Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 10:41 UTC
Static task
static1
Behavioral task
behavioral1
Sample
95c1d50797548311bd25526bd4f8bb59_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
95c1d50797548311bd25526bd4f8bb59_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
95c1d50797548311bd25526bd4f8bb59_JaffaCakes118.html
-
Size
89KB
-
MD5
95c1d50797548311bd25526bd4f8bb59
-
SHA1
db03e778616eb97947508589bec478de96c9b7d5
-
SHA256
9fb30f7275a447dc703cc4115de9e2291c716c2f54d4fb0e6915ab004aac0bc8
-
SHA512
37c368f15a63f29e2876ad52b5a4061f1dbda7578207a00757051863cdafc923530bc1c4774b30c090db0606f0ff91920c5da8786d4e107d9a304a19d5ebc280
-
SSDEEP
384:7X0lV7DFkp4NEmUeVF0siupghrmbIOZzjni7NPpqOyBN9xhBwNNZwABrGByjx9j6:7CV7DF24umUMFtiupg7jQl
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD016171-5A29-11EF-BB5D-724B7A5D7CD6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429793946" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405130a636eeda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000f8877fdf03885dbbab82501c8eb2d4b89dd0bb439b85885b943cc972bcaa19ca000000000e8000000002000020000000a66f28848cdb9a1fa4cd767084f56ff8704a5b17eb68654e84309c1aea16090320000000c1c9c506aa6728fcd23ba50a0e81f73424768ac5b68daef3386693d9e1d898f040000000c6c95aeccdce75b4c9e07df6fed92a0b52e7e89ce6ce677dde161062f48e1d5480ce508df08289a361747b15df1fba82b6b28b5fa5525057aac2d663b13b0b3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000984c0686a0c11924f614e03d6c8094f7c985d5cbbb97cec5ee591ce78de56adc000000000e80000000020000200000003d204df1674b901a19974ddf44b6fe1f5a7ba35eab415114433266af397bd000900000003d7874f8eadf36a59ecdfccecf656c1a611048a681827a71f3ab79a838e6cc6f4a7ae97ef9d7e58924f8a55386ef7c3b49446119790ae6d2446faa2e9863eafdff4dc7304e6bf561847308c5ed7435979298822ec9e5351aa933e0852d05fd8bbf5fb756cb327c90d95272c8ced8de082d42c92db2c2c72031c8f29b88b85f1b56ef6ebae78efd08b840af52bdd4cccb40000000124095255cbc1b915d06d73695c200cb0ed4620de0d1efa169089643552189136b869eb7a019c5022af66eea867c0f3caff570282bc40f9606f463c9404a9d21 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2492 2316 iexplore.exe 30 PID 2316 wrote to memory of 2492 2316 iexplore.exe 30 PID 2316 wrote to memory of 2492 2316 iexplore.exe 30 PID 2316 wrote to memory of 2492 2316 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95c1d50797548311bd25526bd4f8bb59_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
-
Remote address:8.8.8.8:53Requestalpost.com.trIN AResponse
-
Remote address:8.8.8.8:53Requestwww.alpost.com.trIN AResponse
-
Remote address:8.8.8.8:53Requestjino.ji.funpic.orgIN AResponse
-
747 B 7.7kB 9 12
-
747 B 7.7kB 9 12
-
779 B 7.7kB 9 12
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5946dc5037942547c06fee5a9a9318d62
SHA1c163eb28492d32f06b9182b7199af430db81b581
SHA2562fe15224f721ca4f79b9bf439ba7e27b071b2dda047a6847ea70aa1a14bc4b63
SHA51291641e7b8b30911008029fdb2ba20189ea7f34f78a875a76c33f326614d73f5461f554b1ba637ccfba6412ef8e551f167d02bb02507b778cafd983ebdebe012e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a59937efa24b6bde19c9279560818ad
SHA14b9c7ad28b1d5e07f3814da9f8487f1e3e06b601
SHA2567a732e3a5284dfc608c53d39de8446eaeaa21de504f9ae786f7a29200cb94476
SHA5127c53286881dd5fea5d1360cc9cddbe753fe852c3f9777ca6a0859e592d85d31bce7c439f573a2a4e6b924b96934b305e9604bd3a99949b479262050f544dbac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0da7e99fdfc097a48b8817ac87473c2
SHA1a1f99e087f6dd57d5b2345cc56939c53c4f01a85
SHA256f619af80259586b5770bc03595fd75cee77c4b972758920379072de3ad0c8f0d
