Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
7362cd2db1d159b97f66470cd1915027_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7362cd2db1d159b97f66470cd1915027_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
7362cd2db1d159b97f66470cd1915027_JaffaCakes118.html
-
Size
98KB
-
MD5
7362cd2db1d159b97f66470cd1915027
-
SHA1
f363573b4d2cfae7fb269b3e308d0e9ab6940109
-
SHA256
14a8e4fc55edc18898d77254b8d2070638a60e952db4a5a9287a96f82557003e
-
SHA512
43a7c5732a69998086921ed1855e9b9d34e02721d693b965442dcb917c8f4b09f67a07323ad01301f455dffcbd990e9fff87f596e52c60390559c943145667ae
-
SSDEEP
1536:st2WzD6bitRBQHQzA6H3MLC3IAeF+sGyPA0XJiC:1JZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000002f74f29e988a8ce9ac258c25510ccb9128de1b65997c83e3d7979900375400b4000000000e80000000020000200000003d82fb1d18a898dcf1374aac0068822bf1898eb388f1e74389ab891fe45f057c90000000de061a814f698b81eacaf9ecac9a3835b06cf30a0f1368ae88ee200f5e78de6c79fa20e58a4288f9d6ecc8012d34853f6331562220ef89e332d65d45174ceaf45790834c21570e221df25eb6fd363e61bdcc42c91239fc5607d6b5ea9e0585170cc8ba373a105d332ae6d1efa0e9e00880d1147a74b4a2ba3666559160ceb3931e6f80c5354749a53191c967b1d9473b40000000beea5c8b9aa52a5e56f994ebc2b5a9c580f1e4374b11746c0371935341b8f866ed8ab2baf62e93946426ae0cc00db5426abdf8a493c9b7dabd978de262414214 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A6F02C1-4B2E-11EF-8ED3-72D3501DAA0F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c0086f3bdfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428146768" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009f52a36a26bb9f18b6ba17d234e8c6c77695bfff73d7b2d2d313fdfd500893e2000000000e80000000020000200000004a78c38abcd18ab699f5f06b34790e5010c89addd441b7f7266f7726a3b1a77420000000ac92b820da369c78678c629491b72df35a18db46a818cff2087b5f466a0606f040000000ffb68398a0fef1c2ed6423fdf56c5f3dd7bebfb4797297f16b0fc4c6d9f1f790296e013bdc3108c2db545e609f568b17cee4c63fcdad1898eb97297369f1695b iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 1152 IEXPLORE.EXE 1152 IEXPLORE.EXE 1152 IEXPLORE.EXE 1152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1152 2180 iexplore.exe 31 PID 2180 wrote to memory of 1152 2180 iexplore.exe 31 PID 2180 wrote to memory of 1152 2180 iexplore.exe 31 PID 2180 wrote to memory of 1152 2180 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7362cd2db1d159b97f66470cd1915027_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2eeee0d37d606e4b910eb0a8f94282c
SHA1cea3bfcbd78662e241efed541fc2f68161774a64
SHA256d062794319ef3736cea0a28cd2482ccc5a0dfd1e5aa813824edcdf8986d2c9af
SHA512d9faaff9c4c8b068cab8b88ffd4d5413f69b07ab73d5eebfc304efc01b3667f55ae9be492e909f3bde470e18f380b732a5aac85b9156f021723a44f71b6e959c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef27f1c9ef557b661b52198d90b83d92
SHA1a2a23419329d430b556b094dfccd9d6cceeda029
SHA2565540a566fae44cf378eaeb489b239d92c49d189213fbe6ebff7f8843ac2dc94a
SHA51218ed3e7146fb71075b472c48c4fc9ad4c140b62fa31f5d921f32f88cfa9b02892eecc103e89ef0efcc7e6937482e6cdb6ed23ce844fa86e975fb4bf8175ed11e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5757483074fbec72bfe388ec9eab0f35a
SHA171ddb36a55d4019e969d13baae09db4c6a761473
SHA2568a182979c678bb16716150af20b175bc245df4f7bbdb2f0f5a7ea177a23bb781
SHA5129b774ce4278a909ec7453a2fbc6260d914a22013f84ee7b9a7db45fe7cd994011e2b451d8922335b8a2359ad1549c20c04bda7fb657ef19be71c90813221f8d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9b6c35268c58ac2f69cf590f3bcb21e
SHA1d4cdce3810cd211a8f3662faa4d034a424a3b042
SHA25621cdb171f7edb8aeb10adaaecd8a042f2610423c657c2370990a9ce1e4e4cfa1
SHA512d1b9c935dacd2517cccba6a8f4d9d1458d7c224d4617ccf0c021fdb8051b5acb76fa37e1cd25445abd9370527e02d07793b1b38a2d0f94df919d3dee0c30d1ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cf13cab7630f4db7943dd822647cf18
SHA12b82fa898931e549af757e83426e5dfaed78762a
SHA256efb81090e01c65281ef2b247e6bb9bc94aa8cca31b33646fb21a0fd9131d30f3
