4aaf6613d7cafec6d7b2a0f7d44440c84360c0506695aa70203ae893340a2614e1e6914739289aa4c403793ee867b0156154339c4a206bc41e2e1fa772349c63eafa3e880295144f4397fa99860b08ec94b8530cd815052c7ae0edad096dc1d33dcf404516dda19e4f46c28ffeb225840f3d35f5b9d0297ea58c78082df9b794d99f8c55fea1237282130940000000654abb7d80d572d3311054e95c4d4fdaa151f5b3b9f953dc1097116d52367027af788fe1576bd43dfc9a7711fe6d0858041124b29d8607ce6ea454afd3c289d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2296 2180 iexplore.exe 31 PID 2180 wrote to memory of 2296 2180 iexplore.exe 31 PID 2180 wrote to memory of 2296 2180 iexplore.exe 31 PID 2180 wrote to memory of 2296 2180 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71123a04fc867079596c1e15a2a277a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532fb3eab1abb241ae7e3ae0291ef2320
SHA1e9946d401ded8a6d0f91ce54bb923fab35bfe802
SHA256b6146db6de8a5ca51902f85a8158c0261afdd5321127d71ec14422a566c69699
SHA512b6874871309ab0c83bc3e7b4cad5c5075ec590c82aabc57a839ea4ab5ed3f8fb5c69bbfde31717e2f7f539650e39db3a40ac34d298aa719d14241562460d3362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511b0adf84f5fa80ab3cdccb62cd1bc87
SHA1be902642baba0fc6662345ba4c669c9269fc4af3
SHA25643a0b1379c37704953fdce0aaf7464ac61229c0ca17e2ce3ee551663024a19ca
SHA512f49547dcbfb18abe6f06d97d4e5b9080ad29df889f1ed478656256a29df526ecc9bd05ba8fa8ef55f431a5ed410caa005b466fe33c6b674d23417fe16861b084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c573b95599be6e1c49debd2ca39ec728
SHA137a7c5e373ced00f8be14b22d83ea37a1f4f218f
SHA256e118f52c750feb7015be0db20c6df40685fd9636d464375647db65eca44a11ed
SHA512b8746c24697e873430650663cb78e75da2741603123e6d3040d62f9dcdec787192ad0a320516d03137b53535db76c7c69309dda66c0f6f779c67304f34d44186
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bd41b82f065a27b28b97e2913df560a
SHA1a0004f3f0528f0be79ee2c92b4dfeac01fa90c08
SHA256602ae6363d1f12006f1ac0521adc4ed5688dc26e17449a50ea301689e62758a8
SHA512f02057ea5052004795032f3a56daa2c3bee4249d627a846f5ed827c008b70baecf1fabdd4f423b15fe7a570cc7c9ce04e14d8dc8887e5dcd4e7090c147d9bb42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4c419ccbe76d3d260437eda8b682bfa
SHA151b3d14210fc42996ae3ad4afe17bf6bd5af26dc
SHA256011842206a8dbeccb17afb5fbd0be9c2efede22200ca8d7ea05d9571a9cd3744
SHA512c21ce93147e87bd86c4b0a689c1a201e6f5c1280be4445ceeb10191415dfe36392da00652123016469ec7a83b959f745cb57d271a2297cbabdbb897776b70296
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5add52b1464df006c1461dbbf69986082
SHA1d296af38d5d625797af142c64b67b199ddc34bd1
SHA2563ffc73fcf64241b86561f38fd1ae2ce58e04a5056c578a7a169728255252cb83
SHA512d39f564f0ae445c30bc96d5e366fab8317976872b44229c8f1758a3a976b04ed808d735681029fd15625f946b68edeadd12d5b8b6803dcfe5cccf50869de78a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5701c2ae8ab94bb57e10a849e392489f5
SHA1bf6042244aa307dec5dabcce9433a7593d3e1dc0
SHA2563cca352fa79828481a6e61bebd77d948991aecb0561193c7d5ee0f49f368d67f
SHA512d679349c87b5f260812808815bad6475f291273144a08b68a9ba8c2dee06688ad65f4f29a7b3f7b3bf59b1eed3c4c0e8fd9fd5514b332af6a325d1aece7fc9ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abec258f4943dfe936c5b62eac9d96ac
SHA1c5c45cd6f80ae2bb0214e1d9a3a2f77e0b981ee9
SHA256835beddf8f214c42aad79ffc8e532b2928c596603205935bcb2aacd48a7f2b5d
SHA5122c5d450abb5b9f34d4058a2a670e329984219dd7034ad0d05d710007cfeff3946c7536b1daaf40d37d5269e221d17e0b1bf718a83117ae73effdc264de5a40ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1e48f6ebabc0a4bc529b4372aa6cd75
