Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 09:21
Static task
static1
Behavioral task
behavioral1
Sample
8e2e693f55b1711c418977bd03eff840_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e2e693f55b1711c418977bd03eff840_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8e2e693f55b1711c418977bd03eff840_JaffaCakes118.html
-
Size
6KB
-
MD5
8e2e693f55b1711c418977bd03eff840
-
SHA1
09eb68ebbf964f626260eeaa5198a2d5033636ae
-
SHA256
746fde2a71606b385867f168908a743d674d846ec0ebf1aae049db59fced8be8
-
SHA512
cfc50a78e8802c04e327b799541f461cd804493c1c551689f80426add6eae5bfd5754d500e92ee2e66b29c96b5a2b20fcb24413d6934cfa843af30ab7dbd45d1
-
SSDEEP
96:uzVs+ux76JLLY1k9o84d12ef7CSTU3wNGdcEZ7ru7f:csz76JAYS/uSGdb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005987a6ca900948c163e4a4d84e9e409e2983ccf9a2a50dcd475f4ca27bcdcf55000000000e80000000020000200000002fc8aaf02d61d747680df469df849d16e421b6c456d1541d97d6e0e124a7194e900000002b1a6878e8df14de74dfd611673d7dba97dbd08ae429aa30ea68c6e1f33723f1a79a67985ecc941cb827d83b7f3d24aff3fffb12cce9b80c5755fe754fb80713a044e1b6bb226110c9b2957ad4570d79a01a817a263f92dbcc526a2016e6c12992040eeec5e47f8dfd68e7c2cb1dd31f09360046bf97b35142fb488f07373cba74d01a70c184a47043f36155727f595c400000009006fac1b3b9593f834fa3511be6f6b55cd2d740e9be11ad84a2b612126eaeb8e54a584f0ba0e65845da3ffaaa912c05a4a3c5b901918c359b31eae18b230d7a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e89b277969eb6ce30812adc7f7bb5a616cb395cd09a70499516e26705b044154000000000e8000000002000020000000f8c3f86b894c05ca41864ba00c0a7df56ebfaf10aa237084ebb646b7d6f4b4e920000000d00008830eac08dcbf2f08d3ab6ce6cd4cb2134489189c5bb87e69e139169630400000004a1e0aa1c2720768f219b6ffd732ce775eb18624ed8ae430a2dec9ed18636969ee7aa08e7dfcd28ae4e07e70a750ccb571eee68a8c19ecbb2009804ac63ac0b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{424B1FA1-588C-11EF-9982-6A2ECC9B5790} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0514c1799ecda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429616360" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2668 iexplore.exe 2668 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2940 2668 iexplore.exe 30 PID 2668 wrote to memory of 2940 2668 iexplore.exe 30 PID 2668 wrote to memory of 2940 2668 iexplore.exe 30 PID 2668 wrote to memory of 2940 2668 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e2e693f55b1711c418977bd03eff840_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b337f300e074fcf4e736bd31afdb511b
SHA196da5929a9b939708e18789a0fabad89d3568865
SHA25690c9544a192f2e24ee06ccddbf1bfc37028cbc0463d4fdd51f8c77555ac530ab
SHA512a12049eb7ea5e695716578840dbe209a20923e39a931feff901681f48c8d001cb8defcb3e378ebb48b25a730bc6397167e26cff3aa1ab6e45292f4fd5fbd2cb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a097524dec7f0d613c77ed29f83595cd
SHA10a1146ae5a51e7e200f2de0be260c0337c3d1174
SHA256e35655026dfe0bf27f8a01d91adb6d90a4bc359ace81c3087396bab170d389a3
SHA512096f7adc38fe44559f17dc5d8ea9e46504f8e41f9587fb205fb5347c77fd98185eb331117e7366532642b24864a348dcffc19c1403d74e5e5141c8fd54b5a154
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4e34d8330aa19780d675d793179b0b2
SHA10135ac07373e75ab22bab17ff23b2cafea4a8d0b
SHA2569a1b3b0fe052f8c151af6c8837696c1b7592e2827a0dd2a73458ef26015ff8cf
SHA512807be70224350021e0be6603b867250eb399d676670f7cad50d7669d2963308ee6696ea8191e2602b3156d6fdf672e9825cb376a9d951eca6b17050185680db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5890562e8b59dcff10ee2b4129988ba25
SHA1b90c1df64ae711f9301df03af0a6a4a867cebb0a
SHA256a8d6d220ba409541daa227bbecee093de3fb57da61b16581ba05ae4c2ec92e92
SHA5120f21c6a105f9a6f8686c00c36563f6044d684744ff561f9b735f6cfcf208264be7657db4bee11ada0757eb5ae084bd3af11068245e711ed07932f38f0a196d38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b8823fd072fc06af6638250f97d106d
SHA10af09019a51bdc088f737f585af1834c918de5d1
SHA256133e60c831f4319ddb61751a52c10a492a997b630308158a8e25c218776fb1a1
SHA51262d79d3a228448b243388b94ca997b8dc9555569504cfab056fc4f6e8e9f7a4ce64db9e6d61025c1333d87a2aecc1b6a0b071929d26de669170837479f5e19c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57697afe0ab7ba5a7dc96b7e102f3ecc9
SHA11c77c59f194c5dfb5e0c28f7482daa1aea043cf8
SHA2563ecff6bee6045ad32a487950f9d23f82a7eeaecb7707326d40b5597a4acc658a