SHA512f6b13358a4c128f2edff98548aa5724d3b1516ad362f2fd25f6a512dea79accad61826bbdabd3c792a761ad69c3a5452f25b2559f1a12bd8ec97220e3f7d8e83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8a2b6117f539710bc8c80a693086abf
SHA17a8b4f950549ca29d2d12d7bd2708d6a9a3daa00
SHA256949536c4832176686f67b45b0893c01d42d4303593248ae6a4e6389b9b3961db
SHA512eb320dfc1c6aca3523fc91829668ad9aae34434c365ae312cc60e42fb911c4b2840c4d765f3dded0a1a95361ea00a93ecdcbfe8b7720b66da4b737d835cdbabf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551766977f7b26a77fe1fa207218b9a7c
SHA1b7534a54954f0051d4998296d6512ee85b4480d6
SHA2563c441b3c34e73492e9384061f3170b43ba1f2afdc03da23acc0187ab7ece2705
SHA512b0e6909e16673f66d0123250590aa49c5b7ca1c74ea04b7d86ad6d565042f13e558d978b5cde9ee0ecc9ca78f7dbb082e837fdd4706f22fa08aef04c881bb401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c724f7bb154c66db0218bc89b69c865
SHA15d0ae750a1dc4a58128c15c2751600946819619f
SHA256be8da06186b578da89c5092b4e04a3d0695569480f93d94998b2a8d6be396bd2
SHA5121a8f75715c2eace411e885d434c80504c7947e565ec7ba47ac198ea479745f92b438d45b3153d8f8f588c0ab7b3bab870b50efc4416c437b5180546915fa59b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582453f6132f0d9245777b140425c689d
SHA1ed39722c39f44145ff9570514a745264cf3e56ca
SHA256bd618d5a96c13f21ab553ecf38b16accdeb91444d9c05fa905784ece9ff5d516
SHA51296306b25947970161b2c864fef593202f4bcd55434b1aefc0f42f20f4a639bbff00bd6228f28db6179b3b0277da7a77a99a7d73e726035742d6107330d928cd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcaa9abfb033338f742c406a4635cb73
SHA1a274c3d106a7d670b7c950cf3e6bb155a888b0ae
SHA2560429eac465401debdbfa36c4169b7f496f6f8819406e6ba04baf7f9045742ef7
SHA512822e3dacb3c76430d42b841ef7b90edd876cf8059eeaa4d7de2e1e31832734213d00ae2c7db1a145bbd7f497cc678194eb7932c3827f6fc87c4a90420e964192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e892841eea44b9df4bf146baedf49abb
SHA197f661105bebd07f7f400e72f828385e17d0f15d
SHA25618fd789baf9f1d846d5569e654fa17df42d4c9849d9e48bb75730d8128852911
SHA51228a23b5e678fbea733c06e12c538a062b8011c447a31a7337e000fa48294944d5f14cdfbc621e5496422efd809f4a485eba261c82b2582eb886964f16eefa2f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5536921c1be6782c7364701a3f6a24626
SHA1c28a19f7ca63e4069ac416ce18a3d9604e5c3fca
SHA256f0982a9bdadfc09536e4885b5f9b611d9a95cd67f192e22b421682973e288086
SHA512cc3fa0eba03677e59fb3d2ed9e9a04a116719bba885a9031c409866c75ebb5e5d20dfea4b669e7ea3047df28120d335381f24954ddf8fff59bc9b2fecbc75e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c9534fe9483f176077c89bd9cc07d5
SHA1bb278033ff1f6eb9145ed0d44bac5844c7fa9206
SHA2568a269fad0e19e8021abcada9d2739ec964875e249dccf38918ea3918cbfcc3f7
SHA51245d8d59c98ddcc7587117649faac22a4969331c78aec5209f1a38f5e53e71a13ac08e87a793a0464b23ae80585c7d38f89c3dd2deded5e2535dcf817fef76215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512359032e81d37ca568ce23e34683787
SHA126ab3f44de61f7c50d0b1f682e4bf51ed0400fb1
SHA256c74d4f4262800c33d8cc14f9999da28cf64c1013fe046556221b6bc133a72ce5
SHA512a87960762f4a8691bab647c57452eac0626c73eb8c417bca166eb592f74569ee6e91aa117203aab8c1787af68141b52877d4ba755d85ec0a945961d5bbf0e9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507064d68f36544e40ce11dd3f3c58d33
SHA16cbf3ee20edd077f7278a08386c2154703917571
SHA25659ad7b21aa9abbe9234b0e5a3a3956fb549187e37496383e5358d85436afa62c
SHA51219319535d2ec4d276539730519ee077d384f240be4fee1906bba2a7018f839edc2109976404f97e1dcaebb8b948b9104a7361a4c9bcc672ed8daffb1f0e6de13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a5f6f96c14445844b5268cd3ceb534f
SHA1edba9613d8b631ca1b5a9cedd87bd09dfe178f69
SHA2566b840ae8de28a82d9d003472bfb060bdadcb7dda9fdc33fc662a97b395cd786f
SHA5129290885aa5dc741f7fdfa82a5d45397e7badc779204ba8f14e68f1b970493bf952c12beb4ae6ca09ff14c2c8bf7380a0bdbeba63bade85d446844a4f09b0fedf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b