Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
7699f7457e5eb35c2bc908d3317345b1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7699f7457e5eb35c2bc908d3317345b1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
7699f7457e5eb35c2bc908d3317345b1_JaffaCakes118.html
-
Size
12KB
-
MD5
7699f7457e5eb35c2bc908d3317345b1
-
SHA1
4baa85222282441f90e61236e13ce688acdcb990
-
SHA256
1b4b3cd39e1f67a57e7a420118243543272242fc8c4701e6fa76eb6084598156
-
SHA512
124ee2e99f2e4aac18e065a5192f8a7645e3b25253b21ea81deb979f0aaa15204df390012e8b566339268dfff3f6e3b389935b1cd972e3f83e961f939a02179f
-
SSDEEP
384:srlIcLVvjzQ/gc/BAZAncpXkf05LOXguLZ:7g/KUExLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000bba63b94c922aa37b9de10b507f363bd51531bf372075d70fa85808cf2ec61da000000000e8000000002000020000000432fe98c13f33912ac74676312f63e44e36b35af56c2e5b5354dc991f6bc08bd90000000534938a993bc7b1b61c987240f1efad8d36e65332ae590203cb7b506ad088cf3c75b5cea8290b73b994a9ab38b1d871fb87cdff9210ca40df8c986e1fb24f3c0408a639d3c857e50652eca901f47a91816000054b42096f861d20489a13980138ec09c50de229e88fbc13753c41ca39eee7af36206cfd80abe4247dbed5f0b5bf75dbdc51b8b1456df7488ce018dfaf040000000718ddf110589ac668d2887192ee0a2b2429db9042b576dc2c5b3cf8203560974da43cc829b0ad4d61d6766ea57ecc52275fd1b9aecfcb6d4176d117f8d948f31 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428477596" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000debae7e4a7b826f6a642bd21ff68696d2dd56bd5ab8cc7caea073afd710aa7a8000000000e8000000002000020000000d449fe0ac0b585486a21386f0163506859f8b21e80ff32f6cddcec51f9f4ed2e20000000742207f1cdf7f15701b950e136f1b698d5cb130ea73220b4aee09a5abca150da40000000e3adfee31a8080181447968a7b1a323a669e064ba0112879a49842dfe73a222ffed03070a21f961485b826db5dd2c6f71481c3194eae1e1980d73327af2ccf5f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF478611-4E30-11EF-BC5F-FE3EAF6E2A14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0eb0bd23de2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2332 1976 iexplore.exe 31 PID 1976 wrote to memory of 2332 1976 iexplore.exe 31 PID 1976 wrote to memory of 2332 1976 iexplore.exe 31 PID 1976 wrote to memory of 2332 1976 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7699f7457e5eb35c2bc908d3317345b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5314711efed5f96f4554dec3acb13e758
SHA177d241b942ad757e91dab0b84d7de0c1a6ed0866
SHA25641275167307efbc63b98a2f6994a851ec63f4e8803b33c13bdf5af2110565e2e
SHA512dda43898839b3b37788e0689fa8981bff6701b9ee4502c5cbea24dadfe172162f22d1eb2c73a3a9c2d81ba4682b5f9e89bb7232e09c72086a3dd2e5a5eb59873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0f748c06752efa4753d78b68bbf05f1
SHA11832fa31fbf0236337f1cfeeef47ad7fe3ded8ab
SHA256c421bd2fe33dbcb1c9758f7b637114aa1de5f676d56f585562d754a947e2bc61
SHA5126de718046d42be277d574b4e8505a9b610d9278f5c59039c01c4df107f933ebdceda76b47b4783325aa35fa31f7a480d9f203e35765c2b3fc1d9899b598ad7d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efa7f3736ac46f7513ce8a25fe125bab
SHA1c42af55eac17327420644df9558747451c92b494
SHA256eb126cb5a5ad516f72a43e0c97b73bf5dfd8e9ce01c7e098d78f9731556f9a0c
SHA51220533bca45105e07a5bf5b0a48fa9895f004a345e2be2cbe86238ee81ea08ffa3fba4a7a989ead7f73c7952ed989c058d526968d98da706bcbe6a19ab42825fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588c01d74f047215e001dc4a28520ed63
SHA18fa81f78d3910db4903cd65a56dbbc92eb4e460f
SHA256e444124a07930adf526676114adb79f671eacea3b99ef54e3d95c4af256d99aa
SHA5121e270b1c61749b6e96349011617ef93ae3d83b957405a83df8fa28601b14fabdc95fd24e57a9af8ec87cb289014dbfb1277de2bfbd006e156e65926a595fe782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c0cd1001c76a4d27b6671cd96d2865c
SHA1386e52f8f71f07652a445a4b6c6f8205bf3cd91a
SHA256082690276c90af7f246bd22ff8689e0179d962ce1a61dd5cc89e067e4b0be5bb
SHA512f8632b606087d6ddec16886ceb59037af4bc9abce55a42092c45b2d39ece5adde5cec37a566a72a8fa2e15a6986eb1db289ecd8dc79a6a11cc34648266f9f618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd9b14e88bcb67bde59cc8a2e414225d
SHA15560e67c0436bb3767f9f47e2a2be3393c76b099
SHA256574c7a958fd2f96d1953878335701facbfe160c43d71bb3308ed83430aee3de9
