Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
76483e035afad043c0dfba4fc6e1e61b_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
76483e035afad043c0dfba4fc6e1e61b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
76483e035afad043c0dfba4fc6e1e61b_JaffaCakes118.html
-
Size
53KB
-
MD5
76483e035afad043c0dfba4fc6e1e61b
-
SHA1
716147f3d17b259569eb123467b20b0bb15c7439
-
SHA256
14fe04582196062acb4b2496f4a997ebb12ce79ee6439bd1e5c283ab642262c5
-
SHA512
f2cacbe088b0a1baf029a4f5e9ab4fd3ad3548dac09cbedc7e11d438f1983c1fead2caf35f42126da2605334cb0f599050c1fe61dc89a9b69eaa5907973107fe
-
SSDEEP
1536:CkgUiIakTqGivi+PyUrrunlYu63Nj+q5VyvR0w2AzTICbbBoX/t9M/dNwIUTDmDQ:CkgUiIakTqGivi+PyUrrunlYu63Nj+qB
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000ccfabe9c82e33d03f567e6067dad1d8e1fe8d57667adb1488b872fb55caa094f000000000e8000000002000020000000b581c0be15fe744940d4d89b3334de0905b1f34065d087c93b410837c2963ae2200000007879645393ac5e54e70c4c2cc07885af0014720381affabfea490b701b98df4d40000000a5a86fc7f18fca153540a9bd65d73369ae371e6b514fb259154fc0c1df8d950bb8450c01536cd0a9dd0f9926a4a673912cbeda63fea418c160c79c365504a8f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000021de4256767cb46733a89509873a9f4ae4c63d2843fbe99b1c3c80a47bf0183f000000000e800000000200002000000061cb0fefde4de736d693a5446a4db808cbb566366590659fb06701d3ca27faae9000000026dca845c4a444fd2b54451c99e067202a030211aa2a4aeae052ecaca635b8a9ab27f1c2a1d03444a655d62d5f00dad1e7b30ab7c40b210b69120b1a80b64a0aa7dd67f6e34d335b8abb3d2491e6d7a7de881620d4e55bd689dcc04b124245c57209d98c43dea4f1dd74222c633c0b133a309e4f010674f8bae627707069e2e98c1d37261336509c531146b75fcdc9e340000000e29ae1352cfce31e857a88439f7c890859e0e2113e195543f5fcb00ebbb7d56d612299a2b88e92b0abf97700bd60a8b91679738d22151716512302c585d21bf1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428309939" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83815041-4CAA-11EF-8EE4-CE397B957442} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4002255bb7e0da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1744 iexplore.exe 1744 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2248 1744 iexplore.exe 30 PID 1744 wrote to memory of 2248 1744 iexplore.exe 30 PID 1744 wrote to memory of 2248 1744 iexplore.exe 30 PID 1744 wrote to memory of 2248 1744 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76483e035afad043c0dfba4fc6e1e61b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575e8228c3b599325c91d4b87c43baf75
SHA1ea5f88f01e14574b76575becfa8b64a9b4bbc97b
SHA256589bac60eb46b2eb8c412652dcd60b1661d4d30f5e2736c235ea1bce2638a442
SHA512497bcbe64534f60d3e326f08b489ca378c9ff279b7006b3007d93b66c134ac6250d352dddd20b2f2c346d13cb9563a2300be511638b1417a8b9fbdc2f44d0cd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c30288f2b7752088f64cee0fa479e56f
SHA11465cada284786fac7864b61880b9cee91ef1e4f
SHA256386c50dfc0c2635943a6d1dbef6b7f22ca1402b6abf803fa578a109665311ce0
SHA512269e6e0746030906ae2b3ce05bef2fa4b3bfdd6dc97e51090dd4711a684f9a06f8d579826313fba4440207a667173895511cda04c86a574fd14868e968e15323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504fe87ce4d8316fd6f0665d4d6d47551
SHA19864f41528de056eb71e79664da1c9ac8ab5dc5e
SHA256396b32f37758f7bd7f1415c4df8f326e26b84cc99140edc6bfef0c793703fd76
SHA51208017287ca56d371b043bdaa2550bbcbb2215ff8300d54600e5e6474299baba8255f9f082bc3c2fd753c2f0679d557665501f0de93e32fe02cc7b664ba2a06ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bc6ea83616aefcfdc629902bcec261e
SHA11d02ea76461415104ab133d390df1e05f1ba98eb
SHA25627e319f59e703646241729e843a3ea1f0d2a62c8c50266f378098d7f82f27d06
SHA512eca93d372adfc1e6d082232fdc5756bff82a09f7c976f41ff52cd9bc2bca47fb7d7b4180e7e164b6d9c82e791ed2d9e7c6bf5096218ff4b476730a76033fd66c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba9aaaf34b24ca83a7d089274d2b8d75
SHA192f1f12c506b093a860d502cec9ed2562cdf0057
SHA25645e07449d2fce69c9cbc092fcf0ee721347d9a2827849d3b3378905e6f00d997
SHA5127f0d344e7745c1d8c6d328587b139b699be17a1d4407ebc3c3d4bb49adcc75c48f0218ecc4202614fb9e7a94a39c8cd12b4a37d4289968549f06f50c9d05a2de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba48097441f270ac21a7784ea056cedd
