Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
71da72b6a4f0d0eac3d8f1db69220bbe_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
71da72b6a4f0d0eac3d8f1db69220bbe_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
71da72b6a4f0d0eac3d8f1db69220bbe_JaffaCakes118.html
-
Size
35KB
-
MD5
71da72b6a4f0d0eac3d8f1db69220bbe
-
SHA1
c59eb02691a4bd4b51b55a19899982c81191f774
-
SHA256
b7a6dcfe8fc123fe8737c07c244f44511ef13352c3124d524374ef775e78680d
-
SHA512
e495335fd61940ca00090cc191d04c2a3c9cf1d5ca0fee2bc89ca64acea32b07e45f3574c2a070900dd9821d8d743bbcaef5efaa33adf485bcf5040e904fda48
-
SSDEEP
768:SvXXMifgtV+Z9E/OXni6LfdEnIv2Ze6+/6lJ6+/6e6zr6+/6+/6+/kikhcP/4DWw:SvXXMifgtV+Z9E/e8mzsK5llOcP/4DWw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428114988" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CAAE0D1-4AE4-11EF-82DA-D2C9064578DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c755b3055e46f3f0bf4267f60f49f98b5c7acf708d3af515da837b1990d054f2000000000e800000000200002000000048d4d6906d3519392dbe455f40a5825704ef50d120ef8e7ab84c1357a7e6d771200000001f4c7cc839279ea0a6c626deaaeea945df2b6ecf3453acca2b97eac3b71a738e4000000074b9ca2b2c77393e0b3c377d3024f9e8c854502540534a171f53f776fcd3113586d391724494cf3c2fe7c2520ae2acc359778fe5085a907edbe035b35e4309e1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003e34b91f24cbeb977484f27a6bca2aefa29670b7d14dea50220b264199684812000000000e80000000020000200000001fc5178444b39950bc93a98369c1113be934b29fef17872c20c4827a0974350990000000d33db02c9aaa18ba60ba4713f4be9b6bf0398f8925b8a6669e12a31a90ca079b556b7bea09d928b49daf7813d1646710d0bc912e5b5cc4a1ecb4de3379f73de3e61024bd6b3f74e74bde7676f8fdeea39d6e730a1d284cae598dc2ea4193df607111ebfd81c2125027d220092a1775d58fe293ee38069b0e11f1fdbc3132e337346e5617e4acd2f1f655d65494be12af40000000150552ba8babebadd6e6371c24790b7f4d3b43f81ef807197085a7230ace85b7cdfa8ee7da22ae928ed4d21d2609942c3971f8241ec5808a0e4063814cfe0e18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05dc675f1deda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2948 iexplore.exe 2948 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2340 2948 iexplore.exe 30 PID 2948 wrote to memory of 2340 2948 iexplore.exe 30 PID 2948 wrote to memory of 2340 2948 iexplore.exe 30 PID 2948 wrote to memory of 2340 2948 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71da72b6a4f0d0eac3d8f1db69220bbe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b7324d8afb9a91fb3bb3315a34cce10
SHA110e97386f35c02d8a0cacece6ea9c876dcf112b2
SHA2561700eb02749dd886ee64674465447d28291278f3cdbefecc5bea78fd4ecefe53
SHA512c47406ebbf9da8f64d34d4095df326bda3c596bcfe3e350d3f3ed7a37d65b0e59f84cdc447515ae3b16c41fbbd688977a9bdc1c61be96c3af26f0d407bc13cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c204bbbf2e9a694eb3cb80a892e8101
SHA1f959e608744f67fd4941a3cd0c988b73ed0fdf1d
SHA256fa114688a41a0d184115f34bb31f4b43e95b88bc5e4759138d3fca5c01039b88
SHA512dcc1e4f43d4fe34c3d500aa94929111ce78dfbeac9c1d4643a98b8f78047c0b092eb4053a45a618170ae992b39e147317743fd2095f2b9b67897b5b84df10604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596cb8665f377fe6d2cf20876615de98e
SHA1d3cde7dcd4008bf5986a209618b5f76fb351fc43
SHA256c871cad71e4e6a4c1341c67ee5044ae9bb15f19d0e88e02011f41fde313551f7
SHA5121f158d0bbdf6f1162a3bd41b2a4697f44d957a3aae790818e1809e9883a4d359e23f12ee2a9c65de05a53471e8e71e619691bd2832662f05f0b8c9f09420ec48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515eeba7eab5083800e2e6f945441a0a5
SHA11b168c1fb1106b0b607f1a7cc689c08b7fb35f14
SHA256b89bbedaaf446876b358679217c8e431e7132c18499198eb753e3e6627aad987