SHA15a53407970bb20922bd9c57d3f31aa468722d98b
SHA25618a6b40987bcb0febe36658056856f467d25fa6218b536d97cbca1d2d518e679
SHA51260164c7c110679de98ed936d6651920e43fe5e44d83948caf694557864bd351d008f3261f41310673b5868cdcd8e32698bb268c1d7e4595b5bac75b71e40b161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e34cdb57b77f5e8892ecd00f9dbf622
SHA1be4cd8ebab23b84e367fa78fc6e39318e643398a
SHA2568baf093a2a91f92a93b468009a59a6abf233a301717d9b7ab9319555dce03bbc
SHA5121f72bc83dc46a72c5666049244f21a405a61ceb004c03b17cb88c779381d60490c6fb75e0b3952d618983deb90cd29dfd3802b5cb0cc4a24dcf980246910f060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bb633bf8b4b2a811468a870ed7bc2a6
SHA13c4280f0c86f2627284fae0ce42f619f3087fdbd
SHA256a877207b78ef21da3bcff892aab78cc42ccbd060aac133ab1fb1dfa51e88b624
SHA51283eeec250188a061b125c1c881af5899172fe45eb0ef063a0c768e57aec09c2c7329bd15936a9ac398a8e6496f58494c211b54d74d8c48ad7298858e96c24c13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da6019b6431a2c9e4708c525309aa20e
SHA134a80de3c9084f306434698023add9f6def7936b
SHA256e225f3e7bc5fb4285cdd137bb2a39472857090e44a1ef5026b79cd0503020185
SHA5127cd88023d1aabb4272ee43a55f2817cc71b82a3626d78d5d9f825b999128627ad28160a19a0d8ef43a48301001982558b5e6b2b4ceb544b93136cda5c537fbfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503f739ea65db978fd21da33766fec54a
SHA1cd5ac5881cd402f959f2270352e222685e9480b8
SHA25696d7a6d59e3aca96cf7ecc3b72fcc59ebcaf2b1fcceec049c208e23ff67a543f
SHA512c89a67b237fc04c0d55b25d1e8615f19ab8b28bc00deb9a223edb35119ecb0fcc9f138f2a00c8c21047ad5c5246bcbf4efdabdbb795a240c1e9ae83f0fd1257b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5737e28ab9c70755fd28ba70d8669a11d
SHA18c234a8f3df2f7f374ba8cc756c5a7d8345a1392
SHA2562bb88da5604eec9655fe521c83c5bb97d8185282366027efcbdfe41d8d4c1db6
SHA51228d1591dcc9e0fdab79cd227fad680d9ab5ab766c71ca77707e592d5e779c2e50a9466e3ce8b78b082d6ec24d4ff12a540add4994dacdf63ed9041b8b7e53716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d348f1c4351d44a4dac60d6cd865e8c
SHA1730d74a9c419bfe911a5f3089b5416cdf7207e69
SHA256e46de1acceb01bec3dc79c84b879db2ea5f5c9ea528362a2880b469c71246e7d
SHA5124271bec092561bc92be14a580415e077d577ebfc9cad6eb054c3727fa40a82365e42e93d52818e48522b0837a0ba25b8fd433a507db4bf34f5630d843d7fea3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571cea8c7cd23ea913eb7987280235293
SHA1c3877e63aea0b415ac8a0ccdcb2934507f91e177
SHA256118a9d071d8ccd2a94a051a508bb259adb55ed0300cba1d8f362cdfeb65ad971
SHA512b395ff08a3a0db64ee4de856910c6bc50efc66bc83de89cc5d8325d5be65fd7491de1071683a356018382ea5d825c9f620684efc1608107bba8f9bab2399f144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf33d22d07b7ea793ecfce791c1580a7
SHA13087da36af9d79cb951a53727d62a1878eee8447
SHA2562f940e8a8248771e098397a690dbbd5ba5b5b2ce9cdfab1fe1d61e60278b808d
SHA512bb677a80fb4786d8f80495ed836e8575d98db27a9b46e14b6b9aaa4d4c5149fb2faa2c6dd42f228c234ab62da2bbf92dba79100c9f6022784da7cdb3722eacea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3622932e495e166da7a0d0cfc923c97
SHA112fc35beec0816a8ef3e59cf061a40b170e9ff94
SHA2569df86da7c262db78688e1dc2c5d45e22217500d988f16f06eaade15ee0c5398e
SHA512ed12f8a6ccfb898f76a70f7c7a98c9e78c646d566e0eba74c309be57e3a79c5cbaa96af416d3c1e78889ba86308908ee85a5e880b74924ca1469031f11632770
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b