Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
a48447e2bc85f7d6b1eeb024f74ff52a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a48447e2bc85f7d6b1eeb024f74ff52a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a48447e2bc85f7d6b1eeb024f74ff52a_JaffaCakes118.html
-
Size
56KB
-
MD5
a48447e2bc85f7d6b1eeb024f74ff52a
-
SHA1
f5fa5f0e6e163543b6718291bf0504b966d2db81
-
SHA256
d58869cfa5c13e7650c0d127fe932ba37ee2d810454b86e15e1944c09d64dadc
-
SHA512
f624f59e33396df0256aca3c046b0249e05785a768fa88dae715f8e159949983c9e5d952134cdb6e99db3cb5b5950024f2c668c6f6eecd10048f9966fd62616d
-
SSDEEP
768:Zcd9QZBC7mOdMglpC5I9nC450obKVi/HUlMPd:gQZBCCOdh0IxCm1x/QMPd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000008cf7987ec2aad9f70905c813cb2a02bd8a60e1c23d36f8ae6d697ebdfa52a483000000000e8000000002000020000000830454e3068a9f2454c60144b27accac05ffb3e6c1d8e02cfe3410198c4f6a929000000008641e45820ea85d78ec8fd517eb372fa59f0eb57a30f02c63c31f6be8ef39a9f51df5b5ee2cee2b302c14a1dba1c4282e2297b8f8df968dfb6458da081399d6431f1911ae0aeeaf2379bbe411f8049ccce1f9692efecc394db3986b3c6c278180737d1feb2026541c213e13e00ee302f9f4860836be8d5ac1d59480f8bf513a710a4c3da2a1678347cccb05b2896cb840000000c44b3f6074cf7c9d881b78d28a06e62d391dce6bc22f8de2ccbe03e8d99ac2f8c7ecaf54aedfdba73463aede08c985a54ab0802e546bea91aba0d5caea4b9bd5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c3dcd0faf0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3783281-5CED-11EF-A3B5-DAEE53C76889} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430098125" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000531818e3c4e6be8d80f23ba38f334422a081e08c361747b4711c26d2105d37e0000000000e8000000002000020000000c738afa96aad83617d85a009dc24c3312c9d94dd68d0275187694ec25010c1f82000000096dd96b29d7a2771ee0590427da5c5cc600c8624342a1a8b33dd6687a9a351be40000000ed09d4adec6db764cde2c90fbf241c6728b345ea792f21890be326c9cb7fec28e64859af2f41a2855c2e96e86f42b8839885e2ce987401f9dc668f49e0d22252 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2680 2756 iexplore.exe 30 PID 2756 wrote to memory of 2680 2756 iexplore.exe 30 PID 2756 wrote to memory of 2680 2756 iexplore.exe 30 PID 2756 wrote to memory of 2680 2756 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a48447e2bc85f7d6b1eeb024f74ff52a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531364c38041c4babe2d20427296d7ea4
SHA14a6775c13ab7452f4001a9a530dc8cb1d8abf818
SHA25667ce43b04d2144efbe87e5452a53bbacf1e27d2b013f3358baff5275b860fe0c
SHA512f4261bd92c1f63ebf017a4e8ee9874357aacff9682126de7314735a3dad4a1a90fe52b76c24a892fa196bfe6ee9db4f9a616835ca2d2a88e7485d947e3680262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b0911b72a67e0a0383682d2aeb1c11f
SHA117dcf12fc81cad17c7b91ed7913dc242b33c5f3a
SHA25610fd36133f6267a1fa2d12e31ae224dd1f432a490503361a0f7f50551eee88e9
SHA512762a2a86c6ef74962a87a141486af0799cf47040d965d5d38a58a58d2f75873f8978ad1985d74013a7ae1e60292ed55045e872dfa316c8388889719e1768aec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4b3bc4eb962b59bddbef9cff26443c9
