Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
87e1c860e6e22f664a7de4779507ec8c_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
87e1c860e6e22f664a7de4779507ec8c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
87e1c860e6e22f664a7de4779507ec8c_JaffaCakes118.html
-
Size
57KB
-
MD5
87e1c860e6e22f664a7de4779507ec8c
-
SHA1
8bb140f54cc9f1776a533ddbb48d15c57d0cf975
-
SHA256
13e3f499d60e766ce251d1ad9bc106f73acdfc52373ad0be4bf00044a66513f3
-
SHA512
c617a359c40e8685bff5ba590a0a7cbda94eb2ab4b111781e7adedecb771f90a3591d908ea9ae3c05e6572a0ebde7924e95e5bb722a800605184101e8284c620
-
SSDEEP
384:YGPfl/7ZQu6tkzXiE+TJ4/LNfNgHXAEnWYEzJqBFrgscs8POAnJzw:PPfBamXiE+TG/LNfNGmn8PgYWVw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6A1C8F1-5765-11EF-A372-5E92D6109A20} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d265e772ebda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000070a420fc07d18e68ffc173e17ec4e791f893c071e9ad18d36a265ea248ddc48f000000000e80000000020000200000003d095ba24d8a91638e45862b54c6ab0428f04aa4372f3d63d186ca2ef8ba205d90000000cc43fcb05d153e14ab84f570f87b53a8fa1563af97829135d0f2b87c099ab54f0dc36a5e3fcf770534fdea45d4065c06b474336618459fb2ffec03c7f1d94c7d210e3c00473c7cf88e5e5df6c903082a9bcb1686ca4bd9a70f2b159ab9ad2f2466f358f9fa3e022388cf73e1877d46fd21f413df7ebd6851894b09bf1503358e7b910025b7ad1a47a1cc46bfdfbb8547400000003c3c1d44aa26ad187da9d56e894d279a2fca8e4d702796f1c4acf1f4ed2fd69dd1efa1a7a23ad4572e89b9d1d20c0bc270811db3151ba34972f08a4e422cc56e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000dae9f597d06693e47316ba066fcbb26cccd11a9ffad91aea5dacb66ed80b702c000000000e8000000002000020000000557eac5c97818d116a9d5c255ccfc4cfb6b1cafc753312cca8270156131c805b20000000dec52dd6b25fd6c1e8105c0c0f86db9677921993f33f73f28cdb72299fb2e9aa40000000d91b2d52401154e0b69badae7ba9a7dd130cbc99221db88a3a748029597d94c5abc17aff39d3db8fb4d55753b34d4470fc1312404c325e7cd929d0a3b0b340ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429489973" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2100 2988 iexplore.exe 30 PID 2988 wrote to memory of 2100 2988 iexplore.exe 30 PID 2988 wrote to memory of 2100 2988 iexplore.exe 30 PID 2988 wrote to memory of 2100 2988 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87e1c860e6e22f664a7de4779507ec8c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583965f7036df60ae37f0a5316b98d6f1
SHA1dbbdd483dafe25b67d10fa4acecab5497bc09f17
SHA2569022310591a23e2692592407df571e1a64e3a1429675a77560837b53874ca0f5
SHA5123370571ef8673ecd1c69ccf969ffe62e06b56caf023f1ed5914c2e4f19707f0ffb739c4bb67bf0718181426359f77a9b7a9d0bd738850bafacdbb2ed218a3125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b110ca065dad4de34ab7adf22b07522a
SHA1048e53cdb91c4a0eb444737e6e3f47bdf007cc5c
SHA256eb13d42264dac505bfb7817f382cefe31e651cb8140fef0a6f2c718b1c503447
SHA51278e25287ed49497dcc909c32d3fc76484b1f9d8a2f8fe74e5b5e8715651478f7c92bd599501bb975aa8d855ca1a270a4e9dececa857c836f1c1c67613d73688f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff739c07440168de4a98fe9def87523d
SHA124cec8befdc96ac29d472b9cbc0ee7cdb4031b9c
SHA256dfcc5aa252775da6047ca27b1599148c6ad3b4b425d33868b740a659bc1c6d3b
SHA512d5c8f8064510894fa4ffff1f80557974bf6dae3304514eb20e9e74cd4f394c9589e1c271804373ef0e86f5de9298a06b010b9b605732cc61a4065371603728c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5071ee01eb8b8092163332cc3c608d197
SHA1da2104d4c613dcee1ea9104a7c36022f67b45072
SHA25681c6edb3c54dd264eace9c65441d4ddc48f2e26edb8943fce00bfb03a617bf15
SHA512acdeb22afc90ca8c766d1d97f5f8fe7fa32ec460677e71ab6c378a9fd5014c76ad0552a1422c0093baa8c9d43e47a555d5a6247d2017a05ec07b40b3ec360588
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503305983db175f266af22472682f8e30
SHA123a139be1f2a6672d587f6c5894e54d5eb078a58
SHA256fd7e03e1bbf542bd21c7b7e1452b65f8cd7580a9e65ae4d3bb41df30774095f5
SHA512bd40a0986998d4bfd3183c4e9dadef6198abc544e660c1d987a114e0c46f3fa8e70a433d20dbd87ff8d94a6efd69f6d32de62a0e2785bb980efa82ab531da7c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52155384b17c651627179a69b60e9fab6
SHA194bc85821f4cc6909b525074b67be838cae17b0a
SHA256211deb97012f14e56e1efa84e3241ac3f623a3c7f386763ded8fd47d37a0192a
SHA5127cc82ba533480029e850554283562d761e9e91eee6deb4aaaa1418e220cf5c78c218270525ae6dacf9bf4bc80f2fe473731e228c027bf76a72b01796a2dc1527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc6bf5b2caf7a372eacdb4471acd1b11
SHA1f816e644865e3673e4e867ed7acb431f40ac4cba
SHA25663f9c74a22c6aef3a191db8f91427ec0556652c12dbbad104b2fe74404eb6c4b
SHA51242c535f2e03ce02ba48314e9db387d0af28946566cb0d7d42517c7959143617c3255706991af5f728dc7f90be5dd89eb475377599c6a4b0fa5eee13873ad16e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b071a53ea5fbae8f75e6e2e6253aa016
SHA1c21ea99449fa5a15afa47cdf8cebd50a07e89cc8
SHA256c23dd858b238fc7268a6f20e36ad78ae68cd7f1a12ee55121bd103181f41e88c
SHA512fc0da81fd06b8be111f1a3ffdc3aa2f531b84504cb1888dbffbc3f4ceb1ffaf107e6969904d6dda3833350e02c2dcc91817879f3bbfcb6a202e178d0c3bde45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57886e06dc68d2b695bb91425cd15f2ef
SHA1f31e3dc6faac96039d97e37008ce09687c6ec73b
SHA256d2ca22c5089b3edb5e05b60506da9f333e1eac30af711ae0213fcbc9b5a88932
SHA5126b0a251b8c8bdf52492cce978fde2df7f066593dc0e002cbd5e913300477c604c06490e27e764cb35a89ec30e08c859518606f8690a12c52cc68f4eb2ec0b5b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b0b7fd10599438b1407c4ffc7236411
SHA13ac6fd884dd8e652f22a328c828b08c87ae77d98
SHA256e8ab2b8071dcbc7591782a33595c00bc0896a7c34d97a231ddb35a100431a4d8
SHA512c4f7b88d26f5ca19e033446488812a7d85f9e53cc94c35e17f2b87da0715273a8ad1a9b2c2c8d4129c1f2b1ee23b1f0e57c0dd5bb6ab9dc25eba48567dd73328
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b