SHA16ddf50ef9170947cf4207d51d11021b29f353cff
SHA256793e0fcf97c41c57cee3ccc4dd46f2a6651e1b1979eb7c92ef606f9776a3cc0b
SHA5120d13b658b39256deecafa369c7bb09729fb25eb99cdfb5accfb1fb593c83689968cd6169321331b3be1a06de613b77057343f939627b53ed37e61011f32d5f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe5c8c52640a1e9375778dd99dfcca48
SHA1322bb5f72139e2fbc0accf8188887e728030f861
SHA256ec48312b4ec580471b24f2b1afad29ca72bcfb3aed370002e774848fcaa04d75
SHA5121267cbfe29fdc18ea595485b7e172740e97053c18f23bcb65c2169b06246821e85883b21efa8bd41b05f24daadd6a8d84fdee3156a1cffcf5a6b179c0ceabb01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f7bf9decc8b9f5299492774b0bc2ed8
SHA1d20e9b0f17e0e970e2c5cdc8726eaf1df60875e8
SHA2569e740318438085373ab15a1ed657c04c748d0f463e323ecdc917e56db3e6a786
SHA512f08790d81f8a75c1f47da63dfb76a9cb62d993cf2bfba4273f07b9499789265177e978d735d32d26b66013a1d29a615cd0200ec85fad19422a5ad1fc2e0ae320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f95bb95592a48bb5be8abeb2f608c31e
SHA198aba1872548954ca7a54c0b509cadb0a159b45d
SHA256f9d50a40d5649671a57fa2b9bc07f5213758ce251b932f053b51d7c0d5e37304
SHA512650174e7e62ffd00bdbba60ad741025faafb61355edc9f7d39636941f045fcb1cda9841833d97781d4ec466c2ef9a5e8e7b1f64683d30914fd84b71f0c9fa6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e7f1b788a7988c5c5fbdb0f9693f343
SHA19afd314170071222fe74efbe31274f785e30cf38
SHA256a89e2d383b895b6fe1175b3710b209da368ddb37f85c86f337ed260113d1ab71
SHA512e60d3945e0878afa6214a02929f19979a52d58458072657729dc264146922793a9bb7f74eee7470d5a31cd2ecccedef0a93480beabec0a4f941d79198fcfce63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5240a17db734749757b0b87146951eb1c
SHA19b4d32b2859d45811add8ee6ecd9111445099b20
SHA2566840bf6e924d122611b8fffa87a4a26019b3ff76c7152d4a40ce89b65b2d80d1
SHA512c4ca1d68ec1c775216cab8c6fd7b610d4c063799ca2b4b493b8193d5af1b6aee01170db1861bb79c7319865aaac69eb088ae1132a5908699e21dc33083e7a4c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5367d444cc0dadf8754943990b9daa904
SHA1a82e0eba2083b008eee80d90fff004bdceb4bc8e
SHA2562f947540825dc3923618981b13bd7b5f9520395b34a3721eb32f3c6ea98551e0
SHA51285ddb73cd7be9476629f32cd2adc249a9335496640f53567a193af32093c3912b49ad102e7db02469f142a45715a88f32fc997d446dbcc439750e4255f54b8b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579adebab269a9e67bdfe6c5c19815c5b
SHA1de9471e092b787fcfcf598a4b84fadaf777b84df
SHA25631097b825405f908167a97bfbe707b9978cc29441a7e58795cd470a3743036b5
SHA51295968a3992b1e85484735a4520668f36f9fb972cd729a5d65b58c5b97174ad70242f24f02a854c4e9f097a9c2ce908d06c6da97948b3e13c057755ddb3ad072d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c5190ada66ab99cdc7a66d0bb07bce2
SHA1e5b09089f3ede8c6cee057c0a73aa13c974574b6
SHA25673dfbb94110f786ad1a9dde5f57e3cdde11568cab115cff618eea457794562b9
SHA5123bd3ea410bb62afabd92bb766c87a4e29977828ba0e8371c4d38d468dde18b3f9679da2917833200d33fa91854876c7f8d92ec3bbfdb18d5ba78eb673806a014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5418213670c8897b650e59316204d3446
SHA134b7c82652e0c2f4b39b91d23df8abbdbdad6f26
SHA256fc319244296f8aef9856eabc350aaa30c00376489b2368c91df3fb66e1c2996d
SHA5126b02f35fe566453de54073df6753e2adedaaeb6f9557d67da5d62e92d179afe7887958f7e120ed9c8b777453294aec47c9be4b653a53a00880be209449962538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5050e4bb4aabc983609002ec37f13cd70
SHA1c7e41cce7346f140e81fec842bb88e5d71bc139b
SHA256ab91e8883fb10f63100eea4fabd312115411996686d3cfe3add382d6aa846c47
SHA512a7a42b89fa0870989f4f1bc4794dea5425df9a1fbdb9b6b5d6328caab18cd033c308288e20ba58fbfeaa42210d0ba8a316992daeda5f14fc829a2ea654cd2e21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5e70d587d2b1189c3233ab6ab411c4e
SHA184a357a0aff898378cf0b8c913563397179ab8c9
SHA25680d63181c057e2baf5728051ca166a094457c5e11fdd1096297bc2cdeb09422e
SHA5127c9167fbfa05937efa9eed37d2cd439506e315375f673bf632377d206b88ab4e5244e2b57e0ccf9f680cf80678392cc10d89fb4c6f6984593f75cad39d4a2caf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b