Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
711c24c93a1d6a2351ee390f98c6918e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
711c24c93a1d6a2351ee390f98c6918e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
711c24c93a1d6a2351ee390f98c6918e_JaffaCakes118.html
-
Size
95KB
-
MD5
711c24c93a1d6a2351ee390f98c6918e
-
SHA1
436b75d40c0679c95dc3fb0aa49d1c348b50ec2d
-
SHA256
c702138914e0b4b634d9aeb1394331c61e3bda1799b5a3d7edc9decc634fdcee
-
SHA512
f3b2cf0aa46ea8e8fb9afe8979c63d4db6a504ab08971d81c3d7935b53260ec97a986a14b09ac78ff5e0df4c35c463f043318806663994cd653524c26fd48373
-
SSDEEP
1536:gLqm4DqGq88r3UIErobSy3AYpqniDl/TT8ebsK+ByHNyDTPvLmLYlIhQ9F+0zv7N:Wqm4DqGq88r3UIErobSy3AYpqniDl/T6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f046aa28d1deda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D84DAC1-4AC4-11EF-B0EB-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004ebcf1591afabbba09af202a30f305757dc46126815860ad44ada0087cd2263a000000000e80000000020000200000005d8ff9f49b15542dffb03bfc6dbc6e8c7021bcae91e2392271e0f0e69cbd80b72000000015213c38fb3e7ca5e7865723e7f5688a538e3ffbb85644a829e0a90394d39cfc40000000e74959c08da28ac7f50ea6d157cc607fc8052db75f6cf01187ac62365c81cc8207cf7a95aed88ffb59c5ab1b02f8b866213cee35f7afeefa65c512f0665a422c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000eb9592c293fdc9bc7df6c98ee13431d1f519f37393d0dfd15c87ef189391b70f000000000e8000000002000020000000a5f1f84fea45bbc4d653519f9c70b770f66dd2cd413e129671bbb8d627024aff90000000b868efb2c6beaa74651c701f55955107f8df472177119cc21dfba4e0880c7764b2941bcf3d11a511aae33da59b9e6834b18766d0ad94acabbfc780daa6a7084d819c4c345ca6179a7b3e5b1a6a5bb6b52c25f82945d543e479800598e7ddd58532ad67907b2f7bfbeaf007980092f96cb6af64717b1a514f34c99399650027f7494a759706d865c904e5983d7d54ec6840000000638fe8cb5383b759e80f5edd1eaa83ed5037587c6e7f7395f86cc4a455c39835c60a897d98ddbde0e4bbb52f6755df2a1a6e135ae5f6b6a9b20bd2c3b9f8bd1f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428101150" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2524 2240 iexplore.exe 28 PID 2240 wrote to memory of 2524 2240 iexplore.exe 28 PID 2240 wrote to memory of 2524 2240 iexplore.exe 28 PID 2240 wrote to memory of 2524 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\711c24c93a1d6a2351ee390f98c6918e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c13ed97286fa3188254f37c43edb25ef
SHA10bb9767099ab3a0758cdcc68bbea71521ef43aef
SHA256ee1021b7f4b0a2286e9518f964b7933a91a3a684d7af4b1bf16d0f6e4671fb22
SHA512fa1b1a803ed68764ebd4f8427a1c6fc7bb953186acc13afc67251508768a6eff7bc8be4045d485400caf65bf8ca44ea4009ef473aa33ec5938a662d79455c593
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552e0e103943e6b7983d9995f393583b9
SHA1f3e0603135dcfd38f78bc939f537e18ec85e3d50
SHA256f1b4c8e246eae2419bc5d50368a08957a70855c4e681e89ad015e23e0db03ba7
SHA512d9a133746c4f932c5cafb0c14c30913690e14e9f1224f4848f3f6d40bc03afcdfd248cfff42d762961552b2500cb345b345732cf49b7b3026b2ca57c3ab2d2cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5095be73dc5a156c0af63cf63927fb947
SHA1720ca8a5168f94f495e82609468bdcdb9d90107f
SHA25641f3dbc35bec873a29f11dcb7a9af7d7e3b8e7908b7d85b9da19809f19d5d5d2
