Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
972d39d6a940bac3c98af8c19aded5dd
-
SHA1
e912d03ac5cb5e718e8474068e28135c0571b9db
-
SHA256
dd46d8b977c9c14606b408da05c607a075d9ef5d67eab0d4d64df813b008f462
-
SHA512
73470d8300855980ca3afed523dc7bb070365bbec616523cdb53e9d1316e63a5a0d74de794b9d743f5f854a833dd005c437d392737f7ffdac16a25a39cbb56f8
-
SSDEEP
24576:MejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3Cqkkkkkkkx:MeUDeyLZqcn3C3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000006c8babbb090692541894b929e4388562575ee59add161c99b6649bf76c5c4e55000000000e80000000020000200000003bbdaa4e1332c6b17e3e3f90b3376f9c78b51da52ae1088bcf020abb8bb78b319000000013c850ed26eb566c15f89d431ac27d2ad2f0100d44b4bf3ff65b00cde532897d793940f72c18d7f693286ebc3a4d920d15c10940bccd420b4cde7d689000cb1416b7d0c0ac72549b0d91af35242ed1d9c29664d48d8113ebae3bb65223d41e0fc5aef6fb192b5ca222a072202584408898c3b6d6e8068016bbe296af7754540347f854a801a347287ee10df5f4ab3abf4000000085f4e3fe26f434712cb957a533904d6627d33d2cf332948c355765be488eea77e0ff0f5d43d46e2ea402624582286707408130219e89999206f34f95067277f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000736a8527c5d6486919a2c13fc4685919a66b6409046ab6ab9f246259defc9188000000000e80000000020000200000004119f86f2d1fdda1be158802155489af5eb3708a25f6f553c17730bd13bcb45f20000000a8ff7ed1f60111da8e96aab431397f39597306c9cb5e3378918a04a9e98bba6b4000000043232af0acbb82ed4018657c5faa61a6a1a11a768450524c76c5ae085c441569f802234c3aa7ee0dad64af6fbf9c39c717434b85250bc1dc2c4046c95381261d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d063598f77eeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429821909" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB3CFE21-5A6A-11EF-ADD5-E21FB89EE600} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2308 2700 972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2308 2700 972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2308 2700 972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2308 2700 972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe 30 PID 2308 wrote to memory of 3012 2308 iexplore.exe 31 PID 2308 wrote to memory of 3012 2308 iexplore.exe 31 PID 2308 wrote to memory of 3012 2308 iexplore.exe 31 PID 2308 wrote to memory of 3012 2308 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://contrev.net/redir385.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559e72a44a108d8b4ce2099e7338d3bc3
SHA1c83f107cfb378bbcef97f795ada854704ca15b0e
SHA25628e07965c603d2f389d9fc6cee52ed17c7470590c8a4ec1c32ac0b24c0515b21
SHA5120f709a10cba2fe4b9b070ffddf13ffb54bf4e69831b886b1f92efef4db2b3f7db877cb17aca9cff04957817190f8820b380b4f08a7d55fe6adeb0cb17c35c1e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cc0ee976d22fbed2260c3e0f273986e
SHA1f4e54e54f5b064d8018968adf179bd2e058f338a
SHA2564bb4ee345b4c5da8111959b5231e1623cedce64533e97f30a756d129277eb44f
SHA512bd4a66921f115fa3684b28d714a9e0593b0cc2d7bcb182ed8bc15da3e27d76d639a7db6a9c8757119aca50ca065c5f2e12ab6dffd6137408391882030d3da517
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555ce45e886d5d824fb64e3dd47a6aac8
SHA1df029f497686f2e7d5a20444daa635ae770c44ef
SHA2560236bb0ee9c4f7b2045cb03bcc38831548d53bc8ecfb13454b11ca2ecb45335c
SHA512322284ae03f988a0ebc511c8255c42b287c890b6cd15907ec907a4a6337e59859353418db647787d34b33387189f6324523e8c6873b39090f29bdb4be4130446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3fd554c276312776f64a4242f698f7c
SHA1436266af161e869deb5a2bd90bef6243d54f837c
SHA256f69f09eb8f47aee235e8a058a4051be0872eb5467261222f6fa4c3de198ce879
SHA5126ae22b2965fc6394d10fa7882ae07753965755d0c88c3be55e847fda7d2ccf65ceee6e6d8536dcbd42e6807500b536dcf0ae74dfc9394b4b7a25bce509ab5598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa0df32bf917e1ddf3dcc04622ef51b6
SHA101a237d0f891b58a55a77690fe45c4c95b3abe54
SHA256532e70a86570971df916fb4ad937bf395786ec7697f94a6cf1160f59721c5f7d
SHA5123e9dc42a17131573885684d297a95d083dd864c0de8f250595f72d155ec3dc44b3c2356968043ce0405ba696b93eb8cb3e182836a2ab17a1e27c6f3616255318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551620a80c8730d7bf89a71ba96a620c7
