Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
757273edf416d57523db2cbd6767a75e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
757273edf416d57523db2cbd6767a75e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
757273edf416d57523db2cbd6767a75e_JaffaCakes118.html
-
Size
10KB
-
MD5
757273edf416d57523db2cbd6767a75e
-
SHA1
be4a375792f87eb7c0d64e314a2a791faff71bc0
-
SHA256
d562c74e610b76b936e14831a7754fe8a46f4f30b75da716ff99783f0067e546
-
SHA512
2529070270cb85ec09ae8ba4fd861991d9237e43c0b9f1b7d55c543f51d8ed678179319522a7eba845f653b54fa298005cdd2ca09e84f6e2b9a6c36a164e79a9
-
SSDEEP
192:2VIlIsr038d8k/w1wvqVkZ5BfqnuhChKh01SZauBuLbdU8d:sIlIcu8f/gY5BfqnuhChKh0kaguLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c86b5ad7ebdc2f2bb8b3a35545937939f9e1a2303f926260a003f00f93439194000000000e8000000002000020000000ed9d9537251ba8637ac28db68f00086fd32536d3d0c363237e7ab264e9baa3f620000000a2b38415a12dd88c2dbc0240ab1dab8fd94d6bea90cc35729d8b91d688878a2340000000b0427a9dc496372494c4842b09994eaba2c5d90b93d8d7b8fe4fceda51208a7323924a1e440ba77a2e219a0b5c8dfa14aea49fd9105a5d02fcd0962b86764240 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{498B2BF1-4BEB-11EF-ADD5-E21FB89EE600} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000acf29eacf5717b2194db1bfde2f558a0826796985e70256721fd1ba7e58a1dc7000000000e8000000002000020000000014e0848b1c1523700d1a9b629080f89a56400ef0ec76c6663d781908540881690000000597dfa046898cf0cf0637fc7e88bf36cd3c835088066c5dbe329dc6422d389ce2fa108d285796b332e0fbf7eb37793dd9d8a6602940fec199f0820f96c5017436a18e20c339f4abfb4a2235f419c1537858ac521b47991a62ef3fb9028e733d737f50d6dfcd995656b03a23d0e1a39f32d06a8eabb36041919c7e2ead32cb6413685468b58fd3ed617d4f0029378e3a040000000d83edb08bcf9750b3987f209b15058f299eff43973bd32f645ac63582b404b02530f5a476da79baf777dc87d63aebe4c9e25cc3d5cd105ce6c65ba4612beb3b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f097b62ff8dfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428227807" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2820 2604 iexplore.exe 30 PID 2604 wrote to memory of 2820 2604 iexplore.exe 30 PID 2604 wrote to memory of 2820 2604 iexplore.exe 30 PID 2604 wrote to memory of 2820 2604 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\757273edf416d57523db2cbd6767a75e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c7a542814ad3d44c787fea54a0f20fa
SHA193107bfbad221e2699c44bd7107df2c67e7d82f6
SHA2564045833c927f8f29d9ac3f8eacc7180fda155a5c8d1f5c7b7597e6b457eb40fd
SHA5129d1456de84f25cea4611e4f8b3e05c00217a78f91ff0d9a820e520de4044fa5511fed9793ba553deed3d97c46e30d73bf9467794edb1de534db76ea62a6e9481
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de9c92055165c471a45561ae19ddfef7
SHA114c1d694eac8a4ecde9b985fa8325305136a24e2
SHA2566ccd06a5471e3cb2a490709ef614b90d055dd5c3607e294b40675fce150c2130
SHA512dca00e276b7705fe3d9b15eae765e351a435ab8f672d23c1b89448c1addc1cef2c3cc003bd90aa4e98ba07b34e47205fb01f462c79b274ef3316260d9214331e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568edb609acb13ae5286691c2d4576820
SHA1c28080c9b564117f13cf656ede06013d76c9e23d
SHA256747163bf070ee5b2a7279aaeb1ae053721a8138381c667733d08460df2489196
SHA512f07f28aa8eccaa36496b31cf8ec0c415dd3f18d236fef57b185e97a38b1e5c7c67be22bc892f3b5d3f5a8e3cfe80bcde53ebe999c31f006fe0473f9ea277dbdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505f612bf04e6756d7eb3fd10312d93df
SHA12fc0ac0004a5a68050651c5dd3913bb412ac73de
SHA25609a9ed8f9ba399780eed34565adbb213174a817db5b10b13d5abe8e6b5e26846
SHA512685b97f2719e08997ff1dd9fe468e12481625005a47ff585aee325d6aebb9241ed351bd96842743473c56b6a481da3bf89a792edaf3b592b71f3fc4b06ac1773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d426ad5fda4ba0c04324fb7536eab59b
SHA1abdd5e85526d57ba584ae6ee2487fdf95e04e5df
SHA25614afdfaa1976ae1598fae9ed6d55065d83f3de066ebe86bbc9dbddcf62d3d0dd
SHA51253a01146d2c2139427c504d4b31272e2a0bd92b54064aa848f820eabf174bb8a6dbc3f9ced520060537f69ca16217bcdb486af5eb37156cbc5846d0ae2ab30b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fa0596a0010956a473eb9730a7f80fa