SHA512ec25be625a86d9c12d50c65ddbcfce800d0eb2c95e596d3b13fa3ac8eb8a85e4a6f3cc309c00c5afc394f5de2f3dc7f79a238f2c2da2179429640f47fa0c40be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54162ecac27cf73191a2d15dc399aa46b
SHA14ba76d3b5c20b42bdca6a24baafbc9683b6dea83
SHA2564ab9e98f8de8b667dae1ccbfe521c3be9238b0b9f07bdbae9e2b124a53b8e6a7
SHA5124fa00efe77565bd1ff15deb8dcd3979e87009eef0bfc995968eb28184d792c5a5ab99f4c8a385cb350e59ec7a5d6398d644fcbbe93262b1115923cce9ce53244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe8781c3274b8ba4f68e6c47cf70e999
SHA18ae81a560638bc3e87c76db778bc0253cae65898
SHA2566947d15b6036f8ea69eb8890727eb47abc91e83bc762a0cae5995b2da239766d
SHA512e9e3de50b0e79634c12fe3506b8837511fc3b7834140dbab2d3954181c9085efa33bda885f5dd1d8e628ca3afec66dee9280bcf12909ff2caaaa37c9b9c2f941
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566e0ea3a43969220d6ca2dadaaadd409
SHA1129cdaac3f2f5e13501c78472cdfb19a06074556
SHA256661bf60a13d381d1932d0d468f933ab74a1d18ae4f949c7cb7f7694f45198739
SHA5120ec3501aab3e7742a1b706a86c0ef901466b502cd88d7dcf270a4f3e040ccb07bdd8328d69772b2a8502a1a051c1a2eab971811f007c8d27b2b0c5ad46c7f0d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5135192bc2f08de7a38f7ae0d98bd10b5
SHA15d77fc69504d4f3d250ce0b42eb2ea3ec0331261
SHA2563e19a274fb1f2ba4fbb692dfd1ff250ca9203d2562cf6d05ed13cf8c223d3ccb
SHA512153ab2e36096af0a1f27eade6cbbc02c71f56ca2e885be39d673d7d3c6d2a8880b42de0015d8a1c7db274b3e84b9dc3ba66f8120657eaff0ebc96eb812fb8680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586495b19df4c18ab561b7932b5d9e34a
SHA1f994808c3407756bb06c0b3cfe205738e63a3702
SHA2569553099542739df014d1060f6f8004b3b42b1da712354b2c1979ac988d4bf312
SHA512163f109d155c5796a061b242525f28b56f78328e09f5fe66c006ec3c075fbd0620faf288216458c9ce117f7d7127c32a409fe90a76312d1db6d6120231d536d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6faf75ad187b0007c2964878c30fec2
SHA16ad229569a248f9f752a3d040308ec5f89b211cd
SHA2563de87075fa894d145913977b95aecfeda1daff0966f72db179b7cffc4ff01c0b
SHA512b7090172025f60b3f32d10a8fff9aa30af6b54874e25b9f11c25864e7404882a42216240c63f3045d657ce951d90dedb0dd19c26b8845c45116a09f5940170f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c40b183431fd4c5865424644c95f647
SHA1bf8484cab8c5daa17df3c6e0b95ebdef3dd8702c
SHA256fbcbe6d8b8fe059f71df33dda28d7d66e241f7871a7fe58ebc3c202f4b911c87
SHA5124a10ec88e16a93764c4c925291f2435ff922b3db1dc33e152e7ab0402638cd956eaa0c0640a410eabf4592c7ee0c2022311ff7e197608a9ef49b3ecc1541ecde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57378b419b01fd58aeb5cdb37f0182949
SHA1de77de23e76298437b865cfe9fa1f1dc0577cc71
SHA256232c4334fcb71aaf6a84a0744a2bd678b0a05065351754151b456f31537d5b40
SHA5121d3f78032e86a58ad8773860aabe8fd903eb3df26fe0cb800f580fd15377880de5a54556d3433e721a7b310fef75a3fd877f4f3f6b308fca2cefdd07aa8d7bce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559bc18de2d75c74f7f219dc42b97436b
SHA134c1ff4a88957c17d17a626d42ed042092ec206a
SHA256c9a42febb1eac00912f49b231b4a08f11539597b5b3f59df995641ffb62f14ef
SHA512e028aab051c78629e1009148e9788d87e480b2d43b2fa1f2cabb693fc113e31013330e1b5ad21ced9847051a4fbdf3cb6fa3ef1ba259ef71a9733dca2a441695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583b2345e961932971cfb5aa7263bc805
SHA19142295ad4d9d74ada1be28dc2a3f49cf247749a
SHA256b12572e37b9cb1e914c70969cfdff258cea3bf0518012393bdb9184dfdc0b099
SHA5128d72669baccaf3321290e7c52165ec904eb931472e5a8e2f4866f105de665d89249b3323320fc492d1d0215d9f1d3678c21ecbaac8edb0045a0266bbe406f907
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b