Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
70f8ab658f5266aaf76e329143aa53b6_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
70f8ab658f5266aaf76e329143aa53b6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
70f8ab658f5266aaf76e329143aa53b6_JaffaCakes118.html
-
Size
1KB
-
MD5
70f8ab658f5266aaf76e329143aa53b6
-
SHA1
a2f7b931947935d13556387b39c7bf2fcc62627e
-
SHA256
e785e32a889e7154446496c0a7b91febd28d1d630ef183a8f4b9993b296b4db8
-
SHA512
11962461a1a85b92f019713e6db063a885fd5946c51167eba917f7c36395e65e7a2f61c007979003f245adc9e62ffad027c443d1cdfd68bc7d82d68307bfa5dd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000007383f6386e7e2d22bdb8f44aa411c67a9ed861645853a0d20cf177398c2080b2000000000e8000000002000020000000cefaf3bfa81590ebc102fa7e4267f0eb869dde0b6737c972389f2122955ab84b900000002389ea3056786a90a7f32e94ade2201c19df030946c9d241958e35b5e4a5a6a1790843cde9c765da7f8428b948cb10ff403843a08ba5b5361f5dfc98e619dd1f016f8fb15008cd5cc938e8ea657f00596e2cbc7617df8d235651e20fc6d705bdc3b2664bdede93c50d4fa52922cdd50c389f36da34fb3a6de1d1ab2a657c18826acf2fec0738ec932cf598c3405e1d8a40000000ca143263f313c50a97ab849a5315a2724aff72f588a680e7187ff62785f88db8714ce93e10ef121476889083dcb5e872f5681f106e03497483d9da31c821ee35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF0EC871-4ABE-11EF-B3C0-E6140BA5C80C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000dad716131649c547f23e195b8b80f9ae9eceec9417782415bbb3f5d4be59111d000000000e8000000002000020000000b0d1245f26c9c5866704a7fbb5d7b056ef5a371ab19ff5e396e49e2877a0e5d82000000030de0d2ce55eb9b9ca32c0cdf3b28c4c93244aed66be07ddaf240fbbe0aaf49f4000000092be0b75886ed6e1bd6363cb9ea215f89ba67b8aac50f5d529445f22c4c746d47e3a83438f664d208ed81293acf77b58cb5ca3a6b979ae984d6427b1a431c55c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07e8a83cbdeda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428098699" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 3060 2236 iexplore.exe 28 PID 2236 wrote to memory of 3060 2236 iexplore.exe 28 PID 2236 wrote to memory of 3060 2236 iexplore.exe 28 PID 2236 wrote to memory of 3060 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70f8ab658f5266aaf76e329143aa53b6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a73042f5f4c98a43a81f5c9ee51885f8
SHA134953db34d11ecdaf0bff466fade1a75271b0ae6
SHA256124f17bfce4618c90b2aa701371bd734e7d71a86ef264e38eb72a5cd6a3c0188
SHA5126e3ab1bac33ebff9d2a5a7b6820fa7bffb5bc4e78dee4221aba65d9bf9872dadd03f5a9b88d4cc29592b2a57b20de81240b26ebd21b0f3f0e75fd7d14f68f3fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5535ff310f95172645b06ba425749ceb7
SHA10f9de7aa18aae27713be1ebc67cc15ac426495d4
SHA25616d618865423d187c678af2a4bf79b6f61516f42d404444e0f5e160f736486b9
SHA51212ac447b2e267e28bb879d4a2928e882cc2d8f539c0a4409fc8a09faa99da4a249efeddef5b6ceacab6704bab2148f22d4de60f12a19fcef6a3b8a01293209f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53d4aa6e0e93a084379fe2c460be1a906
SHA1a44ca3b956627251b870c55e41900e1f4e1ea409
SHA25640c1700e46672cd1058b6345647681f382ebdaef3fed47b0f3866118b483ab43
SHA51205ae6765f3b12033e152fe236f06dee6fa70e35e7f112e92335716ceb5b9aee7159167b9c5562187f84368c6e8e6657f4592c8b020a3e125280310567a1bdb95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57e6326ac308d500f7c3584cffb1d2989
SHA1c6779ab61bbb0b845b16ece9e68800b898267169
SHA256f89db0e32607ce2ac8d4e7d91626e0fb7db13e2c1906852f18a57bab0198351c