SHA17f1e0e0371f5c30ad59dc8d3a70cbe2047bda89c
SHA256ec01ecdac699a45693aa397127a8a542927a79e5650c9f312f727f4514b76911
SHA51294f517703692384c1e8418cf9d862cd22453a8b369273ccef5798697cc5ae0141c5183d4e58970c5697c6a3b46edcceada302a9a0d9ece042c40458b1fad9f3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b02b0814ebb364fc7b1c80f102d619fb
SHA1f3f1231d0d4f30271b2b83f794849d6f966fbae3
SHA256f628353877b9be925a2ee7754d81a0367bd9be76fb3f9f1de88b49356016defd
SHA51284b2b50bb2a29838a84dc8ccef118821dfa698ceb29d0f78d2a7e40e33c069367ce5af48ef02eec8fc8a768e3c2f580858cfcddb59c8739f0bde993118bf507a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597ace99e053bbb718e2dfdad1c8405e2
SHA136cb092c4397a0a02bef9119224dc877bfe37ebd
SHA256a2fc010a3d9bf1e9fa3b6d2be63622695885e05ec5fa00313f97b08915370324
SHA512a4a57fc7771f331f7d05e26ef84177e3536167c66be06ae724178a81ff78f81d25a45b7e142a31752fb0bd9f6df70c5bcece9c230a3b42d2c05badd3b74fbf60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e54f131abced7f6d194285445756bb4
SHA1a8c3066d63dd510ad1bb08fc01e523347cba3557
SHA256d6e326c120961f4f00f00eedaab4a0a838e13a9e9a24b36e1d82f8b24513a354
SHA512c7a52b6828e379c12f694380ec1fe4be398402de0319675c52a9a7da5e93bd01ed3539980ea9c6395e383831e7ec1e42dc29416dd35ca262080df98033d60260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52465edb00078ccf82d8d8d1bf5420bf7
SHA16e66444004874b7a866739d25b7bf9e29a906bb2
SHA2568a96d20aa492b75566923cbdca11534cd6dbb1d00ffbbc0e6bdc6757a3794af4
SHA512d94b7b8659cf519aba02b0906950741788540fae4a52dcbdcf9083b206844e9ea07c47aafa9f50de3d738b923f9c8ab3f064035073d295a51d535697db366665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be09bba3356d0fdcb8b14293171fc5e0
SHA181ed74be61b3636b41bfc75ff4d2232726f8f6ad
SHA256796b022a77b7a5b85f7ddf5f61dd249f311b729c9f97522978cdf3ae32488f0a
SHA512ddd5732ec5fe917594cf8ca8cec029c01d45d9eb249313cd5c918b926ccbd0819fbdc85b9d5cc36e409dc2b44abecbd84e52fb67010520c9d0d43942cece37f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f073e53a92594d8adc5fab877e837846
SHA1a4580e1c4958a2367e6bd28a34d59b521dc1e894
SHA25658ba003f931c47e0c042a4708b3f4ea875e86e282aa35fba4fd2395aef7a0cc9
SHA5122090a5bd4e1f59fdc66b205bc0bacdb4e656f60a166453c51d49d84c976880c39c59d34183b4fce94ef74a689fc21a9cf69608e516f62c9e845d31e76fab22b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592f5fc43ca01fe8b6b734d8d066b7b1f
SHA100505119cd01b949acef58cfc062538e8f37b823
SHA25653f54b4df88a2165ffb72dfa09f92a907045f9ca55d7afcbfd7adf1e11acb064
SHA5120b9bf5df7d8855efd885d56c6b49e088bb5494ed82843f101962f57e67051dd88ced7de32046b419ce99da86355ec42d8a964a70fee090034a9a71e5db3c9e87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513f8f0aa6c77cddaeb58faddba60e8e5
SHA1cbafdcabf41e7509ac244a60556de6e922e726d0
SHA256c5a1f46047108fd1365666347c747fdb6aab5c786c0672bfb45d9d143d0250af
SHA512954591d3952eb96f518327020e223a5f8be258e991b2a38f41c4ad0c658684e9e62a5b763971fc74f5f54c661a53db408096edb6b65f181642adfab385d02519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53389fb20c9a3f059d2154dfa3bd5b1f6
SHA1c4ba600c0efa0af7474834e0e4e3e3368c60a13f
SHA256d23f2b0f122e662354315b9d799adf5b473f78fa4e6ed026075b4f9a5f4e923c
SHA51282fbeb508504c3105b3ae83aefced42a8d065e5d456a1d6ee2f96e46423c8b737ac28fcb68eea76164767dad3af055864d19b76093c1356cec431efc3ca87525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5a3d5c8e77caa31d0ad8211abf3a8d7
SHA1479ca3fd960ae3e35c4b6fd175299dde82974f51
SHA256bc30461e211f253628fd9e12379e26a2de53d68b1fadefb041b8a5b0df8e9a08
SHA5128a6dd103cf5f95981326215c44d321033c9b4cfdd8870fedadf5d8086315805cd3834e81e09dfccdc165612a689692c7d00ae7fb653a4914a90a4d8603e033e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fc2bbc29df0886729b06577fe9c7019
SHA1e49c96e8d26af13a7f8fc436e49a2426f0b8b23c
SHA256c6276ab80b4f39f82e927a915927c88b431cc4d43d26e84821b25bb86eed38f0
SHA512eab3084d2b84696ce339c5fa2c5381674274ff6f1ff01922fde5ef8dab0717521a32df394a4016c4098642ae6e8e8c2101570df1c77788597533f7a0e7686f0f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b