Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
a3268849c01e23c8e0fc845c27acac70_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3268849c01e23c8e0fc845c27acac70_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a3268849c01e23c8e0fc845c27acac70_JaffaCakes118.html
-
Size
6KB
-
MD5
a3268849c01e23c8e0fc845c27acac70
-
SHA1
670680e4c1fc2a21314c08cd5789f448cbe949f3
-
SHA256
d60a716c6e2e44125a35458a97f8a74b54024b81772ab9e61aee9cbd85f3d8b5
-
SHA512
29dff029ec95ea98f461f7a85ac84f944fb7d81be7d39d1ffb972b7dcbe15b7ac1266a6b8eec85d9b044c513780175bf7f8095345fcafac8751f5370883c15ba
-
SSDEEP
96:uzVs+ux7utLLY1k9o84d12ef7CSTUq9k3cEZ7ru7f:csz7utAYS/5k3b76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ab7120613519e153d10d5cbaf90c5a1a4c51e18af152188fe23c7a09bd9cf2ee000000000e8000000002000020000000cf172a1c5bd7117853cf0f2fa5cf8cd36e790574a0ac84d893e1e35365d008c590000000d9314fb7b4bc4443e7259821f3f68e9caf32e120a32879f37a4914ce8c14c7a1db6ff87bbf4dfbd127a5f76c466de3ee5c9972c404f3f36347a7f42a525cb8a7e901fe93742e0029d3c7370e46672f895a5bd47b1c658a548084812ed94a61b44ef800d875760b9cac1eb6849b9c8da0d2a32f9858c02ade66e9d3375388965d84e88d92e7e8ee9df2ce3131746046ea400000008e644995d9c6de9e3984bc19fbe04f3f80ae8425b89787f0ed87825dfb74326959e24dc47ad22fe98d7f046d99f19569c070e52bb3f9cc035830f2e51642e0ed iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16776691-5CB0-11EF-A2BE-5E235017FF15} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430071551" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709773ebbcf0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000065927c2252273ba69c31f4b3647e38b04aa80cfcb4ef59d10e6e83ea652aec8000000000e80000000020000200000002a4ed8c0879f26ff5a244a3415f2198bb46028cabce994e61f487bf153fa969b2000000095fe9b31f9311391b1e60fcd0f961de1c215fef50e44819f8451b30112d117c4400000003285be84c57d4a398d6630ccf9a22f25323c53a38b311352293bf1c7c7921e2ac0ba980c243c16810f0dc55774058679db93ad3f55733f0afa5ee412b886997a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2548 2220 iexplore.exe 30 PID 2220 wrote to memory of 2548 2220 iexplore.exe 30 PID 2220 wrote to memory of 2548 2220 iexplore.exe 30 PID 2220 wrote to memory of 2548 2220 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3268849c01e23c8e0fc845c27acac70_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db53d8f9544dee60dbb65330cf0295f1
SHA1adfb13c25befa71339baacb792d33afff8f13032
SHA2563f54c41ba2ec46ca0cf781b03414e9cac5def97aa25147f2ae6f500e1deceb0a
SHA5121b873ac215ed3f6c3646a604146a1acb00ac596c2ee8ad0c2e65cae56fd4eb844e20f79cdb84bd6f777424f3a96fb734edbf138f33732b8b547bcbae9d66b1f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5538b4e08724a42d64fde47f67824ed56
SHA1542590a8fd0f9edb44393e05cfbeb889a422d523
SHA256f9b74bbccfe694f4ea3c5ca202f5675a20948228dff73f631649ef155997d46e
SHA512793a8528da2b64927a1b43ae1fa5669b9a09d98f502cab60b239ef2897840786ad837a9fcfda80624430f6e39b84c28a40fd149c84186d79c18762167967eed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c27840eea3735082b6a5c8802ef9d4c2
SHA18627e414cef50874318135f5c43e9cdf0b06657d
SHA2568530fa2773b0c67332a4976de2472b01be591f7fd0cc90c9c79aa3b9d3ff5c76
SHA512a6848e344371d3db4aa65fde406e5255a39f9f7856289564b87d92abb84f3c23b4dd247cd2e46bce6b362891da379407670205237f9ebb832abcbc3f6b0789bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9c21f08ed9be0a2835cc3ca09ea01ba
SHA1891fc754bac84e1c24ffa0b93f7d9d7c824153c7
SHA2565f645e79a6594262a0d5db29ed804c4bb6c4b7954f1dbf29b1021ce843781164
SHA512425a1d0fd2f01c0ea01891e6cf8fd364710b922abcf9b363b94cefe1a1604378453de59a67087d5dde414ea2c76b2ed0f9642b4af38dc9a2ec03137a6a8772cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baff409fa8ab709e596c771740c65d1e
SHA1b3c9a509f3224d6f2ca416201059efe469ae15e6
SHA25630d2f6685df318a6fc009eb8059cdea185caa9f4512fe9e1dc24fd4b7a740f32
SHA5124d6a5c6eb0cbfbccdf99bd21e33ecdfaec54ab477807f46d82d83010150107d62fe8321da3ed7b6d099a59e12abcb622a2b312c043133068e79c4d83132ad36e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fea59df8da1e4c8a49817a9634fa9fd0
