Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
8db677588161be4a6b1d8f1d9b776e9c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8db677588161be4a6b1d8f1d9b776e9c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8db677588161be4a6b1d8f1d9b776e9c_JaffaCakes118.html
-
Size
77KB
-
MD5
8db677588161be4a6b1d8f1d9b776e9c
-
SHA1
ccf99c8c2c5cf27739673ec7b85dc10682419a05
-
SHA256
425675008ef80446cad87202af2387b39dd68e3ea91b500cffced2971a338460
-
SHA512
1ff910dbb1986a04ec53805eb447fbd79a4fe3638d6e4f267537302e1325051342ae128561c6811021362a4907fb403196707d060e2730553fe18839618f74e2
-
SSDEEP
768:Zcd9QZBC7mOdMUppC5I9nC4kyTJ+ci1GPd:gQZBCCOdN0IxC0S1GPd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3659A2E1-5876-11EF-B961-D22B03723C32} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02a6d0d83ecda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000acd611beb3ec01db7013a7e7e2aeb2e2184a30395e594da5f2e02b6f1f2f2ee2000000000e800000000200002000000030c450c9fcd8c8cb90130e06331922f76796a8f5238b7d3c27a8bb9c9e18c6232000000025e08f546d6f2579c2cae6bb1f433caad8b45532a420ae9dd50892c092c96f9640000000ce637cec31a34b7188d35957768b93ed9aed3435bbacd19fa04fed4351deb079f13121fce174b8258955a36843d3bedc31105daf41dcd562882542f0c7a63dd0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000098565ca651f3437d6ff49a74580eda31db36e90f321ed996038e30447d3ff6ef000000000e800000000200002000000010b5fe7df0779ed28f1a8cd898f676ba5cbdb0323716ceaf8c0a478ec390f7b190000000b7341bc8a6ad8cc701be6fd58697d8ad9b86c6ff556995dfcaa3ad19562754593bead8e9092c719287b7f9fe89376062f2ebb5d0f359a78b7f3d46b5a153c30e8a7658b319b34c8a4400507f375aab2060b0e1b5bdd77a5f2b914caebb755a4b712a0250e44723ead57b74218d296dbabac6db7911a3f0b4b4f27c784e11ed4bd056d227395541d146d96e0b3eafc3104000000073ad2cfc2e3b4c1fd9918f1e77b109dbb6baba0325bcfe2a6d2af0a8c5fd1ce5aeba680371fea83eac39f0b4f3bf891eebde1eba2289f43fb4d0fb4f3b835737 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429606889" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1960 iexplore.exe 1960 iexplore.exe 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2468 1960 iexplore.exe 31 PID 1960 wrote to memory of 2468 1960 iexplore.exe 31 PID 1960 wrote to memory of 2468 1960 iexplore.exe 31 PID 1960 wrote to memory of 2468 1960 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8db677588161be4a6b1d8f1d9b776e9c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2468
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5768a7c88bafe6dd7916381308be515c8
SHA1679acf7713ff3733f7c9d1bfc6b0644b0571db29
SHA256faecf1124093bbfe148a4db6554d81b0c1283844d23f3e7167154bad9f4a7fa5
SHA5122f6363327ff8842fa4631366b5f383af25c92cf38e66468fb8a4cf2b6b723d2595f89522643815d2afc08c28fb9686e95bde360d29b9be03c0314cd45bd010d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5142484d23d6c557f8854ddba65f4cb74
SHA17e873fa4c8f633b090ed2783367d1bef75b4527e
SHA256ccfc833688866e71465d997f613a15892b948a6d968809d1eecad4546c7963c8
SHA512e87ddf23bf54ded559cfcc8a43323d300a7335ba916b4ee5b2de2d581fe68fd187a7a1265058f1adfbb8f27613ec033dddd6736f3126222be2010a1af9bff73f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b97936bc387d46fbae08f400ed57aa3d
SHA14c8eb9890f10cb92b338461311af4b17d9e66150
SHA256f84203f47ffef9b16ddce7c81b327adec2558587229af352b3c67cce38d881c9
SHA5128bfabb4478a908631bc832fab0c8a72cd4ffe708cb837e5624ace4302b2752f5dfed3a524ab394e8821af1595e9ee292857855615b5b0c7bc4bf5b52aae3c801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560b95e160764cb3bb5700a7b4234ff90
SHA1da30311615bcb33b37253f22cb7600c27802e580
SHA2563d20f4c5ce55e91aae7ab4fad60ed1ea97110ae4b75ebccad26155c3609a5905
SHA512f36aa15d2689a458ad772fea1626da8293a2694f4169f1a945e22fe132bdc13070815bf48294a144584915a2525b4e0e326e46a66837d85354b0ee6cf7709fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a261d9faaa19c44b9ab7ba254312f448
SHA185eda03adeb115cd4afebb68d8a3dcf54bc1bee3
SHA25653329ada58340cbe83e2e8c6335bfcb9babd059c12672ccd3d359c08731eb92e
SHA51239ffd7facd11baa786e7293494b8ecb31c305ccf02e7de3ecfb9aec006418f98a3870f3c13afdba3d6ad1d70b382f962ec9f25d139a7551743183f4fc2ecb101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580b46a30c87c10977efed4dbe27b54b0
SHA1187932af3f0e9329765896e8688ee6724be04e59
