Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
7321c37fdf938cd915e47b1771ca6b3c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7321c37fdf938cd915e47b1771ca6b3c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
7321c37fdf938cd915e47b1771ca6b3c_JaffaCakes118.html
-
Size
42KB
-
MD5
7321c37fdf938cd915e47b1771ca6b3c
-
SHA1
e02b96999f4aa351952c9dd67f1b2da3a68cf531
-
SHA256
2cfd4bb88a664ed7402602d1df9758f441f052be4ee68a6b8ae777fae291b9dd
-
SHA512
4d2822620192e7f13a23bfe9ae13b8045f7a08f814969f269bff06f354f4463e1c80dae0acd9950b86da56546f84ea36e0f52aaef3191d39514faa8f2c7bf9a7
-
SSDEEP
768:SZyYWzCCAPDnOuONSQmsB3NPeBPmxph9lB3fGqqK+qDVAIZSy3h3ApTVSs2QlsL9:SZyYwwK1SQmk3NmBPmHh933fGqz+qmV0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428141178" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{968DF381-4B21-11EF-838C-C20DC8CB8E9E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1960 2108 iexplore.exe 30 PID 2108 wrote to memory of 1960 2108 iexplore.exe 30 PID 2108 wrote to memory of 1960 2108 iexplore.exe 30 PID 2108 wrote to memory of 1960 2108 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7321c37fdf938cd915e47b1771ca6b3c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57940278f903325ef04c06a70c745e365
SHA1c85ef56d4125073c135882477e6c9a47e760f1dc
SHA256ed290664d67a6391c599da57e8dc3a7f00a3b1735ec4bf4e66a93ddc19e4a3fa
SHA5122440595b80f8014f77f735143932a1a585e11c4b45363d4dea78cd2f1ccdc8c0bc9cda70a06b970cc2e5bdcf6621724ed0eb9d24cb42622a8f2ed5b48b21dea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511357935e06708a75558b924a11bae44
SHA199aacee613881a5d05a92b940f718f426cb2df49
SHA2568826cc28d1f051b658f963a15a4d0b9a9756b51d2412a1ed50264cc99fb24822
SHA512c33f24bc4f2dcc717e9aa35dc80231d3caf6dd3fae487cf7ce5a6bb4e96fb53990e4b8b9236fec3802c6d501b4e6773f94a924488f99b81d0a4f58988d936994
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527ada5fa5fbef906ce97ee8b96f07cfc
SHA1cfe271308dd503bf3492131101a6bcacba0347ac
SHA256dca14419e249caa3ced5dd0e45bd2916f48500b4ab926d03eb439b50d1c4d08a
SHA512812d54f0f8f166ba47b06b29ea44d6e66275664f8990fc79de11c87363a32611e58f8f4b4f93ebcb0b8884d3d7e42ddc2ee4950b693ca2c9eb32935367059862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d6dacd7e09fade3a6a9c8b4f9eb516a
SHA1b4ed3e535f042d210d99b16b8f75e402bceafbee
SHA256107e0e13d5704ddc94db665ccac365d4e565892e75d10b0549e10d8bbf5ba632
SHA5127bb10a8fe36ff658b5626a56fe5cdd833657f7a7f9c530af112017f05bc14dea81b528c30bd83fa1336cde914b68e5f360d25f69e5d9295bf4e6254a331b4fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a53976cd6b9740948e709de569cc977
SHA139c2cc2e9b897a0f4350910854db052905cfb934
SHA256f20d3d4bb7931d846a259c1effd85b16a02bdebb07e90f1ef692ddf5fbd97937
SHA51203045243d375d2efe8bdab9b0a28ecf0ca9c478c71d25a2ca3eb63e4eeb9664f87cd0d8beaa13bb5131562071e9f15b559abb272a8c0acd0f1e28ea58f0f919d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5219319a0d00097bbac1150f635f2b4fb
SHA190bf9b34f21f6295981c0777cfeadd9b4f3efa03
SHA2566cb8c9d7a1a2565b22b6f499b4848a6e81e1bc1671ea8b8decaec34977f3f6b4
SHA512a2ebe051c57a8a1c5b4cdaa15d25691107518bd7d55bf58c8e78374f6e39d18ca5f549b5ee8af5fa767008e1eef2bd335f65ea41ca141a27053ac30907155e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551b97384d13b03cfc0c92bbba104090b
SHA171dc172656d5f92fe3e43cdbeb8e7ce2d64ee979
SHA256843235c47d8e1d597d9a26c27398b0b8512f363fb2f7aa97195ba1459d7668cd
SHA51202c8ce6699d4cba4180ac0a4404c9726915ae84efc56d375960bc6dd94e790c4b7f50475893d7e1be5038ba8225a684c0bc8718fb647479679285835f8ed987a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59aa9edb3277de8393109905416f191a7
SHA1be4d457b05eb447a1f5854c6f3f96132ac4ce33b
SHA256a1bde28be41a9b880a25dc81fa2597deb080743dc01395df25920635c6de3963
SHA512e63d21fc440be145c972d9f335276650f5fde41fa7137cef74beaa5d88872c7203cff1d8a70023177d38f96e81704f5119b8e48798c178e65f872ea058e27178
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542bb104298cee7b19b93da0b89d4d6ee
SHA1158a2a8e4fa0dfcf82800e3d1cad6683628c9806
SHA256b089f1fa5d415a27fb9345117eb4391385db8c4956fa96e7eaf2783b12d80257
SHA5121fd437e3068a663c97772595c87a29486d29d4de9a50245aa04a1155102fb59ef7f7cc2b5b249998448ad6b15f021aec838dec48e26eb08f47fa04ed318b376c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b