Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
894350f635336eb683985d07bf96fe8a_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
894350f635336eb683985d07bf96fe8a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
894350f635336eb683985d07bf96fe8a_JaffaCakes118.html
-
Size
21KB
-
MD5
894350f635336eb683985d07bf96fe8a
-
SHA1
a564df51b95edf5bd341e6e826a220965b4e6266
-
SHA256
c9fb5e57443cdca43fbadd04dd2345cac4d2a66c5996fa6f530386939cfffbc5
-
SHA512
28db4be0e230509f03bc51d24dd03fae75ca1e766dcdd4ae746a6c211b15890150fe0db541ab90b849e905b77dd6904792f570c2d7bf08777f6be350e9c85d51
-
SSDEEP
384:J2XZXwX9uOJXZKh58+J4JBJtnBVkYe3L61Ha+aXQyhyYFPHR:AXZ5OJXZKDi/kT3e1aXfoc5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000127d2ed1346ead42c8c9c176b767d835a5662be06434cddebd31a4b5cd05884b000000000e8000000002000020000000012e71ff04bb9fe3f4914ed25f3b137568570e12112362895ad219ac6c6e5f1a90000000292d51d788c8b159510e7b8ae7d6f35ec961372069c3942c83dd868a3d7e5a0e4ab86645501c9e2b9f69a4a3e4d658a560598a22f52d617c048db4a2b759762772c77b8a5a4f63ab232b3613e3343c94e4d713e5bfaca3b87875a9bd7f0aab072949499fc2b8e9a77f3f41f52713a3161210ab9318a9b8d871e7c778615183f44b5bca3823cd1ab2edafe2bf1343d6ad400000005e0f42e49f76429805369d979e66488214aad5cb157592c0b097fd5c85464dfbab5a3c8ab0955d6ce7dbdb974bcbfc0937730c2f73fb4e1016b0228fb4fc63d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000dad3cd66854da0aff0b53824fde0f0f353da4a163f7b2e675afc66078a337b67000000000e800000000200002000000045ccb24a8fcf3c8dfa6dcfd29ac65384c1bf958e0bcf895dc771f7d3f19aa41420000000926db5ed5122a186813cfa86b82473e2c7e6d700c20c2b89850063cb5fc17fa3400000007072353616ddb7c75ea19b6060803ff59cc7a995a99f7715466f7623f6772ae15c612a60cf9b83d036d0f4b832ac82ca8c5b1d301bd590c4a76bb8a058b0c7b6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429517890" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03a14c2b3ebda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED8DCE81-57A6-11EF-8340-72D30ED4C808} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2340 iexplore.exe 2340 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2180 2340 iexplore.exe 31 PID 2340 wrote to memory of 2180 2340 iexplore.exe 31 PID 2340 wrote to memory of 2180 2340 iexplore.exe 31 PID 2340 wrote to memory of 2180 2340 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\894350f635336eb683985d07bf96fe8a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59174f9ea217758d55ac4cb6218871f2d
SHA1bd174c458473fb568dfd886dadf3abd3a700f5cb
SHA2565e7251bea25a010f79482cf6a48cc3af14a0dcd46d5422cc6387556b6698f6c0
SHA51269dbf9b54f192db271ef421015ab23dfe5fd846fd5141cb5d3cb1fbfdfe59eccc765a668314ab92bf874a7c10247647a3d836beec4c277b87ac746dededc0118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530357a25647b0eac35046afd0fa82eec
SHA1b1fe8c669ffad9ba73c65ff36a57b920c254ae4d
SHA256d848295605857ef01036e5aba1767b5cfc98057e2a414b530f5f56fa837d31bf
SHA512d17c2d24121190c29e5c3fe2243e457f0188ad1eeb592aa0a34be2b651df4e561fdffad0b7ec9a34766046b17e3db2cc629575ad7ec2ee6ba71620613e0442d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8d7d820675122be4d080797928f4196
SHA13c301898aebe03ecc3310a099996dad13e667b24
SHA256c7f6002b1a6c70642879fb0b964ac44d6edfe4a88b11dcd6875ccb445b938905
