Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
a202a336ecf43bb87958559dbdcd2c70_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a202a336ecf43bb87958559dbdcd2c70_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a202a336ecf43bb87958559dbdcd2c70_JaffaCakes118.html
-
Size
53KB
-
MD5
a202a336ecf43bb87958559dbdcd2c70
-
SHA1
5a8abfd989d89a3d5a302d14cddc538d66980ec5
-
SHA256
4602765fbbf4b7a7a953f3acb28f755508ade40215c8f347121e1b33b827c6b9
-
SHA512
4d6dabc347dd7f31bbc708cbb5f132b83f0b6a3cb380ed3f8b1b9ccf3a0e7ebde32c07f7338622716cc62c500a40e23cb2208aaa90db8f336eb05f43e4c44b97
-
SSDEEP
1536:CkgUiIakTqGivi+PyU9runlYX63Nj+q5VyvR0w2AzTICbbUo8/t9M/dNwIUTDmDX:CkgUiIakTqGivi+PyU9runlYX63Nj+qE
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430048656" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000052190447f6cbc3e0b341b0d8c89f6f7ed624687d662b3547ca390d351b6cdc50000000000e80000000020000200000003cdb4f4636cc6458cf02ef589f7eb14e32bd76bbb797dd1401dc86ce718567d920000000aef56acb68f347a3a0b7d347e1a0ce94179af7913a424f3d357cdd8b959f34ea40000000267a4be55f79ea7ce5aaa4f0037cbc0f73eef7be83bbc97423e02d8890385af70004c785046e5b9e0b1795853dd06cb2e2e3b31dd60890c196cc8031f01d4f42 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1F3B0F1-5C7A-11EF-9CC2-6ED41388558A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e097939587f0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000005546c2bead60a0938760aebf3c9861e40e2ac6b7a60f25303fbd97e9102ed0e3000000000e80000000020000200000005d4ad12c1f3abb903c52dfa69e85633fea44e2314060221bbb6f272e61d55f0e900000006f4977c9e3aad8ac78b15ea6fef221cd434c4bb079d57c5ff2e781a41a69a0c0e069c1450a0ac4e00dffc42b3bd7c8ad23053043576bfdb20075c3982690c098a38cb412cc2dee2af0d5ee92677526f3dba3df7614b45895e574d5ff188e38258dc665dc1dbcab43af0f40d982ae87068987e747775a1e70ba6549ff591ebae10fae153798a94d9ebe52c71dd094cd50400000008c21313526047eac3f2812f495d6108812edd42c4aa98ba25b440b95121e12777aac1c29751c0c6bbae91b9865a634f81b0556542f72ea0132f07c14e58282e4 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1868 2548 iexplore.exe 30 PID 2548 wrote to memory of 1868 2548 iexplore.exe 30 PID 2548 wrote to memory of 1868 2548 iexplore.exe 30 PID 2548 wrote to memory of 1868 2548 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a202a336ecf43bb87958559dbdcd2c70_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf961f7ac63f208b0a92daec06a92aa
SHA1e2191540ff86d88298be49a1a7fdd7d7f4fd361c
SHA256d14aa724a4dd8e466a7a2ce3858409ed6a03a5a9019ab56d4aeff21c4c6f9980
SHA51205c5ced0f7cdec89b3653b08ebd2270711b8447c2be30eabfe1d438f833d2cc0fd9a86c4cde92c62401ec7bf77bd937bf394d1815a2f5e921da36895306b1393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d00542756f66c066f8d98f08c3d80c0
SHA193738af31c7b23e331cea846c1317ec40fae5956
SHA2562f05425395b082bf2ad7a8f5fa8731b252334564d1616c0ad48b1e91a4e7f8d8
SHA5128f7c62fea055aaf63e20bc29eddf2c89dfab9847454bb88020354436d9917ae8f73dd2b25846064a43d05e4f7d9864a580f50bceacbcf940190c785d26ee9d13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfd5d9d9a4d238aedbdf2dc199938c52
SHA12777c176c6f645d92546c0a9c68c36d82328449c
SHA2563d9f9d748569d0df35dda8d1fb583fa17d6d2301a8d606fa65c0542c65b86d42
SHA51240077283daf7299cbb99e1e760d74debdb6e534f70b7bbea293deba9c6e34a6f575b0890f8134c363e6e40f1e097ae771f12193da24fe30909e9ff5a2eb211bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503ac5bf06e80e09efefc569101b1806c
SHA18950b71dc922a9ac03b7f7069f4f8d3395f957b7
SHA256f1de6e3feecfd5a122c4a34e86e42b979507b80fc5b145b208cc53a41ec2ca79
SHA512497e2a47e67a0a56e50698b8174525cf60d5621a7b3060d510fd92b9ee83c66b7f7714f356f4f75120da73d0f5950b12ab58b884e78a1a877b9ce631f22f427a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5378d44d525f2091eb519a5405cbe01e6
