Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
8bb0b7021fa6a688e54bd826d9a6f725_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8bb0b7021fa6a688e54bd826d9a6f725_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8bb0b7021fa6a688e54bd826d9a6f725_JaffaCakes118.html
-
Size
23KB
-
MD5
8bb0b7021fa6a688e54bd826d9a6f725
-
SHA1
b1c7f61b8334ef35b881c7266ac6769d5d70e3fc
-
SHA256
4940b6891896b8ff01dd28b85619573fc0637635410fd7418dd9302702074532
-
SHA512
1fb0e032c40f1cc05acc739509464c65f00b7dda42ca182fb7c819aae6c6945df02587d4d31d57a0988ead998fcce1075719636aad4d444b576e9db1d8e5b5c1
-
SSDEEP
192:uWr4b5nR2rMnQjxn5Q/lnQieINnrnQOkEntXDnQTbnxnQOCnQtKwMBoqnYnQ7tnT:5Q/TBJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429566874" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B9A9EE1-5819-11EF-9269-5A77BF4D32F0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 iexplore.exe 2724 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3004 2724 iexplore.exe 30 PID 2724 wrote to memory of 3004 2724 iexplore.exe 30 PID 2724 wrote to memory of 3004 2724 iexplore.exe 30 PID 2724 wrote to memory of 3004 2724 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bb0b7021fa6a688e54bd826d9a6f725_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7372ed9de46fa1465e681e691d727be
SHA120d821bcc74bba710228c4ea29b1ffcdd70a32a5
SHA2560ae5aed4dd30f4aa746faa48a4a827a2577d93464ec38db72c73a05cfbc68ce8
SHA512529ff90a68ff49b756b0dbeb70dd4b5cf71c970a5d6e752b132e3a2ed086a0f8c7c2cc0b61eb8090ce90c514690ead48cc641d62e0367dffc1f6554b34095050
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c66d15067f7c82a569a6d445280485a
SHA1b83aa25a26f3f13ee0a9e58fb377ff104bbbe978
SHA256e2ef31a9e9e32cdf0b50ce6ae14c3cf7adb05164604ae820fac7571b4de4ba93
SHA512f700a3ffe1897063c286eaae6ff0bb301617f5adef0fc377f5a8d6b9ae5e447931f15e12fb72f6701e673e47fcd7fdd60008d3a8254470edf93d26c595740671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9d6c38aef55ee5dd408530862aa3cf2
SHA12fdb1676e76142f78b9288b0fd0ba76c03a9cbc8
SHA256742ca4ca22ae570529141be824930fc2a771c7fedc7338f29b16aefbf991b81a
SHA512f90f2674e24f322fc6215196fccf2a1162c82cc3da2af0c9893900da8e84d3d071218063ae02a4dd3dd21e21560c4f473e61ee2b4cb6c362d734012ea3c2088f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576977c5482c5427cdfafc247eabc8e06
SHA12984e4d32a08cd7f9a9062c9146c8337bd6878c6
SHA2564485dee243b3be1215147a009903e5777391a5ceb92864cdd4ccc6980f6a1037
SHA5122182890948d785613f5d0df424bb6f89f3785f708df47e048c070617480160cd6acd4e26ca1210a4bc1b45fcda959c0f4ff2f37c9a67c895e6397b246c88616e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faaf9013f895c384620b3d32e24a779e
SHA1d987eae126367718427b9da55859e11130a272e9
SHA256da43bf8909462d77d8f791827765d2b5ab297ba55b3a3bf7ddb63438a240df38
SHA5127ad5aa3995453b57e52e204538616f9144be4177c3bf568e4b790d00bdaba37a0c50cef05ca6284e02d6408e9c804a9c6720e75dcea03dc48edfe3a1448e45cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e10dea0cc7a33f83f9a47b17ce150327
SHA19bc818db9229226027bc2fc22816e7630d8cd420
SHA256be9b58ecfd1c6e8d32038812d66afca52e743f01ca893cbc65792e1b972dc9d5
SHA512d5802a961883623fe1c29a0e309393bb9c152fba13c071c7dcee7c5d8a2bc7bfdf7430c4ec5a6448aedf3f58fd9288ff739b5c46624b7ad7f44670b3f12154c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8b8dc793ff8ff8cb152b50fdf5a9b7a
SHA1978732d317c2a69ba0def7433e63368731f761a7
SHA2567ce84443e06165bc4626d33e1fa71777ff832cb1cb6e0b6608c88525c8fd0f35
SHA512a8d7e1e08226afd1f6d8a7ab0f13ba922681163ca35eeb6b84a2b9c9cccec7792f9086f3845127643ee5fec1b71e56c7d25210f7cc605ce19fb7e4ff3de2fdab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57efbcd5e04b65179866435afa9ddf79a
SHA152ff3b61ff360ac9e9e52bf920e275c146698202
SHA256bc6bb4b3d29e9f924e66bd39ebef799cd48376ef84a42b5203a5eefb807a12a9
SHA512b2c097cfde8dde6db69954de1c98f9ded67eebc2dd7c8cb37119923b057952e63af7b6c5f3b0790b50a20720f1f71b7df5efaf16c147f9c593e501273d5baf90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef972f6b5587384d639ad1e3dfc926e6
SHA1dc36ec5acfe82bb0bec799d442f8f52c18041233
SHA256ff7581a6bb41420ff5591ef135192b3f0215ca84f360cfa15cbbf25e97b41598
SHA512dbd8670c7cf810a0c437e843f39ebb595673179de7f58894218ddde48a3ac312ff8c541bfa13afe79497b7fc9d1967512adf0ff0b6b6da1f61ef20a81be6b44f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b