SHA10335f648f3b655e1778870daaf6238bf9ea304e1
SHA25615ed398b7136ef133ce377f2dfd55b43fbc0fc8b7c4fea4528be6951b9db4e97
SHA512f16230e0989e9b193d7d0276455cbd16e42e49f05a58e0249f2d9bdad83438aadc4e0d0d39b281a23045d6044f24eec76bebce0499f76ef648a60d962cc2a2a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538841efe7d9266335c473a31007762f2
SHA1d783f0870c4fde9d55aa24526ea94a1a23aa09b3
SHA2566c48260d34ca6a61a8a306ca7e4aa6c86afb4c791564167d4bfde52840f10e9d
SHA512cc42b512f65c660640e5deab3a8b7a78121750408d2daa7ce00d0208c51fcecc7f8b2a1e01011dbdb7f98be161cf6abbddbb5acc051046421dc4df76966c75d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536be93c654f25e4f78f1d70576d4bf48
SHA18dce67a744ce456e019e948c590e4f2fdf1a441c
SHA256bd3ff2fbb47dda423c9d5816bff787462dd9a84d135eda8b7f350ba748d417e3
SHA512115bc7dba8bd6d8bae15e3667404c6a89b0ca031ea1e3c1e96cead46f875baaa0ebc134699430b8b65b2dacccfc994ba8da045c59e83be950dfac9ea89af9d4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d5b495da9f04873d0fe208734cc790e
SHA1825de5b06656c79adc79ec9a3e3ecd699fb5ad99
SHA25653b89d1b0590fd881a91a76d05f60e2b482e06d1ac1d17f751e27e9a3e13d415
SHA512719f13126216105e7520382f38bf128e8741d6ade857ed3c9733f172ee2388941b7edf9ecd58ed263f9db146924edec80c6deecb079a1a3148ffbd37a6fcf7b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d02e91f8bb54001530ceb879540a6cce
SHA1559b116280f32a25f8a034c675b84aae3598af18
SHA256261d18d526afb1c9a41eaa5acffe907bd8ce0f438cf46c07f194b6459cb5cb97
SHA5125e10889677d117b61cc39190985473b0afe67842bb69d733589f91b7d48e6e43577a3b76a389fa9563e79baf7c583ea33890918408d0b515a01d5b40ae53bc14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c9eac7a915f63f15ae75cd2f6e8e64e
SHA1c876e0514ca74dbd01ab6fdac151986ba421d523
SHA256dca856c72ce804fa21a58d81ca0d7fc0fbd95389a50f3fc3642c59b19668f83c
SHA5129b9b13a180b14402834686444da90b708a1f7bddbafc08c7937e252620a179cf6d808b48f2126e707316b5ff95ef05247d01877292685562add1e98b4fdade50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e169d969c79b0a16c0067e86cb5a203e
SHA147728cbbd418cce2dcd9bcbf8409a32c2b75b70c
SHA256b718fe4233618b4da58b9db67c039baf7c1b15a67fe88d9ce668bc74d22ba2c9
SHA51235d77bc2b9b31b1d76b935957e8b9824a13d4446c1ba1489529c6a3ff12b5c5a6dfd24278c54d78fffc114b46bcf09ee817088eec9d6c27c94a508666453dc5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e60996a2c50745e67ecb9b8ff9a7a39f
SHA1593de5863567a720a23c4642a9e96e0f9700688a
SHA256f9561dc2544e1915ec722e77b41e52227c96ff7ab07434aa5139c84a17b8f092
SHA512161d04a6b2160064a3ff3038d8ce6b2ac439fd643ab0a21dd844113e2260f67fb7c04b154384d5e6f322cf73c9ebdd85f9addc065292bb7948e6ce6bfedb9174
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5945da30613f8b20f8aacf5b3e996c9fd
SHA15c044c3afc98811b1b65af87f969d381d6204f76
SHA256ca8361c275f872fec4c8edacefd5a7dffa0770087e74c7f4b391d28a9e225440
SHA5126e0711ce247de1414535f829cbb273646675791bf3048f202733daf0156a825f66c80db0a2e094a4a692ccbd15407b4f865653f4a5d653612367dfa3ab82601f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcbbfaa2391856a9c44470e6f73fc1fd
SHA171c92a9fb7e0b95abc8a82284f89184b64985de7
SHA256a7ce48b6c8aaec1cf70779a60f3530ab81b8c515aaf784326b3be9abb5fa8f47
SHA512f55b64a1efe76297033820737ee2e18ccec6ba302b0c5a0c574839b55bf80307a263d36a712507b02e362177d0810ba7f4d3a9e4a6c9492fba28f55d381e1a9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e99f932969a8fa74f871d00438fd2f1
SHA18a3809c6b1f5cbbee6f0afcc6e50002c843722d4
SHA2566811f9ebe14d7d6f48aae66abf7be0f8be7ac0ed53c6f289b1c04edb438cc2db
SHA512de073d0b6292b24bdd9c324548cfa08cea1dc5e2071599730c2476b7e58e11443808e1655fc26fe0d6f19c2268bced19c00d32190e164c13faf5f410cb07fa25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5212e8e03db93e6c5448a95b976a94fc7
SHA1cd65159a921bbce213b3aee5c6320be76c0c4d2f
SHA256922004d24158e19b00862ebce1fa0427216e374eff464dc8f9b32aeb6ce38e11
SHA51223c1e96963ab19a2ccda71545759f7225d1e90b3ebdd2f2ae48b2794fdb13e5bad44f333f766ed1596620ece30870558ff52e861db8c689b745f5d91099f4948
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b