Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
82bd12253b9c2766c7f31ffc72e18f77_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
82bd12253b9c2766c7f31ffc72e18f77_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
82bd12253b9c2766c7f31ffc72e18f77_JaffaCakes118.html
-
Size
127KB
-
MD5
82bd12253b9c2766c7f31ffc72e18f77
-
SHA1
2a874cf0dce5ac19957746ccf31f6fa84d6860da
-
SHA256
455a45539fddbfdeda7238cbb2c656619275ed3e5c076325b160cdf465c8caf8
-
SHA512
1062ea3a63b69c15f10b01c94ba688370a3bb6263bc6b035cc4ce6b5ba68f25335879a9101b0227f7450b5f91b5adc4f302590e22841209517fbe231368541f5
-
SSDEEP
3072:Sv2ks9Wu3WsantyfkMY+BES09JXAnyrZalI+YQ:Seks9Wu3Wsan4sMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B01FA441-5078-11EF-88E0-C2CBA339777F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428728343" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 3032 2336 iexplore.exe 30 PID 2336 wrote to memory of 3032 2336 iexplore.exe 30 PID 2336 wrote to memory of 3032 2336 iexplore.exe 30 PID 2336 wrote to memory of 3032 2336 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82bd12253b9c2766c7f31ffc72e18f77_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5409658e0d2c892ebef3a0a5c13da48d0
SHA1dbaeb7d2c791cb8288beafb81811a37305a28cf9
SHA2560851526046e2fb27ad0ce3ef43db53d359dc6b1836e6934f5f36db383e8215d8
SHA5123fcc99070609c878b7b69ffcd976915298926bff987b3fa0c0b7129f62b3f9097a4d0951c490c22789e6b3375a85a8a1a45a8785c0b486aa0836c3e83b597170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f99972105a372543283905256d9d82f
SHA1aa0cd3eb2a22bff8f399619060485c48b4b55ddb
SHA2566b7c61aaf7c723e026e3aed4a91869f525211a7380c5a171bd8609c667da9852
SHA512938535392369a98be99165c102f4eb4917c1fe3eed2160d313c9ad6fe8e96367ee3d18ef2fe22ece0de5917de8383606d40a6681db5c0751667d89552bd0d02a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595ad6c473801907081b012841f63eceb
SHA13c2857213233b38150e1553a2b4921a4bf85d159
SHA2564420e4ae822187aadff42e9e075bd68b83300a3396aa7e2f675ee8f59e3a4be4
SHA51296b72149afb80e7012f8813e0892b243cc35427903b567be43c70776ddf386f254a59f7296f9a5a94730b3032d85dd1c30d10472964e344397af8ec694d729a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d721022ec73495838b086ce7daa56d
SHA13750f3e1c536f155ecd33c01a41494b5b3e19d65
SHA256a01da9b41e78eec52117774a352c008cdd5b022eb2c681e5deb53a2ca2ee7ac5
SHA5129fcdad47b7fb49b3072f458a54c4d2ec34a620c844518ed93480795743578d77173c8a923930c87e205ea13d2f192e01ec462fc3f072ea2a693df7347351b054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dddca3988cd2a147048d643357f1a6e6
SHA1b50d1588dc78739164f0fa2c3e823630f7da9f4d
SHA256a33b17193c1f18f93c5850d2ed7a295fe4a162ffed2ac5013c911f554ad64429
SHA512d3d65b002969d1d099dfb9abd1763dc56d84111c29559c486250167bf6abead8d0eb3a8a20a758cb805582d953af3e28e7a8401dae55c7b080c43d46af75c7e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7fc976d3054bc65d8082e07a7dc6a9c
SHA10c72fef87fbb08ea310cecb5a73c1557ed7b8950
SHA2564abceb883e3434fd5897b4f7b0f078917bdd61f79cc299c9260939af4b26d5f8
SHA51299f8bed8633b1764b61cfa6e288e959e0d69b05bbd8263a066bcab0c91de8109912e2f1f8740960b70baa2780eaffaeb20b48c42bb35dc486d7451c829b073d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8db64ca5081f911ba257b4c29c9c0f7
SHA1b553c220ddbcdd05e78b09d268731ee3759e1fce
SHA256e07be9dd0eeb34837df802ea213d79af34f0a4aa31921fc3219dcc1e4bccfedf
SHA51290b5f0025c6db890d0e6b6023a8c8143d15ba1f9dbfb8c53fc56f9d19da258ffde599bfb4f717d69e8bc6e16f4a0ba8103d300e3976f449efa381caffb86fc64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be7641abecf0aeb3c30295a998a42cf3
SHA1b02dfd0fbadfe9fef2e07357cf0ab176a9d1123c
SHA2569168bd1e93a3c7fbc42bc2ea1af74da85884d2291994e9b1e18536599ed76f6d
SHA5125dae04b10e2b4e2c867cbe1814e0c2ad89adc8a8ae048d6806cca46ca0396b1eb74f3396a1c626de47cb3cf7a91ac62c48c9b0c185022658bdd769ef98bd5581
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57509c08ccca0bc1c13a3a358063ef881
SHA1a9bb3ff1629617879ecffe4395a55357ed94437a
SHA256b887a7b09e6081c1fee56d3138ecc6e7caa1805245e43c58647779138d62fc9c
SHA51233a0e5c8eb34d51e0b54bbe77e0079bd1de0460788a797cc72a9f12e8bc9826708a2c4e647649911506792a07f6ad56456ffcd093e61e992498ce0d9246b67ae
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b