Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
95d3790bc25e98e42c39982b498c4e7a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
95d3790bc25e98e42c39982b498c4e7a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
95d3790bc25e98e42c39982b498c4e7a_JaffaCakes118.html
-
Size
3KB
-
MD5
95d3790bc25e98e42c39982b498c4e7a
-
SHA1
5d74a31f1d717c53ee9f7c3e01ecfc8d1f12a6f7
-
SHA256
a663209abcccfaff41b2b97b6817e0d01f510d36ebd44936ea8a206415152e1d
-
SHA512
4c1381561b1f528cd7816401c5ea6cf479d7ca3580e54b64e183d5496bfb5025f6398e26c021ef0350f4aeb01a8b4a597df2860c2918797ed1b794c4cccd06ed
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000044670ff960d33c1db6793eb3e30da43c8f0564d743992b0a90f5543408cb8af4000000000e80000000020000200000009539c40bda2840e6c12b8b975dbc16b1c2445b840f86404d4dc0e39321f9aa4520000000fda8e270ae0ccc40da4995ef090b18a6a72ebddd8c23dc9ce53f1f50e608a5094000000027aa402c7d0efb120d5abac2f766e3c9bdc65998c3ca466dbbc72f43b393bcaf10ea74cc8fe3df9170be20e3b6da9b6b6b9529c4879abf86913d2d7f19863141 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000000715c2eb9c6b81a4a3636644a8cdbcc1001248baf1f92e06bbcc69e7d12f30b8000000000e8000000002000020000000ae621eeb4c3442f1e5a45f898d675433de8352d045825048eebb7d80a6d95b4390000000b34b10833946b3bf914aab76573715e6794317f1dbf16108fe42b99493439f3b86c9d5cfe4fe0c1bcacd3d6f829771ffe09c468f47dad958a5f50041f1a5740fc2591d17ea3d258cd5e7821585310382f31989524edaea75be9e3f93e2df44a5c75804037bf1f63ec7f96b5aed7d44136a5c415b701bda49c4ff4dbe9080f03d6f55bc522d01841f925e5333413289e84000000039c43ba4404c7fb2d08370031f7ccba8ff36c974538b68a08bae28cc2f91189072772707361d48bf003c6e0fb22474041680c5eb907c09105f525bbe1b29fa0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b031917439eeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429795186" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0208F61-5A2C-11EF-A839-E6BAD4272658} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2560 iexplore.exe 2560 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2440 2560 iexplore.exe 30 PID 2560 wrote to memory of 2440 2560 iexplore.exe 30 PID 2560 wrote to memory of 2440 2560 iexplore.exe 30 PID 2560 wrote to memory of 2440 2560 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95d3790bc25e98e42c39982b498c4e7a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504a943bd84ca4673b87a7ba1c43246c4
SHA1cc9b62549fcb169865da9fa137ee478fada76726
SHA25654ebe125389aac0eb1a7f207ea57b480017c5645622d89265b3bd09cfa0ccdf4
SHA51268432ba3d4b518e7a06d362606b329486e87f300ffe11770a30d385d24491caf8c79dfb027c5d9832cd8484bacb2f0e57e3ce3f1238e0236a310e4e06bcca262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfd3de1faaba8bfe658d62fecfd069fc
SHA1be496c7b8e491c4e138e1500b5d20da2b5609dc1
SHA2567996ef14d2479f40f96b24fa949a7a035957ed29509e65cdc9421f90d097b516
SHA512c216475ec27c006d529bec19aa4732c69b97904f366b25ea795cd9e17a1837f3d2fa3debb3e0da970ad2809b7f4cd63a962f3feb5f8ff5bff1962990d247f657
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf20016612493b9abbe15579bf02da2
SHA1f711d88df05ae79cb02d42513c1c5ee6e6281755
SHA256e5a8a24fc679133e86dcd29130a68c2a99d8925af7a46cf0e1062088697f48f5
SHA512a7d59c55e6613f85bfc0323dc874124306fc432a8726a5cbfd9b054fded2a1852d6a797498f9be5fe9733d544739fabba8033c65a142df7a73994f40fa4e9719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537e0dc128ac97a3f013f1168f828bc76
