Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
a3b299bb877afb59a62e59d642fe61f3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3b299bb877afb59a62e59d642fe61f3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a3b299bb877afb59a62e59d642fe61f3_JaffaCakes118.html
-
Size
18KB
-
MD5
a3b299bb877afb59a62e59d642fe61f3
-
SHA1
6c2a4e1d93bd10232a208894cadba0cc603c9744
-
SHA256
14ec1d4c323f1ea7bf89c00d34207eef6e96268646d42e24a9ae8202c049096c
-
SHA512
74311637663bb3b58f213031a8fbf1b917ce16e77c45c798fde82e4b7757bab00c8543e18e648a5cc914add13179f80674366e8775b9ff710532d43f5ffe4b85
-
SSDEEP
384:cwLbz/QHun8h5tC3LfEhihfoaBxfJ8xGJ8xPhdXJ8xZJ8xxhd:jgl
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430082128" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6E60061-5CC8-11EF-B9F0-E28DDE128E91} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2848 2324 iexplore.exe 28 PID 2324 wrote to memory of 2848 2324 iexplore.exe 28 PID 2324 wrote to memory of 2848 2324 iexplore.exe 28 PID 2324 wrote to memory of 2848 2324 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3b299bb877afb59a62e59d642fe61f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a858939bf3c239c597ab992a0ca6605
SHA1672af754a425f6b0efdd049e1fdff2cac9c8379a
SHA25615175991d7194b2bf660584c4d06c5ce53505ae0e02d542de1c39cd1458e4282
SHA5120af54bb55659b883c8ba55aec0bbb458fa9de45e4c80cd12d518a0af28c6ce83089159a711615d403f26231a440ff32e171ed2b22bc3fa39f0477a8c3fb1b41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aba0c93a62abb03cb0eaa8ec6c4935a
SHA12228a3f53df22e34683000445216a596f03a8a76
SHA25635d4e2132aa756e1de2eb6ec5a699aacf39e72397579038f9644c2ad4fcd7963
SHA512d94b9e92398000eb440043246f7167ceb227ee87987defb8e1fa98152691ebc9c3940b171144b788efba2ad842fe85d7d7ff4cf9a8915413f708012bab32b852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6876827625600cadd2b6042fb0323dd
SHA183436fb1a68d73a168ac829adc736fc5a73158aa
SHA2562e113ea2a2332f2081705861d6add209e8d4aa080d3874cd3a9c31c7569b441b
SHA512a7e11e3eff60f568024542b2b3843567523c3a348fd47787771b6b6eea179c777ca57436f9ffec0f2d3fec1ea59cdc7eafacde5f15b4a7c0448570cd4d27a01e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56316f29966f7ea6ac2ada8189eed48d9
SHA113c919e16625f3cf9e9d1831ef4a49ab7440c5a1
SHA2562a7257b6e2adbd2374893c2680c6a9db474bfd8b433cf92fc09f572ce31707b6
SHA5120a80f6caa2b8210429994d86735a5b25d390922ceb4fb3b5b683faf053cb836e0e9e33aa83a9ee3f03b789a6d84bc3750e6d9cdadfd7df276dc030b337c2b5ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caa6f251bab44314341ec2f40914d393
SHA174fbd2b77a0fdc7df3eb09185b0232bdb72caea0
SHA256b2a33006cae3891bcb0ca50fe315a19cc34af0513e8beffa7fbd268719b27978
SHA512822be969b45db70409cec54b2e6ea94e3c945b5a94db7e0c661d6803a5b3942f89a70130b34292574f3f2714501b5a0017992b9b34909fb8866a1e465de94123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524ebc3510b14ba4f349635c143890ac9
SHA1209632a787d88a504af08f8abd694fff5a404baa
SHA256e30fce6edda370f5f2dfd5a24bb28572ba22ffe7fe02825cdb1c01da06a8d09c
SHA5128204337661b32112c35e99bae5553fc74c0940b44332badecb5cc11dfe8fdec5136bf769c7d6202f1bfa59ccbb7c0cdb81777ffe1768bdb26c1e2bc7f0fa5d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521bc6964fd1fe164edca6c816d714eb2
SHA1ce0583e34f68aae90964331804b4238da93a677b
SHA2567bd41b6ef7521dcd49fccc7fd35cf19e52af9b3c153aaadbe15ed01aef4b4966
SHA5124d85415ca8a321d32611420062b87d7cb6dc521742a9ddf3ffa10f7ac1c975de5f8e62311881a998b04a75019e4f6b692fd45d550734a8ac62557b0148acec83
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b