SHA5129e2b7595be31f7a4e203608642ed7e974200353845ed5b42790adc9e9f1cc79804a25ba6ac6cc991e5cc305ccee51ae44578c30c9cd1f1b31350f265233f24ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56da3b19401b6c5a1d46dff88bb9842f8
SHA11afded44d6add9a8025e89b7d3397a54fa3a8bba
SHA25624013d73852cc4f3f8c62566123edb898e9447c2c8b7764e264a6d2795f6d284
SHA512587034b240ed23a570f76ace9b323ee0a273903eb8ff5f8d7df50c9e34e7d1ebc8868d77b7488b57a9f7015bd903e331232edb8c578552897c4d3a5ee040380d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5937962659dc13d650425ae1a65370ac4
SHA1a435a0546a7f18b57a028aea5fe72939cf4d93a0
SHA256b2c3afd33ee213b819c7bf91b6fd6f403e13e1e7cb60a6ee0003c1cff205de9f
SHA512bf25c7fd78d35e39a64131b170a73def1dd5c51cd1ccf362bb31fbb87ed16a525162cd93146283f7491eaeb02af7060beeeb6d11db5f6287372423ab146ccf73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53531fa645724dde4d51f93e0ae4a944b
SHA15daf5382d0ca94c3f0b0b41c3811b00a1701c62c
SHA256daf27bf295adacf739ed472df6452e215961a807c03e7806b2f7abff7f217f2a
SHA512f5b85b954fa39375ecaff9d7d991157651d643404dfe537e34232ff259fff9701021f36538845648bb07ed33f469c9b5cd971832d830b9a1b7fbfe5a04d32ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543f24a98eb1d9c7beacfe989f3fb2f04
SHA1506bdcfa17112adfe45b672327552e127523b733
SHA256f77f8298ef700b9b0dcf8cafd465d33457c2289916f744bd4735defaad9b08ff
SHA5120c6cfa5e100eaf38473269eae677f33db3051af70c94e52c565cba352e3a073a52303575de4603a36ee67240fe7be4a5ee147a5c2dbcadee91ab13acae313439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c178462a138bf66857c1738f9d23f015
SHA1cc64cbfa10c4b4d8bd891692ac3b94c5f4342e3f
SHA25665cc88d5329bb3d31ae43bcf232126de57eca3a5e44477ac8ac610411929de09
SHA51253904c0acfb5e018cc704d1714f1cb1211c9e32e27e8e11e34ff7050476b5750e1d03a305bb8df02f0d59eeeb143a27ac3b9733b7f5d875710578821d187ceff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50596198c25c96eb9cf95ceb3399be076
SHA1c3fe85a310fcd3fe15b9b7656686cd21d6a1c512
SHA2568c2f9a0cdee1fd5b0bcccfe7aa54bbb0bb3f6ea0be6126d9207c27fadc657526
SHA51209d52f915f8459698e7ce5bca891d1accc26ceaba100ea45448c17ebbc3fdadd14719ca750dc04b53ef8cdf9a3f4ad89c2568ec08ce3a85499d1315e03663f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549bd18b58138cdb11bce273ca9b93043
SHA15db37e124d0d5fb0ebc7497d23bece252b2dc269
SHA256cae5e6ba152f6f45de6a2f2352839375b0c2471d64025cee30bdf2a727d86abb
SHA512f8141d9bb9485004de96fb01cd81a97567746bdb8e6e3aa53e2854ecccdf0d15f22fdab8a78902f5d4dfcbf20f7fcfa79c4d39dc52e2817dd516647d7a3cae59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527c381cd3f78201f79348613a1d94708
SHA1bd9a45a60c800add381bbe5452f4ef767c5afb20
SHA256391ff375dee8184701640daf45525b4ba2b3e7f1a82b24a4d12c66c6c0f704c2
SHA512e0a53496fa6de9821a50e4e921ac580ae8d83079b0d8c8a1f01fd07476f857bc91ef0e9ca0feeb8877680c267b5c37688874a98e5f6df42e3cc7b0f67fa28727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fcb8f009d903da32d6954af0eb78637
SHA13185b7a524f742711532e60fdb6b300ecd6e0488
SHA256397b246379887129c180e6ae1d109bad192dcbef91c36955b59e9b6c4f8fc0e7
SHA51200f543dd54f07431da04eb8484a1b32c4a0323d0cee8ecc631cd648c115551b675e9839b985ada78aa7bf000b461cd70db3b59a68d7cf69df3f007a1bb6e5366
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b