SHA189d6668362988d84c3b250c17c14f7886e6c9784
SHA2567da5efbb5e0898b21dd22b3ce58e97cce6318d322106f519207bba6caf060292
SHA5124b431117f32e618b778cb37c8cf2fe4e068424b1589d7000de478892f2233b162a11a32de22122d007c9864551ccdf0083962372a52f2a426b131e332e0544f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca22abbd2af094da1b3dc65cfd76aa0c
SHA17c4292375c8073531ae80a03fa13ea60222c75ec
SHA256c2994542b55cac320f1216060c27100c03b78198d5de3a230e954b60235ff54a
SHA512190244fe02a2a3dd331c3f189e175c0f62dbab1a91e13b481d520ee2353820e3645dc66347b24f3ba2a9e50716ef4943b5ad6cf413ac0bb4325199c7bd875817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585eeefebce4a0f38b4b564c73039b397
SHA1d04bb6b3685b46cddc1bdd868be6f76823b2651b
SHA256d96318dc79e4734abc1714ef7bd12a2cf535477a16f371701236a4f18def10dc
SHA5129d687fd516a58d94f1dd4a737df37afcb990bdc627d4beaf5c7218e7959353aa761ef453ffff9241f01f8bc245becce1481fefefe0b0f4f107531ef3be312555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560616b14d26eb3fbf7bf01869e58a148
SHA1706ca3c4c10cc369daac39d671007752d33aadd6
SHA256485f280e6b3823ed2955affe7ac690dec279422ac549b9319ea7025df9f58a46
SHA512d966c59504b1e13492ada9509591732153cf4acd8df1162dd4b03622a89b4b3c4c8ff8714f9aaf6d61bdeb27cd7202f4e2634a234eb2578970add33205856d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dac25960a7dc81ebe39212a4fee07243
SHA156e7553e0ae510d541305ae478dee7e7fbd74965
SHA2564d8dc4d242a57b5be9e997d42d39a57f54e676ca580ec45c5f384f1fa316c638
SHA51279015c2ccce7e20a02adc405a08e225b700dc4f31eaf3c6bce46eb533cca8b3f34565d6ad2e184ff876ce627f28f269f79ab688912786fe108195efb3834c636
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8c69e7093691e1bcd372740bfb7bc9b
SHA1e3b87374880c90d401e65088dcfe824d253480fb
SHA256b22a37541facd82bb031b412ec9e04913eb6bb648477c3becc63ce78499b1426
SHA5127bc686a76ad407835b0d5d5956f5177acee799667c4fa9da854eb7846bbf95e0d0ecaafec96e7bb14fe1cbc114590a02ba6fd71ef9bfe1757bf594bf8a233dd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db81153022d6f7515d30ef9ccabe6482
SHA1c90576b0d1099accd2b229afc8d980468d9b8324
SHA25615530f5dd6b224ad4af675ff99c93ce62b1f8c9ee12d5969117164222d2ab88f
SHA512bc30902dbf6041354f3927313a7cca092d726c5f2917e6f424dc73b4ee00c76fe3e2bf36b8a304e0af313b79c7e1948540bb170ef10a4b0477366d7261f0a4ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ced2013c5120f98e6a140301d53f70e0
SHA1e1e4f046508362cc9ec6cb64883286aa4c3b6543
SHA2562ea4a517842f0cec3672912a9a4e7b0f520474251bfd909468ac69caa155a5ab
SHA512d0ddb57e5acb31d80ab54e1664af0c9e2f72f5f876e93bf321fd132428043404dd432b7a9aa21e6c1588ebf83b17edaa09d0a223b8efc983c84ef3525f1f5083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1b197ed4f5f565a5b1ccb23615f7724
SHA180a3fec94525a5e08365c52451f11a2aa847880c
SHA256ce995d92262abc20ea6d9495786b072e00118221e80a31a4d5640345efe9364a
SHA512fb494219c38b4249a68cb12b59b050e0276a4769c5ee6f8e02493b03c3985154064e673d05be335a53e479c9f805da2e9cfc2791a98898e7de9155d6ccf5d04c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b