SHA256d36264eb678a5806edb338294fa10c97bcb6f17dc8c9b40c29a244f4ac934bf7
SHA512215e98b8d43b110b47101910417937b9ab4f8a9399cf8344b0096529f2d4633270cfc18743613a7ea232111a8b684c6b89e98ecfe5d664782ad9b050851e5137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0806e3fb09b818ba3b9113ed711e336
SHA154e5509b18301cb10f7c8ccdc7e8dc3280c6f9d5
SHA25691a7158449bed0ca9b8c47b1f450a4b754e9f5ebc92a504d4c5e74b54947b2fd
SHA512eaad7475373774d73f8f626351dffbbd4a5b02cef71db6e8df8fbdc6a1681c39a32f04d68c6c2a139e7acc8c5544928990bfcf2b93c282214e43763c491928d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de2ea29566abb19af225fa4b11934938
SHA18584a5395426f697205bd1bdf6d7db84490cd152
SHA256581cc243ca324bd686b17d76fd8825eb2feb685618d974775b29201adfbce4e5
SHA5122f45f291cb841551fdc61ebf831615857d968cc9e8a1330c8c797892017be27e1bcaf198367a85f318dc05dd38639fcbb4db5bdec7fea241f61f6f927e336155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e47c16db46e9ec6ad1c8ce3edd8458c9
SHA10b003d5e25255ebbe6c8ff1c29b013b5611727df
SHA2560b1ddbf8de2df6e4a3bd79efb4110c0663ee28a2ba2526451ae04dd96444a665
SHA51286e89f5104aff2e2acd55e282511acc6bf2434f768d570d319cb26c52e15eb267af6d3e8eceabb37443c9371d664989c387ac003675fbf471a5b732abb8904e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4f4c8c4636bcb946683918b313b8bfe
SHA1b923d125f94b56bbf1df6753c0bc5581661ee511
SHA25689c252df7069d072d6bd50e24b0cb9246e5837420b8b17cad9930cffb8947f65
SHA5120288c617135679383ce53e13642fc975072cc5e3970a75673308f666265d6aedef829af834924a349f9302e621f5c31ec44315fb69621807ca7ee101dc8c87b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcc6130a7a0e1e136726dbcc93a7c63c
SHA1992d66cf11134d261ca5bca0c4677128d60c6449
SHA256dea30505ce036672d8eb1539a0551b253ca251621f3c620640a640ca711204a1
SHA512dc74d133c843084f1beda03acbe85ff5a954d3f6bab3f9e1a89c503caeaa17438cea89dcf1d1a478477cb06817177f9d9bbad53a40679f72f11ce3e1fce1aeed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c05d20497c5bb43e9bad8f356b3e7b0
SHA1992564c63ce06a42ec84ab1b522b90efdde97cd6
SHA2568a0dc233673e9b97f3eeb79466a930eaa1ece920f2dab9bcd72feedbc284dd4b
SHA512c0e7127f83a8b929f28838416a4a32bf4d43e1b6531604b4f403265f078280a37f85c95801acd1ba5dbd5b8284642c6df873b3acdaff6877f828fc770e832dc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513f45d253af09cf4cc8f38876d0ed934
SHA1d1c0549c6288daff25eb40f8239964aba35c50e5
SHA2564d9e4cb7e47aa993453b3f94a6410e9aaa089cee574c6dd7a376e674bfad763a
SHA512e9cc6835797a4abd77f18ac80ec1c459a88e2535a41b9dc5947a7e51f1d1be58dabdd31a7185bd02512365bb100882ffdaac40e25ae3b7a41b6b79f362c5b2bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539af94cdc9c587ffa1e832da1d8fdada
SHA13368b8c2a90b134006beac7826eefde16a502f37
SHA256a240681e4a02a637b095f542e865a9f286c8de7ebbb51b67121990d85436a7fe
SHA512999c76f09584be5c43313dc2321c2ae31dd2c502126f696e27f7391a0de994c3627226c47ab9680a0ddcb83d6a8622425d1d0e34c7e35b1210173d6e4c31889c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dc31225e8cdc910158dfdfff02427ec
SHA1b70e8439485e5f0a07560f4d48f61293462089a3
SHA256ca8c2370c72dfb9422952d80d729d4710e9f0ca9603c51e797b84cb6410e11f8
SHA512a18c993db4af7eb456f42d79efb440efed3e7d7ce55464a2eef77a4d208a45171b08295e319d202b2f0e02e8fac7ca366005ba0544202c53d23ae18929b575b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3d7d61c9104bda2c0cefdcf1b161dac
SHA19b74ca88c981e89d4104e9afb680e0673a272ed4
SHA256421741e2dc76f2c3e288e54cc8c3b7d22ecdf90dfc90ce7d422c2c5fb8e1dfca
SHA51287ffce24fb9c6794a0cc781eae8ae364f8cd1cdddeb4195b2b5730045afff3ae9be383f6842b3f295bcbbf26a569470542b09e5164827d87111c054822b62e5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd2c3e7b08daaac5ecb64ce62eac6f61
SHA137a7c39ce38adbeba2c6ecf9ae792c83e1ab75f8
SHA256307ce445e7abe97b37bb50b88d491fe55b6c161d3f4b392841a6d6e37234c8a4
SHA512c9843caabae7cbc0a3570baf53c0fba032bf440503b4ad2365429b090893e7baee71f4a3f7db971f96240383af1254fc261fa493f82e771b2bf28facc7ecb7b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff318e246559f09d6ac0599813ead723
SHA10afa525a3f9c089f3d4d1381e2894d23dc5156e2
SHA2560f57ed1cd8f45bce23677d521388983620e41fd7015b6d627d73aaa9b0650351
SHA512047fdd3b026bf9d12c704e7a60a5276c46304931541981f4eeebc2ba90fa672fd62f237cadd3948dbc52cfcbe1cdd9461e52e2deca3f2a21f2dfd4b09ede5135
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b