Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
843ab4bf21d9649760e46918c646e2a4_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
843ab4bf21d9649760e46918c646e2a4_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
843ab4bf21d9649760e46918c646e2a4_JaffaCakes118.html
-
Size
1KB
-
MD5
843ab4bf21d9649760e46918c646e2a4
-
SHA1
e435e7471c78e0d2ff85ff96972ac3570dc87b7a
-
SHA256
e2e2b055d41bdfe5f84548e8eb9abdaba37083ad22acff4f6d5ee7ba0d9f14dc
-
SHA512
861829e65a4fa3012660ac2f1e6cb3f57b9bbcee2f2a782d2f8bbe2ac11c02481feab91c75baea6756d54bf365040a678d0ca9452ffb6eb3d17be94e72f8b834
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB7BA941-56B3-11EF-988C-4E66A3E0FBF8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fb76bec0eada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429413463" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000725c95ffd7d5d4270e893ff747d83ad80eaa71a7810b63aac4f8533f16916fa1000000000e80000000020000200000009cd09e85cea8314c2a6ec81185d62d1ef70107e484a54bfba37335c72b25e2512000000033b2d3d01404eb502f817f36e55bf1617a609da3cb2d67c82013a68889ca0f13400000007c3438874fad964886b20b117026a1fdf57210c33d58b6332b69f8a1a9b6307be60ce85c172eca8fd9d877b2bbe12c51238d21937e3f56570b4a22fd5efd14f3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e2f77deaa6350f2edb4c749ff283dcf9b330b7d9bbe0df9cfb9f1584dee13be4000000000e800000000200002000000021c49aa0dfdfe6b1e487ab90d8032c290deae2793a2ec14e2a599dde4b788be8900000008d264e4c8073b74ffb1b2c63bb05d3ea1bc7ec326b9a7a6532da561f4ef84935be8d35ca460c192cf97e005e1f85469e65299bd9b9b1dea1b4a99670954216ceaa7594641deec44a950d4950211ffd909befb4033afb8cd3d9ed5461ef1305e4a5b127097932cc735a8494ba66de041a4781346052bd7c3f6aec26d6e57f00dab07140bcc272fd1fa884e3eaaeb58ee1400000005753b2a635aeeb4f2fb822c58e59750c0da0e93aade04b0d3dd95e399c482b1b2d68489ffdbbdd99c0ddfc6a0bbf8512c81a1084ce9c5534ad105bd9f0dd05a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3060 iexplore.exe 3060 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2688 3060 iexplore.exe 30 PID 3060 wrote to memory of 2688 3060 iexplore.exe 30 PID 3060 wrote to memory of 2688 3060 iexplore.exe 30 PID 3060 wrote to memory of 2688 3060 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\843ab4bf21d9649760e46918c646e2a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aae071d4cd31c3d7187c0141977262e0
SHA162f42bc3b1a0919720d79b38e9cb7df6944ad19a
SHA25678d14bd5fb4917965dc6cc1bcb1a78c3c42444457a726367ae9e3ca67962a4b3
SHA512f95bea39b45846fc60d99ef45f33e73587c41b2bee8bf17ee5f0a5a54c03499b766116d92c5af9dbe34d5e67a5530ea26da035d7f4d1efb44a35ae0963086e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5115d60106ef5a8cf47a33e6a1c42ce98
SHA1cb39a5a3e724ad47bf63434bcae13acef2fc82d6
SHA25647713558a707c86aa585d9cf8945b9a0a3747930c20fc393d7da13442b7e47bd
SHA512a0ef2122e2183bd64446a845432b0ffa199c66666555c43b71501a92d34f4a7221ff059000e659c65ea4ec01c624a35a94e0ffbe56931e67e19b4a282fcf7b67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c96ba594af8a3bbddeb6d04dd3026717
SHA1eab637df662c0af00b610e4fa0a46d7da0420b7d
SHA25679006a7faa98a420840689c69fed6a3557611f8073aee243723a21bee99a0383
SHA512a44d157f6bc6f5ac2a2bdd0058a5d1c00d3e3428a15c43d1d2015ad098b27a94f853ea19848cf3ff9c3ca03c9550bf6a1adf27d1d0ecedb75c157a554066b615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53317b4038251362abef12c47d21929ea