SHA11b0f302a99c68064ec8d0a65238a82b210c759d8
SHA2566614c0c35416143bcbaf5946f6d7b5da16f9b6cd4d34e3a9117cda916c5a86c4
SHA512a6e64706854fceb80db286b1effdcb97914ffa6ace54e80d68d59ff308a04cb64a92469173a51523a47a5480efc1a33f461690d3e34bf44ea324e3f5c1c58c39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f22e2a155c42281f33965cdbf5d7e326
SHA169bc76b764eaebe02cd2096aefde91488af3e1e5
SHA25611c47d5b5e2e26c74734274f2954914b6d187fa35f61199f6098449fdc1e90c3
SHA512fd670de47b2ba765a2f1b267118064f7bcabb7a2686a31f2ef92b2e57f50570b2f682c9bef688c4fe49285d7c894295a655b5d1ff16150d32c7870f307a62b01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c00b1938d6d3c542c0b7e9d404484e0a
SHA199db24b301f7ab1454cd3c3729caa5ccf4f85ed8
SHA256bbe1e1954573dc5dbb472ad2aa1add0ff8d598c7b43099e88fcccdfa8f38c534
SHA5126d382f831df82b126c30a70901e4c5d733874e45028566f74bbcf4444335192317961953e90940fb4e7bf9e6934aef7c7997e0ba38465a2a8a792f0ef52040e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5928ba4c3590136db40098ea80524aee8
SHA10e7048010a401543da8ff7348ebbf35eae916bf6
SHA25629a78a53cecaa61350215909aeb92e0fbbd7e6e6718d0a60bb2b3e470366126d
SHA5128563a98db2dad81b469b0165b39335e2f0d9af781dc560a836d02995633b816f7c901ef84751ff58ac51997b10f522aaaababe953ffbfc1ea80836091af71333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2942649a18b6228f6848f00070b2325
SHA1fb292781a457f3c780db97def6c238e88f62410e
SHA256c0f440d2e67b6e40bdd133974bedfad962ad88388b8ff99dc767474beca2e3d9
SHA512d95188f2034cfbe63d3edb990c00edf228fbe5661d8491fa739036a962de9fc499d8283515db20fac98f81688f7b6d91fe4a84507b14cd037e2a89fe61063539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8ab9334c579aa2d537f3062b45053da
SHA12182db27fe961f364a6380fd126d65160bb40c42
SHA2563d5399e24f050ce5cc5b9d08d77814faa7b85eb6c09cf7e3299965b88f717b84
SHA512b0a572490d36699a5a6ce9669bd1abdb6f894b896993bcacba48299d3b94977c49c1f6d5cc46b705c68bc1c7df0de60250d1126ee3bcda2de451be574553638a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e6f9e59d6e4fcf2937bbcb3dc7f6ae4
SHA15b7b6e8811b30368942655927b909addc4206001
SHA256b1ab1398044d22bfd672faf6907570c514ce89fdc77043e10f4558c99a59180a
SHA5120d2b6c20dcf03ceb6a2c04ce1f8221ea9d167fcfae6d6ffb976c2b1a2178c601ef47780a2f79def28c77f795c6f9c020e18b634331e4e7cdbc88d2668ca0f268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58575062f0c971087fef671ba1f0178c9
SHA1d78fc1157e9a6d0e25d21499fda7138ec1c63025
SHA25697f4b9de1c08d1b7fd63d2ad2467529522697eb15ea372190aa79f0064729754
SHA512fee812ba30eea1bad1145c66205ae70fef167b6679bce85c17b067c8d587edb7307632777f4b4569cd165ff0cadc79572c5a4c743c8ab61a3375685188ee163b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56003504460c611bb97219affaf8fa964
SHA1e7f1b7e5f130721c4b3107fb14af8485aec4c199
SHA2564c5d8faf4ff833479f57c281a2ab2e07d1b7152766b69904a77fe165996e43b3
SHA512529d5b830cba1ab1f5993f6d2c9cd586b562bdec18799936d7b3f3859d422f79b7aa086d8aba043c8a1307de8b24100874157125babd8111600c3d8a476142e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fa2254c9fc778d36fcf8bc995b24e45
SHA16617a4b980eec2a3b9ca3f1984b7609ff7197411
SHA256dfc2747873f0426bc69be3f38d54179eb4ea3b71ea018cb5373afbdc48798426
SHA5129a93494a9b8bd85468526b0d269b08e62147945e81ec430a8d3557dab940e77b77fefcd6534f978e20a5c8de9743cdb2a2486466f4031aceb313e5c1fe4f4769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d325a691629d3443836a85c97873966e
SHA161155e82beb2ed826ec1b2ce54f4e67f32584f5a
SHA256413de9c40054465efd141d96a33c2befaeaba29ce0933f249051c25434029940
SHA512331f7f8cc8fb6fc173176558eb6bbfc78cc8039537cfe8e04bc1f02919655495383c60cedc4c60f3bb912a59727c0b73c9ab5fa354ac3f5a06b1ca7c41a6353c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b