SHA5127cbd9858557bc7d5a536429372ff183ffa7728e4255712a18867988c3ef167bb8ef5d3395d32a161343476495bba5c68cf35d8927614aea8d40e6e58cdaeb700
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517cfa7aa912a401ce92590cdd5e211e8
SHA1ecf1a80206e7bd729616961372b7f8effd1782ba
SHA25639a3bee23f173129f59eb0b74fd52bf1f51866a57419bd432a21e33ec2299670
SHA5129a34cdbaae60ebc152d60ec133151df4d5750a025b0e247530de23c15a190ba6c71c5475b589a8ceef32a9c5ef19a68786fad9b30a3c311c855ee3c7e3a671ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c758cc687e27cca0e96eefdf188b39b
SHA1cd74d820915d6267d145ac08a3504cce96a13bd1
SHA25650151ba00a341daf39aa5111b867d414e9861c1d8b327766b6a7a5692b7ac7c6
SHA512513db1790e7eb37625861e7b6216da0b99ba1603076846e4ead92853a53c553569e09a8b8939f33ae817b5426893e899203d6fae65a9cf6a1ee160f2ac3557d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd9756006959208ed3b2b0f5d1c02245
SHA168aae898971b0667b7dbf99e6157f4aeea03b83b
SHA256322395b7fc6704d24c508c8c4f5d0f63e7f85269f80f68049c6ac1153eba3331
SHA5128b9140ff7a70949fa6144efbe95a76ba955621e8c677df2e6148b9299e464c9def7dc8bc0787d6786e404fd6fba8a8f98693529346d104faedbe7099d8a99fe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b0ba79c22ad2d7b77fa1667cf32d7ce
SHA1aea8edbc8f8cf9be33bd1625a6554d6ca1ac9b17
SHA256d8eb0b831e6e8091acbea8d54f123f2cec29e9afe910a025e92178470f049889
SHA51273ec0a24acb280cb1503bd96df6e3fae165a9552a9768026ef15c096bb8194eec7b3194d5c8256edc37a5c9c035535e8198129f410eb3e7a83ab804c5bc2e74d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c0e4eb3d9989442a9e8bb24d390941c
SHA1e5f15023eea56cef1e85b36295ba1078aa275b01
SHA2560bed0920b020fe01091d932386799612c0cf8ca4c2a2b8ab58d99f6e6cf92757
SHA512f0722340d6118d11fafe3224d40d38fd19f85e98b04a0f7a87ce2e24e46a196bb8c27ab2f4e4d0eefa988d53b6f49b26135911f9d7d9fec65af29687be150349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532308b0d73d7bb0faccd89f8bf275206
SHA1b694b3c8153fba9d6bfce12558726a48a7743db1
SHA2560c3590c5c38516813429bd535e8666e4de001ff6463cfc32ac86bca626f461fd
SHA512dff5a81f98647885777f1fcab5b41b7eb15d66cf7a9aca2b72ad3eb36fbb6d5df71ef158ab34b9c2d2f61203fd0b262a43bc5ffd793fb1a901740de1d8445e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3f3fa54b514b04a795e525839ac767d
SHA1a817b254e2ed118bbdd21bcf8710e30237abf207
SHA2561dc71ca4fd639746350367e8fd5f58675c1de7a1accb261985de728b7746a962
SHA512c3b64c7a82077505e338473d997b7e1d3b4ed8aa20d85f0179cf4e1b1936b1da9b32d53de19539a7f2e2d9f95d4be2dc24d5bb88941a312468a1d7077c8db22b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f3ea493da533578d23680821b34a1a2
SHA1678b81a07a9707db83b997e56b74d6bf05d90571
SHA2562e87c8e6d0e84ddbd446c97f527b35dd00b8207635ce3d732b2527b31d3e3abc
SHA5129c619d1f4846ec85ff3d43d5eac6ff6d9160b41afebfcadc6fef578026c7efa7a8699090e8fe9fee7e5092a058f339dfc3261d9694de32e278c9b846524d9752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beb2784b6e8caceeb5dda674804fa2d9
SHA1700d63eefb224ed8965f8850c8b9a212e8d49710
SHA25636b8178b67ed6dfd718d1c3f337db7a62fcc3cdb5e69f4d80f3a9ccd0a2ab4ff
SHA5126431e1a8319c616acc9a4bcb27563bdf6143b7cee98f0fe16f9ac67b9836e46d376506b2e1716c102136458e6904ee794e22c7ba84e67c4af6ae446b19d6aa76
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b