SHA5121a250e61d74f92299e158c6488acd8c051ff4e59a1a06a4013bdf0a5f96b076e0845559c625c2265f7b5d31759b1c780886937fe6f957c4e4baf68d4640e73a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD509fdd59e51d8b434f63f2f646a979576
SHA100896aa30461c9048530dedc7a1f362fbc7d1771
SHA2562c265bed1b03622e86a15a68b06e34c362e4fc400889d52500d56c84b2d4550d
SHA512368c26a852ae27fe749e2a0cbdfe608b16984cf8f48a143cddba96704e2a97af9a8f08a34c6bf9cd2cc2ff3cffbe345a3ae8f62e822d4e4262c742bd02555e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fbf9cdd9f4fff41f2b801e87c63677ec
SHA11c3eca3e396379890273af450be7c53730fcb72d
SHA256cceaa847230ef9302cc77bf119a0bd9093a7e26b07025e2e03b4b7e184d9bcfc
SHA5127125cb4442b817ccac1ccebf8c7735a8812db3d99d88118c1a9a89808411d08ebbeae177c209947136aff7cd12ffdb907988c235481bd78bf1918d4efcaef03e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD530cdda992588af561891223a2fc923dd
SHA1837032beabc74bc17b2d75c0f69cbf8eca172b0f
SHA256bf33b23e07e2222623113cef67799d1170439f56eae08b31eeb4f5582e6f4383
SHA5123f8843fbc032399437323703b9eaa8ddde6fc2db09d016dec792d075514f823d77d7670d04a39c51c7d4e14897c6d41c4f3417934a1b65761714c9601355ae54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e5487d61c40b4175751f00a746a52cea
SHA14bdcf65acd1da61c16d7e6fbedfb0a32658f1531
SHA25609b1490ae4d6ad2275f9e8abacd1120e89ca226474f63b6cfab90bf23cd64e69
SHA512fb4641914ae871bd505e959fdbbc23c5edf2e2b370ad09d651408d6e2d26de44c3c78acffe525c987051e1d451ec8a0ac7deb97497cb240107f76f7d2343bfc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5abd456998b43837311299edaedc2803a
SHA1a7222dfa7dc65210b36361eebffc5e41d3dca62a
SHA256d1232cb3dacf24ea1203acb53b9e202c7199c037356f38d92de3e2e1ad9481f3
SHA512a7d64f995254fba43d78d498a98c0153270e0d030c98faeacefd8a33a621623c3608ba30efe46346464d46a1d26ab136a33917187f2de249f3b0adc2fe7707e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD592e30f98169561006ecb3dfade20ae07
SHA1c1fa18aef5f03b074ea5e22a30fe367c93f3824f
SHA2564aa46ce2d715085f6b6bf91a4293671e5e0c12ad0d96f085b30d71adc40123af
SHA512d93078a5e79700f89f143cba33b941d29581ce0bd07e345396a24735d480ed06eb032e81ed74d1c7c00746679b16f6b55735dbeecb56239d0dc858c987d09b3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD569885787c1bc3a3abeb01b6802ffec1a
SHA1ace031a85509251621bf14a612472e5d7f64bf7b
SHA25645f15ab460395171365ebc751e42819e6e7b15505bfc3a74be2593e38a84cd3c
SHA512fa8fcdb24716068c8e52c2ee1c4a741d94dd6092741dbd31640e0370a2b73ba1da7a8b62b4c54664c92e8c48d2959e89737bad250bbeddefb64a68579e51c712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58e03d7b2cdaaf2f0a0cc957c0a6a9517
SHA14b6aaab4dc6fd9a51b3fe8cfd1ab65d226071d89
SHA2569bee2326f09ec9052afcbec1b1ced56e6c73faf4c50dea5434e54ba8a37ae0cf
SHA512dcf492fc5758c2bbfa2e13ae14ab44531e49c7a243765a4be75767ec7c5ddf6ac26e0866325132c50d39d3d4fe5e1e0e8d254b3d20984a5668032905b6caa13f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD520d4fa025023b0f50c14be833338cd41
SHA1bed35ccc5956a609219c0062fd00db24276c4c50
SHA25694fdd3463859b47ad0ca1540c34468cf8a6ad1acfa7aa674a64ad685c68b6a73
SHA5126ce6864fade36a0893cfaa192c65edc71a9a668ced2cd097127a18affa7a61566b6bec2934579b2308c343e90e3e7d0c2077799524157bd1846abb928db76b12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5be01dcc3fcce56b8db5ee93a1b1cc5d4
SHA10ffb8231ed103d2ec5a8fa02ea1bf71270584f65
SHA2568682da3831c1bf4d553538e6a8af038ad22a11ec5696d836a8a67eeb19d19acc
SHA512dc52af8a788d13737513285cf740aed3ead583b8199f526a585d4b2ab96da161f3d0c1c2f57dcb22480d43315c42a43a5d6716214acb3c17845563f8028a496d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b