Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
83dcfe8bf963ac7cd2b05cc9cc95138b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
83dcfe8bf963ac7cd2b05cc9cc95138b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
83dcfe8bf963ac7cd2b05cc9cc95138b_JaffaCakes118.html
-
Size
53KB
-
MD5
83dcfe8bf963ac7cd2b05cc9cc95138b
-
SHA1
361d0404623c1f4d92d0d9e0b8cc812d518d4753
-
SHA256
9368d998de898b81c520297ac888275a03d35cf7f1841a8d07a6fc4e79bb6886
-
SHA512
e0fc581ced2f528777dfac971593014a601a3b7546d4b0ac86e767e18f53451ecf3d8ece25597300c6e385ed43a443424b16db6426250d3850260087643eebe9
-
SSDEEP
1536:CkgUiIakTqGivi+PyUErunlY363Nj+q5Vy0R0w2AzTICbbXoE/t9M/dNwIUTDmD0:CkgUiIakTqGivi+PyUErunlY363Nj+qT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b6b990aeeada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429405679" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000da6247cee06f1a608b0923fdb493d5cb113d6d9e67b3583a6bd957f230d345a4000000000e80000000020000200000008e6d6f84c24ecc6ada6d8db0e24224772b9afc4844cf2a9734fdd118a927a18620000000d2e6c0843d324ae96fafabeb3503d3dec558448ad616519d1197adc77f1f47d2400000007b23e9597d28163eaa79e3b171c73b341fb3a22f9ec8118050da32719d81bee139727311aa89eaef9efe9216b28b1f11791b3a0f16f95e124a0b5898f47388da iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000007b9c45e69c71908e3e53c7a05398be01dcd9ebbc88b7da50f9292908c666341000000000e800000000200002000000016210361365f5dd97875897135406896458c95da48397d4d128ae28a68a73861900000008e2bcee81391feb29f01701fe9a7b6f4cea1484de67c656050e665a1bd70e25e369c2afcd9f5bc682639b64f6ab814be03a72de957244bc0b5dbd8b315d362e1429c1b6234583d2fcd7afec867961a8b424048ce885616e1a6b3b01cecbed608072c7d977ab1b0ebb3055e4f58cba1c8423762ee28dadf5b28ebace35230a34de1225355a22455663f933a4e5f5975df4000000023aa289aa0243cf933400f2f4b9a656003e30699592f822feb78b61f311a6aebe27ab41094d4bb428db855db22575807ab5806712a285723a7c59afc1a1d72ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA9253D1-56A1-11EF-BD32-F6C828CC4EA3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1356 iexplore.exe 1356 iexplore.exe 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1356 wrote to memory of 1276 1356 iexplore.exe 30 PID 1356 wrote to memory of 1276 1356 iexplore.exe 30 PID 1356 wrote to memory of 1276 1356 iexplore.exe 30 PID 1356 wrote to memory of 1276 1356 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83dcfe8bf963ac7cd2b05cc9cc95138b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f012f9560e60702dcbb41ef64c19c1e2
SHA143695f1dc4c7941580a128597b4776afabb3ea97
SHA256e4d483a595b188edb5ffdddd3498964e83724be7e86946e0145a59e9a78d6db2
SHA5125b3735cb7b8b15a0c253028fe314ecafa037ef40d7f052d1fa8c9954ecd08f74b663f49652e4697a76283d5aa1b948f0f202b3a4831c5fda03c2b757d39e5c85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af57d3224f616953da6081d5d655ae43
SHA1e03b74648e54d14283d621121f9ae4df7e724ebd
SHA25631bf0e7f334c37de6697ee78c4a8ada612f70ce693872feb9922f5198f2cf857
SHA512281278a4953aafd67215c610aec5ed92ac589daa1a5ba72f279005f7283527e1b42356a921a2c6c6a82dece28118f09d288eded21f04ab6bbc845229762e7be6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5187fd19f64552edf2d8261e7bfea8fc7
SHA1b7d416b6933f5736f077ab33af7f54a03da8baf2
SHA256ee2713b017c445c61c4bbbfa82c390b8e472ef44ae4af056e89108c82dc95243
SHA512f3483ada38637cfa894c281195608ca967008a36d1415885470d72b0e1cc5d25b4291d00d4df11a12c796c53dbac7218eabc79db0ed73bf46829ab27b92a5c22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508b0a901d9541602352dd5e6f40e1d6e
SHA161f0ba5823e15ef83604e475721efbecf6a34e91
SHA25698af02a1b5037fff818d249e37e97395fb5b3c52c70674ded4d7c66194b4f8e6
SHA5123c23f9b31448c7efe86a3377ee2db398b745716eee7fb2fb9af7785ba7e2666041b1635daade75fe4064c603aa8b7f5eef782e2ccc64512196c52bfd1f18f684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ab4c8fb97e28c049f98753227421669
SHA1bc079bfbd9eec9f015b6e7f666b26ea5233a3945
SHA2568a8ccb3457d093afec6a84c19147898a91a8e83b25bdc507a074821deeefbea9
SHA51299ccbace1c5289bc92de5fa02ee0f3434b1beb6d341c8c35c2412f8117922c059ed81c67cdad21aa8e589a32bc32e185052b01944578ce411cc9f4994f9b7a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517ea589e0c7fe98e3f65b020b5e42c8f
