Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
896b69492d67b4f3b2a76bdd6701d5f3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
896b69492d67b4f3b2a76bdd6701d5f3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
896b69492d67b4f3b2a76bdd6701d5f3_JaffaCakes118.html
-
Size
20KB
-
MD5
896b69492d67b4f3b2a76bdd6701d5f3
-
SHA1
85965db5913e7a53aec63dd57d23cd501adc4897
-
SHA256
fa35a49aa56fb43223140efe1f1208b443714b35714ee5f7494584ad0f96a961
-
SHA512
125e12b6fab60b06386fd93927b5eb4eb107c5b4752f7963af76f88440bfc2c57f62a60240ea87bb4fb52d9e70ed06324e5a4ba65c6a50dd8284ad83c1134481
-
SSDEEP
384:EI7EZUvwbuKpXwjr3pSaSciCd5MuWs+ZFRWbzCLCCuEAmuPlFLTOmnKw:EhgQExWe0C/RKw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000a0bc88303220609515577a050be6cbff6dde55086b4b5f862f487c8c5ecf21f000000000e800000000200002000000096d7ce05483dcd5c3a13c21cc2945ac09fca71c7cc5205bf63d9c8547ae6912c200000007d93c044b08107942c783ff504adedd7e97527d027e9210200317ac321ff4dc04000000053e622236233e74a8c04f26fb30cd021e04c225409936c8497312ee595c811149f7c9103bff59956829afefc5e1feeddab544ca24030bb3d61fc4253fe0baea6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bb8399bbebda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000219389f0d64399c95432c1f95e73c37966a5c61b50d025941b88d1dca9160dfc000000000e800000000200002000000058a1fba70be3a55d99a0d0a3b7aa89f9df2dc3f379c7d6e0bbf943ee91a3852c90000000493c754668b7a3cf844b5ff589f7fc579ea3b23a83253b5fb958204967142093e858b4faa28b1d9e85de4d5db374e53abfc0b25e442341e22151977cd9fccd2e5e2de3fa479d619408c845e71eed10c493030aa21d0dab69287167c82f0aac0eeb226faff1d3f3204daa67df84a17d1ab777c4fa7ace48731cff4f013eb6a6eeaf7fb48dd6a09c99d170f6fbe81f215f40000000f46088ec0180d1844f69b2b4762061ce4bccf3007f711a2d8e38c0a0bdd1bc4cc4f09b4285de103fcade606879638bcd4ffdd083ab6b45691e66230b93af6e23 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C335D5D1-57AE-11EF-8FF0-DAEE53C76889} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429521225" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1928 iexplore.exe 1928 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2540 1928 iexplore.exe 30 PID 1928 wrote to memory of 2540 1928 iexplore.exe 30 PID 1928 wrote to memory of 2540 1928 iexplore.exe 30 PID 1928 wrote to memory of 2540 1928 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\896b69492d67b4f3b2a76bdd6701d5f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5843bea6bdeed0d3be7fc708a27e520c6
SHA16041ff56b084b615f312fd597576f76aaf191bca
SHA2561142f018d9c684de7e1025dcadb191ecd646c3c3eb1e1c3bac4e31461d6e4fdb
SHA5122fc2164d18600da84ca8e3f401357694287ae20ff14a42edf391cbf105fb06c8a332f7e15239aaef0da6f287a43c9f3bb191cfaa20b4f02d3582bf443c0a1024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5223e46246424ea35090ce5ba1c2d638a
SHA146ce253621c2375ec21ebe0b35b95eb556c17a72
SHA25604653124350d380f8ca7e9af3f7a16e3cd36616ba584e7ba015feb1b959c8e04
SHA512ff5b47aac4d2c288fdc54d001cc2478fe9140fc1a1045d99a0f6b6761639181c9660897c7b55f5e6ebab09632238b05b03acf473f828f9b149c0a652d9300dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555f03878383caaa4623c775954530dce
SHA10a655ae3704b7a720c200c15788bae8cab74f8a1
SHA256f94726d0583d1d4d5f38af39fcbe7d4f171327e981c7792e0c5f0aafa41aa9c9
SHA5129f342ceecfe9d98406595899b014ae90b3cef9a9fa662e166ed7aab6d1b1f6f27fdefd7043bf081da339027710ff388a63877355298a5a833fa8dfb201e57334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce8a751ce9cbe343475129891154a9d3
SHA1e7138a9435ad32aef8cb619c80a3c9c2c5aa23f0
SHA256ef948abc922b1d167ebe67ff8ca865710f7c3d03537030efb102a8832217cc1f