SHA1985d659a66296ef284bc6e84abf8ea34768d6c11
SHA2562184ca6b07be8e382bb4aaa303100d25dae8b24adf85aa305581885d03989434
SHA5128dba1289ac5cca04ea57488e21b98b6f5d3bd4a352cbe5e30f1e8e0ab3ca5b2be0c409bf8f0d799ca3120d8468c6dadfa6543a72ba070dfb84a378e18bc60f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55718839c1c10b6a29c9fbc4b78207968
SHA12ee2045c4cfa285b6fb3b95af7771f3ea7b80444
SHA256333d693eed9f236acd5d572e1a7a38535cd5b31bc3a3412d2ef03982965b48b1
SHA51277010a7858b0ace0ffcc473d132e213fcad21e9fe1d2b55ef3a3e3a99eebb0c728789ef59ec81116922d7650d642095c310222fd56241ca4b1a05b5f9b8537f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5665cf844575b8d7ee3030ae0e7e34e33
SHA11cb271cf91a50e3bc5229d73f1cfc4a0c487f624
SHA2567c4dea0cb5bc886f718a911d5359fc03258658fd6491fc9e7cff10e62e6151fe
SHA51265150b5483c9ab520d35a27a513257c3cabf16935e7bbde9ade8f0c4b09565d8178ea6b608582cbdb6c037104085e3561ce9ba572634999caac536eafa37a985
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cba08a9670649cb82b0476ef0509f005
SHA1183ac79344fd90df9b08dc75a82c5871e1013dee
SHA256beba90f2f69f514330abc9f2ba40de3224f016d7bae2babe169f2843230f71a9
SHA512789ff573aa1567e315c8ca6ace4c5c8e53c4cf6eda33405ab77873710a3a5443d4a2531920030cb5aeeb1c9878a11fda943eca45a070eec697abb475609dc82b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ecf22de22aaf2774abf0f17b0963dd2
SHA1a09e74fde57ea93606fb55ad10b2a6d074d59abb
SHA25686b5b641c9388536d5d5a29afd5ed203b72230e809978ed299ca436efdadb0c5
SHA512d026ead4ef3d8436434a1fca20a91b74f2792725bf8b1d797f240aced97226a08ac514afaf1b777c9f0136fef9ac4118eead2353b798c49e401d0bdc4be4b368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c50728504f0936311b855d6409a382ea
SHA1ad4db50cd722920c1e3750605c4df563e00bda4e
SHA256959e33cadd5f6643edbd197a74d73f89659ad2b87c78c991f78c142b8fa380f3
SHA512f4f9aaed80af959d4d5f188f890ac7df5b15f7581c27e3591f6f70711b050415878989e8b58ad01ed7b478399a968627e8229745a98adb95947a8eb935302f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d84146b5bd57217ac2421ed086720b8b
SHA1f6d6f6d0ca262c62ee26fb0d2cd32f3ce6aa857e
SHA256eb9495fe9a72280c9ed7fd8505ba5a76db20a015c64f60b6bcc1a56654808166
SHA5128f3344f54f33f8045e12d38b17e611ab0e9eaae596d659de2da540eb00ee69fe7e6491d4566f14dbac9e81cfef229ea75659184b393c4bbf187ed8ac91db21bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a2e08e12dd94411f01b2fdfa04519aa
SHA11141b31d786e9aef69b046b713d4bbc7ca1467f3
SHA256ac812fe856a573f99af094f08f330ad3f78ea66aa6749a5b7854aa9ccebac2d4
SHA5124a7b0b302ec963eedfa34519f5f13d43630c8f4d25974ee4fb6fcb3ff2c7b067e85cd1e1f057b2189100f4c5c87290882b0a1aa6a98b15c53702bb4747e93660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f88008bea24ae18f9dbbfc673509592
SHA11f9c4622120965057d2602308b617df053b6bb05
SHA256c22461d873a4ca1f34ae40cee58b6be15c6c1fe2982332390a8f6d4aa3d5b403
SHA5129b930deee050778603b373b544713b4060d6fb86a84a189bbc560d562ee8bde2446f6af13bbe23e3d64684c8854b712fd4a70e6c7b5790f8f205c5627fd4a053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592fe27a794c89267aaa2a27948376da0
SHA12f375e2b40626c5949c79ec07713e6cd281551cd
SHA2562b1f501a8f787faa3059b73ec087fdf7a368be1ff8587292441ef4297ce1f571
SHA512dca6b9e3366983bd544b1aa2c676ebbc42be025ac9cec93e5de8022a2cb91cf2dc4b08a44979f3c71a44527182f4025f5bc7f46e481146a54c1cf2272c4a4153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cedc6e890a123c1149bfcd69e4b14e0
SHA1a2736e521892ee6574aaaeaec161509349e3067c
SHA2566f56029f0c3356130b0fb3d9a38a6bb45266c5305cbe51c0a1c1883b9ab5b88d
SHA5124419ed1373e8e77e1e3f7e188fdd955e58d47e45e0435681592d1ce8a298342dd967a10b16ce44429274f3534db93481ab11fe0f5375e32d458eefb4c18a6649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55794f91ab0e90f2af4b9d50d21469bfd
SHA1988f2cbfa3b8bb466f7330243980150a4f762bb9
SHA256840587f6d6c8cc3f6957ae6711da1640b17de44173a4f60f58c1eaa5da8c4a2b
SHA51220efd2627595ea013c32475487e0b799ccbedf10af8c05b5e8774c08ec56ca9239c91282121fe8ae6d7357b3df35f294194052edcd0b311dec9a650c2a6f979d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b