SHA1ebb4ca518a4ad9f17bdd014421f6b2fa5a47e337
SHA2561de2003f1a99d3b90ddd6ab9eef05e6bc85cee0a04b2bfecc0fbca3aa98dead7
SHA512342dbe69b1e6d5e10c8050bce98eed0fe8c78737475a7cd582df8f883e2fe47d5c5bbd29718b8e7216953f50e937c8b5fc0c40fffad39e0d48f9a8b3985e6404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5104b8a09684a224321a75f096d015656
SHA12263a151d8b161981387e56c379af31887a3c4b9
SHA256ed95dc75906fb57009efb14d39dad5cd4cf8382705be00a0dacf796c2a87ca81
SHA512bae29fbda2241643945a7d66b268ac57a613a0ad5094f2d284191f072023f2e6ba782c749a405a76972c67dbc88e191d77b50c92450df0b2d31e29dd9125516c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564d9a7d2d07366dca6878c470e3d83be
SHA1cc528f5ec0d734664efcaac5ee579180f8eaa56f
SHA256952e0eb85140267f0afffb883c1aee98bc4ff995384bc121d238afe728549a13
SHA512f431b8169bc264b296cd319c539ae811120a57bb451247952c1013ac5807667c4dfd049b3a20745a85c88c3c1ac89b0899744aaaf53acb89782866376d4537fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db8c281d930c2efdc9ab3633387b634b
SHA18125007175eda0dd2a7d4bf6ccbc10d93e2966c3
SHA256f135464095fc19f9390535d539879fa34660092caa7c6f2cd15769414ac0ee72
SHA512fdd516f36a49a6f5006bf7283f1d26b36fb84f974b73273fc26913eb52747b5aef044780325d518a4a91a998e0d7d0b8cf8a7e4bd6650b6af2a3026feada11a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59eafe13d46790a1666073ff0c345ef58
SHA1e68ff13d9d85f48b407e5d6b276efdbbd73b12e0
SHA256740e4428ef92704005368f380be0ed86fdec3284c4a6bcbc07381afed9e85e76
SHA51244c161b8451c347fbe188abc5ff992ef842c4a4dd4a429becc4fc1d2011dbe962707b58eaf3c0967ef0ed289c2cfc551ffc6e435f5a4e8dc8731301ff31011df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578ec6459b2df499689d87ebedc41099f
SHA1f7e51ae26c68231472ba2b26edf67df9ef7174b5
SHA2565b8662a6251e0690219a547a144dd5035ee7da051585a90727a25e1a94d5c2b6
SHA512ab9c1e5d248661187979cd72db458d0a9e0fdc837277c91b4da81916040286b617cf1339951f8cb7b87d6ed17a6ddcfdc59f2620cd69925100839238fd7cd11d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6345f77e8f3c3d1dfe49f9ce32a474c
SHA1a0e3c941626b09ca62b895e9b809f9be3639817a
SHA2564c16772deea35e4fddc903dd09f1dd06d333117ca3d230bb54560753c03fd7a6
SHA51262705aeb9dac5c34b8427011f481d71d8ff6e7466c9917fa9ed51124650063644212d160b0e9ea75dc15089fecab47d6ec85e8dd86fd665dd32185d4038f13d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593cf78f5d12624434d76530b97afa659
SHA175378ff56a7d4ec54c2cdf0d5522dcf60486cf99
SHA2568599bc08f30f97f3d42ef587cb3f217d79208ea06f1abc05fb3f7d5aba258dcc
SHA512f48444e87784d6e266552c02005d6d591557daeefd6e6eef5ae96ecf8255655f989a49ea71de7ec03e267f8562f3e96376cfdaaa08da400a7076dde81c198db2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e485c1e431f10e9de2d0fee6bbf09a3
SHA11615af3f7825be46c9c61ec10f2bdf78f2cd6713
SHA256f6b87c0fc7a42ffecc7de3abcbc7cd647826a7db11cfeaaf29539fad9e1f769d
SHA512f8dadcdfc498223652b52c3b1cd19943e15b00e130c1a077d724a7437f91c2fccc8f5fdf4442ef4e4ab2230859affd3ea0a534002715f78f2158168ffddb7ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551b83053e8c1c9713f13cee94f45937f
SHA1345cfc27d831808851c3a3ce8eba3de5ae2e0e13
SHA256b38c707b378392600622075e9f62e6cd8fb60d5575ce3f9ea93fec5a8b3290a5
SHA51257afec14a79f94ddc6036cf66b8408f7529100d1b4dbfa6c2bd048fb55249dbf2f4aa4eae373e2af996a591b4dbc0c95b04a7d6fc5d17abb3d9b887d166ca574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa438e01409b8701136bf251de66151a
SHA1d7e6df794dee42f124d1bc27ce2e741e1d95fd77
SHA25640ca9d430c5435c4dd3dda9673773820c6d3d6ae676d7223d7c3d134415b8178
SHA512f4f7cc24fc0f4f795d38555bc48299d60a0ec93759f56d00262e9fce29b4aa2429afd02474e66f1ca9ade302a32b621627be0d458b2d9bfcd02c1b772f4449ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1713589e826b986f7f32e2ed0f1a0cd
SHA1ffebe2578cdd6d552802710cdbe441570f077f32
SHA256708c554e831bca69dcae6a42e4c306ed07b7f7f821ccdb2f1908639e20e6f289
SHA5120163436d0648be534aa096eeb51a81f0246d3388eae562ae17ad40302ddbd4c1657c79d6cb60360e2856ea820333793b23500de30993db1090ea1dd9067b2524
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\glossar-js[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b