SHA512f49fb0f7681a9f5998353258830a7cc9dfd16ccb98850d89d5cc5b526e23a0b09cd0d56ea11034932c597078e056a16ccb1f3e765ffcb2a0760b3005c5c74c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a1d1bbb8250b773c772b902e1d32a4a
SHA1d2aa8671ce9f6b851599b8bfa7da0fb4f859597f
SHA25606a1453937b05be404d593ed80581926eb6fd5e333013ad40e80742686db6cc9
SHA5126a4032fe6dfa4aa2be31405e8e1873a2f65bc22799a94013abc0db2e34280d0b11ca98c37153f1bd41b48d285790b1311fc86b3f9f70dc626bf6874fcadd4094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50426e3c1bca54607eeb026b935089973
SHA1978971b20adfeae3a30b6e5d3e9825129a80151b
SHA256e482c2cc49c601501e64c02ae26a05b48466e21d9c1b8a00c7d1d33fa23e5d5e
SHA51251919bcc26da64316bebac46a5f639cad1889a6ab7192c54a89bb64beed8099f5dd7713d0e45c93531826ea023eb47d8afbd7034f85b7d339831d112e00e7943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523f692c5f1c2db2f41eadf2c1098f8d0
SHA1af474f5c31db0b9b836bb3c15f604052cb946bba
SHA25635a85a483f3abc52dd382d3d2992d012ffe8f0d7610aab5acffadb7359b24ae3
SHA512575d2072c3d441f09c9e8ca9e3025a6bc5b877dfe90b0bfc533b41dd84d124bd62892d4b31be8e45911f172481cd1e4c24c3a015e25a095ca592bde2abaf8f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522499b29eb99b3050fb1c81555671a64
SHA122d4c89e9de8dfc4a3a36209f72e31429bfc5108
SHA256ce870b8f6cc43cd91a9ff0ca7298b19b7459d2269ab6beb36566b99d9cdf6ef2
SHA512b406c97d26a6e0ce9df6097a7c32e943e9d0d79ed5f464e9447dc2e1d3cf34b598c403aadddd0a8e846844accf4a9e12457e82617d8019061380207afa911010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b562a84d6f10f04420cb52ec7cfb8735
SHA191edd65c5eefcb42c7ebe7fef0b7b8a605f43a25
SHA2562fd12bb9a1ca50629d55fdb8b866d4424acde6fc4f7a6ce6add1e1221aedb0cb
SHA512bc4d40fe7edbea2221fa3df1bc50c42c01ee85e17afb2e491df031e423c086ff18ac8537d6415349844fdbb8936e7e01c38ddeae56f039f693ae9ba15040198f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b335d775ca146a8e5f6ea292e828f901
SHA1ffa29a31cdeb961ccfc6c11a7325a44637169f2a
SHA256530f5f9819eead4a870075bc41d3de311265c7263fb36e3737a56f26c6c99df9
SHA5120947b29de18cbefd05ff09ee4c06142ae47fe44bd9f0c7c0236b612465d4d30f13b905e4a5402ce011cc964f7531167e29f26873c5f78e62e051e88303829dde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a82b9a61b535eeaaee6305a9d011fbc6
SHA1c8d38405e61703840acbdd90b6af68805531754d
SHA256019b7e6ad2c7aca1bd87cb1e89497ad3aa380f9d84d8913c92f0ee88a36a5e68
SHA512c0ef8b4032f3bffe9a11183c074c86becef517e2c829b1b06ab59a715d059c29481842a2dfdcac7a6cd62cae59825cce74ccbeb377d86469004b75304b53bd07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5092189b3e50773bc0d9ee9d9eb920ec2
SHA1076b38b219dff50c0f42272acadad251d397f60f
SHA25668d0ea892921d4b1dfd550ef48e98070a3fed62134c8a700eecd9afeec7d8aaf
SHA51256719c93e14a03d36750aeb0e3fd7db2f42dbf08292a1f09c9b4b2266c82d6e75cb7b4ea9b806abf9ca5e2a0476d7e31071a436485cd44a50980e3f3a914ab94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512d5e079fea733e7079a616829af0869
SHA1c6edc8aeae055817714bbe0261e0f8afb40cb44b
SHA2562dbf02143d10eaa2f0cf3c8513da8b264fae8a9e8c6d48b89205d628053d33ac
SHA512c6702075c9b84fb48b27d8f384e23c8465ee7cd65d586ec0f55fdd8718d5a031da0711ffb229e0fb27a1c180a93c8fe07b2f611c58c83138a022e304b7a6c748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad2a52205ac49b26b19236c5a1edd606
SHA192d62a111a1eb2b0bfcc6c0cb9d496febbe5082d
SHA25678838b54d73a6f4129c3e5f8b2cfeec34ecb8a1db9a39f207d5b48a511a0b38d
SHA5129989dc73e946043dd8168e8d1fe12c31ec6e5a4ca1e14bd3c5fc1ba3d5311cf11c5cb563b84552b54ece2f3439c0fb28541bf037ba62505a5259d1fb88747681
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b