SHA512aad706f14c2068917a88199888df50f72f88a48a5a1eb2d19e651dda244fdd74895f220bed6cd93d61b852bc9d8339953cd7c4d580556d5216d73c118ad4aa26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6d8796393b521d163df6b9c4ef5667f
SHA1ae4ca1c50beed6c6933dcb5beb03358611f0ad2d
SHA2566f470c47d16d925335c131c52f401eb085a1f8ab5b67510c20251583fcd08604
SHA512a959c8a498968a38beaeda2704359d8c2b552e800ab4b3ca3f621d1d84b06f2d6f216bfdd826045f3fd8175625ab288349afefed5fa7f718289186c90365c8ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a59af7f94be584530073aba99bb4539
SHA12ca5327b4f928de4fcf1afbd64f513ccc4d42ea7
SHA256dccfa1bab9b9e2d8dbd19522c62f984cb3f5d0d2f21cdbfad589ea146cc77cb0
SHA51221ba5e183b6cc58239ddd929ede619d8e0434c915999612fef5e209155953c4e93c16f8a8292475b539019d183e14ede410b6e4db76c14082fd109a66e42700a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d6891bb744fa343a021161fec4e926d
SHA1db42459d42ac065c02f743b9311b3f5f3ca23c5e
SHA2564eb56867dc76dff11cb9e59409c54cc62096bccde137aeb19ee86e53140f8305
SHA51290acc2894b68a082db354202f6c653916489ce98295b1e59547052be61731dbbb47a3b05d2c41a6b14044291af367d1eec2d4f9263e55c3df149b99534261eac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c206e7a259ed75ddcfb0f8411702b25
SHA10e535d0061a73c9011f95559a064245c89abcd35
SHA256e5feb6bf5bfb0b818a33dc6fa82ea74ff428d04605733017b924f95959a13e96
SHA512bedc198ff6e4b6b347d37170ae11c2a77e3bc7a5388c488fa41da49a8a59cc9b2a27eedfab12c7c2912a0ef1b6d2d484309a6e8f2bf87c5db8f7d1a9c9938596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564bcd1d26809f200271ca50581067f80
SHA1d276e9044d388061cafb9ba84a6ace1a6d06f7c0
SHA256557d051f612e310bcecfb7b3abb3eb285c8dd614bffc997b8b712af57d8c0ed6
SHA51252b7cdc7eeff06000e0902719b02f6cabe49eb6add6ea7e956d1e173980b85f9402201d51b592bf184b04311bd2cc47427b608cd7674da8d8cdbfb4f64a9497c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5128693c4506cc2b67f0e22b30d3ef239
SHA1b3dc75db2f215907e739ac73936a291926d43ad3
SHA256f1d364544dcc3888d1bb9444fa566dfffd801af3ea6fb355554b7bf9c71fa39f
SHA5120cd0850adfe786c5b4a99107dea541be83304210f59ded9e00936bb5f28b3edfd83ad549635f151b5b8439c4cd458fec5ae554d60eadee30662038e64e55e20c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570840b5164f129a1d68853463ff9a00b
SHA1fd438ad080509851bc62ff8aab16bf2f636bd679
SHA256dec21cd9cfa3d69203fe554a7cfce7db99e641c8970c05541a97a16d90c5d3d0
SHA5122b87ecd7e46a4cc767c0bb629f389f032471e5d234cdad10a4af5e2b8b4d1d7dd68b4a3010404e6ea9d2a0773a0872f5d381388cff353e0e3bc2c6b8ad7f0aa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547a2bae47bfe67927ecbe30c6a6a5fb3
SHA1fccf98aa4a865f2d579195dc21e450a07b1c7af5
SHA2563c9c505a10fd845a70bb984f5774c4fa2971c4c50ef3fca4f96e898c8e5b4466
SHA512be157b2fbab3a413feb21f2fb582beb57d4ec208d768b5d5fda2ce925ce47a48ad9aee7cece728050fb4c04b0e319b1b97142b0a28faa1771826661d41471464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2c858e61f401527981db5227ef8d944
SHA1340366d3b31fa41e415733de900e6e6b9a684a95
SHA2562b56a9e7c0082d5ac9cb303e7f20571b5b2d49bab28882e239b6fdf54dd2f82b
SHA512b3b065a9c27ce1c631b3f9a8134ac87797d098eaca54c485600f3916fc78152cf1d33601ef870a2f7ef0bad72772cf392ef6001f3581fe9b6dd7505448cda1b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551e043bd38309d0c64e3e03a1ab70deb
SHA1ad3c1eb60c6be43295eb90539df9aa509a7085ae
SHA256314b63cc09a2893e15a0fb9073673912767e437c4b96d4aa9b5cd27989dcea51
SHA51240e1ab996325628f84bef99f8748f5ed74cfc3fb754018350df13319c3736a0f6999f33db57c611a4b134a7e0051f18bb61f51b740948804741c0a4bfee6f2f8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b