SHA16055eadea54b2f984f09b319933584cf094a209a
SHA256127e1e500c449f60f6ee37db7d5e910f4a8072be89ca1c49f99eb5d0bd5a65e0
SHA51273d19b945baaea75f8105c2cb305c53d1070bdad4890d04d5c4b571e70c2589e3ddce9c6f800e8fbeb9d8aa0346efa4001a128ff8a4b52ddbbf957fdda5296e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5b630326f4d8d0a22fecc31a4c88b62
SHA1371c681dc00b9ba36b81c795c434d2a3486b2fb4
SHA2560f756ada56e284a431fe45056b5b56bde2ac28c1af0288dfb4b57687d44a4990
SHA512899f25a5836c56b6fecc0d2f77476abd9bbb286ec5c13df7b1d568197010453b940b9b8a6d550c941294471c27f9004a154bd03e17b16b9c3ef6c613c550df0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df4c77e3b4b3366b889efb38941403fb
SHA1cb708925547d461a4690c543574d5b720612ebbd
SHA256b825233bfe02879f8eb09a2ea1ce4b826a8aa7a85102b88e3255876d79186410
SHA5128cd5cd4a45eef018e54a0f3a5c6de95d1f3bcc3c719df71cc9f5c8e71bd9684f76d828cd48e69ce8367bb1cf5010a5850a0f1c2fc32c4aefbffc2b83ecb36f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fb3cc99e4760d5fd38ba95c8902dc9e
SHA1de148c04f6a99cbdba2bc00e37d3d28733489994
SHA2566150d45d8ec07789cfb161004300ddcd71135e36ce4078b1f28ba92b5f3b0f1b
SHA5120f72526ad1c84b44bc4e28df8a6b01d5eba3ddeb9085f74e32556c09bd4b2b69cc339cd3711bdae71dc756dd41e698e7b11e85192fccb43aea096c643d58a695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da4e06b65badf0d9bd111fac1646f96a
SHA1f68042ac153aa32274e47c1ea88169f35e192aca
SHA256c01fad42877cf9053dc65f998c2884b6ccb8cd3ddf26d0e308b1c25f6ce7067b
SHA51240f1c2e5b03c8b58126ad0641430804afdeae6cd42362d5676efa0d7d95e6f5471459499ac561d4be9a169b2e98ee4cf091318f2ab4ad410a8dfe650e9da061b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578bff25833639480f256b54024b3a5fc
SHA1c7c76bda9d627c99378b0ebd9c29c45796cad5f4
SHA256f6b1fd130ce96322a0a9f0e3c5b9e8df4cc2da4b9519d1fd19d9661d81f3be24
SHA512899a100f10a84008340ccbcd9a542ad9b2d6838b1a2245a86e1275cf9e1cb6e18f922127e86b1255d71d4ff4169aaea6ade999eaa508ee23fe39bbca73286bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588f4746732cb26be9c5fa7b382f00819
SHA18dadbf45e51c7133156480cf4fe5e1dbfc7ce0a8
SHA256fbf1581d46ef2675edb7f13ddbd20d307a9c9f6f23c8987ee2900ee234a51a82
SHA512263b299cf8a97aea49347941b755ba856db94d73f1029972cc7aab72e9725c40e94f0f30ef6a8da8f638d23667aac1ca31e467f957da63d4df24e9b2c8f39c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523ccc64d3380fcb0b4ccdbdd61eb5103
SHA17400682545d1c255a24944490bbe5cc50238b886
SHA256fe7e6f418a63886108fcb4da5047a4e195f3916796432f2d3769186aca24398e
SHA51215e259c6217a7e882aae020906245a58e85c4e05b7299956313da4a5001397fcdc0bf7d801667ed756e1737b340e526fed6d4f9c08dd38f4b0a590067d83a623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5507f7cdd61a060d4611a185802bea742
SHA13c9d44e1acb17802ff33a166ffba5e92936b81d9
SHA25622e50547ae4577690e101111570a474b2ca10ef883020e11bd649d8c24572496
SHA5127008f7787accc1736a81f6055ab601ebc75afe7220e6890ac63a034fb4915840666cce18dac65b0e9f27c8428f903eebef87a6e98af8e80347955debb4cbaaf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0eb71417758b91b4d8fba4f9b0b7518
SHA1afc7585211fadef2a33541d5f4b49b1879d7d4d2
SHA256ad9cd8b52e15b035197344209650feaef0c51d070c6b499ba77fbe2a8d0e8d0c
SHA512ddd9b4ebec4301ee433f72720b64f4b81fa8c67d2b2aaed1e79bc8afddcff34346beebf88ca88ccdd05161a6fa5b4e0fbbbf9aac9724566c1a4a8ca5101f6ae6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b