SHA51286ec6cacf2eb9d34c216fc3dcde949847d45dad0b9e7295007d514190f0782b7cf9de338cf652ce55d1fe42a13b9298d1662336fd9ad37dc75f9a7fbf3536565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5532aabc7dc2e8f51299fef3417c90890
SHA17b81cfcebc6732cf7b2938f9de428488897fd4c9
SHA256f55267711f403acf59f71abf580fc36f4d210a64f7b3cd942d2628c3ba33314c
SHA51292890972d0f998de665dad953402b685b7f4c09dca9b9ee85d851c5394032df3b35d7db67f3f3b217222dfb2472387e23e8ef8ce4342a2722288b5b07fe9849e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51343a14604e58c59cc50d7a114576657
SHA19a716033e7a0cf8fd250eec63fa4a4616f8f8a2b
SHA2563ab8a6dba953e8748446a53b7d328b0dbe0f08b9346b903cede5219da8b970a9
SHA51246f644b395b3a26ba18d9729781461cc71ea67822f2e8cc7d238f8c11ac7e99748a6e1bb4feb7a2a246cced3902a861d6403017c56b3269b8513558177c61f61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbdbdb318f489249db41e76777b3993c
SHA1ccbda07629655c7dfb296fbbccf5c7f198da1354
SHA25657800900945a43ea32f1431b425d948b8deafc64c81a4a2501138d036ae139b3
SHA51272dafe57031ad0b530cca6b43188d9801d3829b2d8ca2bbff9df88ea5440eeccd5f725e5d4711010c54e5044cd4fb97447192bc8178cf8fe9b245beda1269be6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5784c9ff8452f7f5528bb09640c0baa69
SHA1898cd41ac1cf7b6722dae777ac7f2b9ff05144a3
SHA25689359cb982970369dbe61e1d6eb5f9c053bb496bd9b034f1e8a5b5542597fb62
SHA5127200cd8f978901386170ae06e475a28de206301b6780c42015d43f12327b5eaefee1ebba9d3bf3071bb033d3ea7462a9b09d0716900f45191b2c286b8fa8663d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553a05dbf9c30607c0a1fe3188686dd61
SHA1970298cf44a13e8ea985bf27bc23e2bdcabadbcf
SHA25621616add46d9c6ce323e4a5ec43186a280aa87e86bbfa1550f541e1a39e68806
SHA512e7c46406fa9063c3a2f398b7c8e52c0b04aa81e73c825b8869a6a4c8e2669bf11f1f4c4c425ea11cb13fbc37ce2d0e848b1f9982b6b2fababaaf7e17a1401ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc5965de46600bc6edb4351a93eb82c7
SHA19b7340d634387c2067eedb3fc9f820ea98cea23c
SHA256bcbce8a3fdf2ab30956883dded293f08c2a3208c1064e28547dfb613632ec720
SHA512d67257bdbea7558a2a74b03462a7121def99724b15b34921bce9d04990c8226d9e495232ade6a58d941038fbec01703678ec5ec006a4484f5b95b075211d11f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0ae83df19388f7eb53c0f919a35c94b
SHA18046868c3fbb27bac30fe6af6b31bb1646973098
SHA256168828ac8b9b8f98b687a55fc1560f13da41d1d1e663125220be631adf402560
SHA512f48c288bfd8e80a1619de0be21869e87b74af7c684ef537a35fc66d021d07bbe4885800d66530e597cd2abf0ab3cf930bfc465035522f4a4ab8dbd99f858cf9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d833b4a1a9c05079c0880ec262e70c4
SHA1379eb144dacf5fec53b00b446dea3308044fffe6
SHA2566b4e4b6bcfa741a4cf1a63da288284818ade758da33bb54961a45579d97f3b55
SHA512b55ef88570d8daf4b55bd245de0ca4b185518e2171a358912ff438227fabb9690b72e654f3d1b082b5f4d9f55019425a2b11cf9e792c8fe1fbc06a1d61bfcb2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528b20846b9b8e1c19adf94ecfdb6c2c8
SHA1c42eaeb4c79663289467b44e7a05302efc5c1603
SHA256f3073ad5e90ee7cd9fccbcb059e7ed7338eb3cbdc511c9270e243df27e0cf9e5
SHA512935035c27a47e1e3249869696a654e060adbddb5954e207e9f003de8cb28acd8853abe01b15e66272c289a21d9f00085526e1e12ab32f945273e01472dac66e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e802d47758b0d3fc448537e36996e8e3
SHA18473faa766a793e2fbdc7e3a871d4e5ddce9dc05
SHA2569e91c5b1553e0eb76362cf9896342d62ec8be4914af8f82de5b57da90eac5462
SHA512f70f795d680032de9bb850ac93b24fe6005a0d5e5abe8a9980de95e58cf752f8a6c707fba67b5026462238915187daab26322dab138ddb117893697c0b928723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5249041058879d4583159cbafba22cf18
SHA11395e6cd8ba181fbac0a02ed7c067b2fa62106da
SHA2561a3808d9c360c6efd0eece0025cf1c7c019c15b9e3bb1d366f80f458aaa17b17
SHA5129b76f9bd67757c3749625042d80af54ed419623c5d340c2778745854c59c08ed1e5f60e9b332a28a0f36479188c61bd755d2651c1aa8fd8ceea7dd82ffd9d1e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d573885dc0a2dff82239849ba8cc675
SHA19e5334081992a98fb82933b14980a7ac0d36427b
SHA2560fcae38d6bd19e8e57984713e0d847a7d696e92668d003fb95612404bfc55467
SHA5126c6b1ca912a8dc857a19aad23f2fc66ce31037052684ea5d26bd57705a191bf31dfc5c41b44bab709840843f765e7b479e5b865134ca5ff11ebc5097670014c7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b