SHA5121ddaa71214b79930019005f353435ec0e65918828df53283e97f27df3d384aad5b75482ebf76968cf819cfb4c379e88de9acfa734390c43ef140d3dae63ab89c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570f5d79da54e1dcb89219498ff91fe65
SHA1d58b01e584dcfd7dc37cf5ec8cfea0787770a6af
SHA2568e43ea12d47952367f10dbc85c69c5812eeaf4b2e2c85e743f89cb5ac9d7eab5
SHA512f90f2372324385e68c1082bf9c8c9ab002e15a44e4e40bb25d3f56f013551c97245a54a5d9168d5e06843f15222177155c1f3864d2188781e2873fd5ce6ba5aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eda35fea54d59e144f72d44addc1da11
SHA1ba3e6f60a91b47e9ffa2809de7c0d35fed73a8f3
SHA256bba520a60c9532428948b7d67430487f5357b0e3d8ff90967c0ffee2cd4b3b97
SHA512541f0c557b33590f617bb022bc137677ae21a59376694bc0b90655dd090b9cceabce4b48ad06518d4316cd246108e54588924bf39e81b09aa2d86c15469f6b9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5a61be92913912f0613e1190b7547f2
SHA1be387465bf4eee4ef7a1e1979896c62aec08e873
SHA256daa4d6bf919bab995b9697bf1e547858a9135b716b5ce5696c169a88d021b18f
SHA512c637bfe6ed5770d1198901647f39a6357985e20b9b054abcbf34f09422a5c17ea9543b61d2c75b2445503bfb487e344565cfb3fea680896b810494084c94379e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52353823642a630c5d860e2396bb5fbff
SHA1f3c6beb75c0bc87d13e000d3d9c6cdb46489ebca
SHA256cd538e53c9e133e7052dbd7b443928559bd88fdf5ad6e885dbb9c78159f06b15
SHA5125aac69922c92e64b31273786835808151e2193106440ca42b3f8ff349d608cbe45b20ce98efaed55c8bbde28a6b885b99d1a51d485652d0be511e69ba1a3c775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b0b903f93fee4fa22767e57bcbe0ece
SHA12f58e58df606168b99422dfea0ef83fdf68f6144
SHA256bdd614e5aec1cc106d7b07d078818251cd377afedf43c88fccab2421cf0b5160
SHA51229fc081c9909312dbda45d4a0ce1b1df0c33f676eb121b75e47d374f49b7f9514478c9ee4f1dd8f406bb0bdfee218afd55604a9ec2a95b850e42e91654af4c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5049d5afaff1e22299b4f3eee49cb4381
SHA16c274d7bde0e5fb194f1c5e081e2f280f04f3e8b
SHA2567a076f0a5cdcecf190d3acc9db0ef7cac78e4780c5b31beb516cb8b9fabd4895
SHA5120d910607d26e1a61b358e56ab2ed03b6af7482dadd67e5c8d400fe751cc2c6a4b86c0e6e857444af1671bfd3f870841f1f7304a26b584225b888d5ead927fce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e5e1719271de3a33335d79814d2dea6
SHA1d82bfd7fe888d493ef09c84136cd7efe25eb553f
SHA2561b02d1aaeb8e7c2539528866e1323f9d1064f9eebf523d52456cc8a3007f2d19
SHA512f469396a8e35bfe10975b4da47f0a6c8b7005d164cda2bdc615a7bcbbd1985034c78674f07e73d986db125016870d0bbe436ede119b9d8b6e101ea792dea80c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534829c70f7dca0ec5e1eb12de65dca22
SHA1686b0f145161bec4aa7d703468c2fdbc5fafdc38
SHA256ddd285fce4a2eb3c342e939be563db4d755129aa10819ae9a0d355948afaaf4b
SHA512dcbb1189c018da8a3c54631732125c86be329330cd365d24b998602327fe091363807e0dc69af9c4ab51f9b26a3c59183250f60d476c5ae6200e5c30724c34da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5a3d6ddf11a3d4b5b327645b61f8c6d
SHA1238d13397d1b6f490bb292ca18ef55e7c95961ae
SHA2569341b16c422c327a8aadfc014e6fac0d9e848514671dba3283a817b16e281ece
SHA512b59d5e32c720528fd95ff13c1e2f1907c05bd4d6f42e615a4b65615bd4a236a612e45612f529bb3883bb495266ea6e8ff35f6f023a4aab11d9fcbfc8f0742790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5496c3bf2a675e50554e827ac7658f22d
SHA14d561314778ec478ef7ee08b9a89195bdb0392bd
SHA2560de983b71a346f13fe5650fcfffb0af1eacbfd3007afd62ecd6857033b34e4ed
SHA5129dc54017d11a7795d0678119b09db97270f18c7c08ce5499e7c2df6e21375ccb9391021a75cff7c49588d3872b86911918225d2d512178e4ec762f6a3fb773a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c95edd3497bea4bcd1452e138fec57a7
SHA1d0e3225fa608ebbfab10b3a3b92854a12e74ba4d
SHA256b405ed40e54a7e26ee68d2f1a231ebadbcaeeef6e6eebf44d58306cc41983ca7
SHA512c11bcb0a347e2d8c66cb65b6e631613717f526ca586792b3e72896a0d45e446023b3feffa3eb5def10f058f2140f6296543860f4ca082f81d5fff1f85922d26a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f802b96733c4013ab05b0688de086d31
SHA1e2ce35da68e3a93faa3225ecc87d8ab93fff0039
SHA25602264a1c2349a66a8ed8d0774f1d64baeca6473fbef719057555c2564e4a32cc
SHA512836fe6c53f1e8be2c963bfdd88c13a72467124648920e15a1bfef1365922780e4892c995d3c298222e9706b39098a09628a1b3d6ef783343831fdd0353959911
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b