SHA123a1e030e27a936ec27007d9bab2a3b785b1fe07
SHA256fc0365b7028bc0ad47e8f9f3c742cad9042c993d231ff98eb1d1aaf8c656e9e0
SHA512390a0d87388a6bab3ac18ca6b51e1c4717b5a00f82bbb16d1ceb770f3afea37b4eae374884f2d54cdba3c0e470f4ff71d2c123c7e9263f6e4b1fac279612d50b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce4a8050db28bcf27484be410bd4ad7f
SHA17cc75355bb217da38499d44193f92204643996f8
SHA25637d5e7b161aafd344604d88f6a43032bf5adc6183f5b43e33cbb1be91db78691
SHA512ccc8c78aed02005a73d38a202626b43ecde505532a29476349849cba8f2f148c313720dfcce8865cdf72091e634d7e797af8fc8b4f0a1e05e83028af51c5c8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593ac9584a631b8318ff80a4a8e1019a7
SHA1de0afe1d72a4f35f7c3ffd819972d767ec474d8d
SHA256fe476933724694ab1e0cd891808827a997f50faa3a50ea0592aebc892940b6e4
SHA5120e1b1254cbe05d8cdc0505130d75e8b5c19aa31b84f5086304f504dae49ad2f88a7fcce62251a40d5b6a35f08c590d90c53b3134f5de6df1380ee08a92207f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58274961988e0675d6b11824e912c2e6a
SHA1d6038bab166456e2fae4c40f03835b4cc703c090
SHA2561832b2605d99ae469b409820d74a2ea3f4b63118905c1d4b927bb61bd018b3bb
SHA512190ed3bfb5f9e55ed1bdd7498cfe21374f8de43f7345e30a8fe9fdc434f4802d6231ca1ac548240017955d0d00b2ec962f1cbd6970dd00b74bf72d76f1da300d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50be8a22a75985523fb44aceb6940bbf4
SHA119f47b36ea41959c401e4dba00a3841049081bbf
SHA2560564431263cc143e984b6017ce638d98c977b68ddc862e334555eddb6b6b4150
SHA512a1a49a98c85252f2c4ea9b226e225f08cab96639412d57a00ce31d2acfac9228a84611c5658a032dc5d16a795408bf63480e24051a87be910c1f36e58a42830b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4ebfc9b9278ecb72d986e6181c57b4d
SHA10a8ce988c4677fd03b7879fa449b0796e10a6142
SHA2569cf5b7f6b5ac16637671d491bb377920a12b26c029f5d27d10754ff1d244f2a5
SHA512b4ba09b77f3be50557d25f25334927db575264ca12244560fef2054337cd5b79712c45dc672579be731aa051bf01f2260d7d0705429efef1a6dec6eb08868c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d67fe721c5536aca0d51cd1362fdcb81
SHA1e681a12bd2b72bcd7a8c627b30938df6b3efefff
SHA2567d59004cf3619dc8f4e349585454fa5a1433e8f1e82fb31c9d89aff5a5c9efdb
SHA51261bb31194a7e69ad74a28dc357f19471f8270c3d970d70782af5157652b6b9c19cf599d6bdeb54363e5338c5198048047085a91d3025718774017cc0fab09993
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56577b6ca0a3f01b4293d901488c3012d
SHA189322f9c6698f42f064e05b54f1edecfe133407b
SHA256387954e0e48cc88f3f374592571a79c707f2bf761f279cc27ae6c710c4117134
SHA512f3d74ceb5427810fa0db2b73fb8d5dcb3cf36ef0e22a6f0aa72e98263bc42dbe91c01aa713456382c7a08d7194853644ee162934d47472dfa43680ff7e1cce79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abad90e87635c8db86ede1c14d7d762e
SHA13b48fb96776ad6da818b64ac1f0d0ffc6cf4ad3e
SHA25692cf9d7d8bec1e318ab4b3095e54833abd00afc377bc3b4fe960a6d2ef76e238
SHA5124ae9d26c4ca5986fc21fb6d43c4faae8993b9e0508af119604511556ca3af34f41451bceded782ea0c6821fabafb3bf6e40ed08c83ea3bb10b2dcc6a51f3c15f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\sale_form[1].js
Filesize761B
MD564f809e06446647e192fce8d1ec34e09
SHA15b7ced07da42e205067afa88615317a277a4a82c
SHA256f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3
SHA5125f61bbe241f6b8636a487e6601f08a48bffd62549291db83c1f05f90d26751841db43357d7fe500ffba1bc19a8ab63c6d4767ba901c7eded5d65a1b443b1dd78
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b