Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
a4a7dfcac4f40c5acacea1d352fb61c3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a4a7dfcac4f40c5acacea1d352fb61c3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a4a7dfcac4f40c5acacea1d352fb61c3_JaffaCakes118.html
-
Size
3KB
-
MD5
a4a7dfcac4f40c5acacea1d352fb61c3
-
SHA1
3f2ee43833ed488ab90948d0cf2aab06836d0b73
-
SHA256
739d0935bdec22762fe77234ec5c21beb33259f901a4fb1afb90b38326f1a0c5
-
SHA512
5bd93ccbe8b34d4872612f08993a8fe16929d83076e21b50d923349cb9e540520c01292221d9ca34b4eaaebf2bb865e9af6e93d218c8bd66564911e6f7d10606
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19521531-5CF7-11EF-9F09-428107983482} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e017daed03f1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430102049" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002ffb56d13baa887929d23016a6750d1916de479c62361a161ba63dd4245385e6000000000e80000000020000200000008d5fd0eae5c9cd9ac8e8027407f913947ecdaa040af872071eb90a7300d469142000000065a2dae5cc4efc6f5659681aee875995f6d6b6d6571f8ab94b700bb562eaa34240000000ca000f6646fea890b43975915f5adfaaa73067846d94c9510207e5cf4c5e37971713a88b73bed279278eae70bd6de5aa06e27a698ce641a14a110451495430c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003ba1613db34554d698f0b7f6343a51c98c4412cf5853175d784e084011971f3f000000000e8000000002000020000000f9bd291e11b78157f515c675d6e50a780366f4af0f04e47a28402d91a3b0d5e890000000a449ee2d9f583f4e91ccb358fa8b984add4ae4f1a3d7cdfea5d6d5408fa05e9c7cc3b51b1ae834c53f4d742f9abdef596478816410d400e0b5a126f470906392a923172643945dd01a858f47d4e942942d3bcabd22dc8377e2622f770157f597fcea2c0c8791773234f77e0e7877fff8e928f664a7ae718bc750ce84c22cbc5277b3f7bb924d23b70b8ba47f0b9c53ac40000000bf2ca1fd2801e0ae1c224def35a57e0cd61eef2d70e639e43f531f448517bc8f5828e8c9009724a48bc3b6ab6cd76993a8ccd25bf305027b9db2c689a1007f0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 824 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 824 iexplore.exe 824 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 824 wrote to memory of 2964 824 iexplore.exe 30 PID 824 wrote to memory of 2964 824 iexplore.exe 30 PID 824 wrote to memory of 2964 824 iexplore.exe 30 PID 824 wrote to memory of 2964 824 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4a7dfcac4f40c5acacea1d352fb61c3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54115c83c52998c9537ba3b3f43aa01d2
SHA189a311289ce13071b5fb5287e1de64ad8496d89b
SHA25640482f73c769dfcb76aee8da64bb911dbbd450406dba2cc949ca517d50e2bbda
SHA512c2dd6c4fa7694928bdb09efb861e7e9960e1dc2179d3fb5b0e28eb5b808be19a26b827092172ed542abec69c59093ad76ccd598c47ff653af3cb0ffe2708e3a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a652061ea3757083869c03e33b3f5768
SHA10f0dd83ce325b2f606e59b1dd3f668afcc0110dc
SHA256f027270cf98e2d0cbe9091610497e67b3c527d3ae189e34fecade09a4f8aaa7b
SHA51290e5446e2d6962bcfd6f28a43948b114d92ced152db6205fe0898e36291b81d423adadc79790396bb8b53dae8b07ad7a495db0e3d82838ef0e43a48d962bdd3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b1825652c198d7c134027730d004d75
SHA1ac8f90e6839eda556917bfd2ea6d9ce5568eff91
SHA2561b03c4419586fa866c6dd58217939116389ce8498696db57fceb36d5a305dcaa
SHA512159b37c9459a70812f97a02cdd179625114b68ee6f9e4ebadbd48bd64874b81fef625167c9969473a2f68639c3bc0ab8690bb3f976bb0392dffdf018e03f27a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b1b3ae6420f5625d8d01b49b3dde0c0
SHA10f90ec8f53e36b4e1b577ac46d41349289710721
SHA256beddfd216982195a0f55b6bd3788aa761bdfd0ed963979937814e43e59c3f97f
SHA5124650d9ec3aaf39750b3cf688614bb76f78db36ed715d98448b503466190aba7b442b2df55d79b923d4edb9346b91ee93c936b4419fc5bbf332932ae8cbab3d34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ded395bcd0d11ba1fe71da2c1e5de4e1
SHA178819b5d0e467605ed7334471daeee884b119197
SHA2561c589b2aae203ab6b4c3559bef1ef33c18b733484f65c2fae999085bb9d2fd6e
SHA51232282e1734383edd7df53609f2fbb7d27e7d62617648d7aacca858a6aa793d27faf7dbeda8f524b76d7881577a6983b6e996935d34f0213d1e41364f11494648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58734be10a191844e43b3f326a9953b9d
SHA119fb6a6b3b1c03dd7bd9dfd83fe60b6ee8c6ec88
SHA256816704bc9559d574144e0b7c063b16a031a198248cde36ace15e777bb1fa45f2
SHA5124c7191939e556f118002cbd898b6c6a92bc106a8036949117c4a58999ec258dca8c460f1aea2c99abe7b168128e84d263e6b170a352140b589f90a9ce7d0f069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc11054a4aa0047d715a7f7219b5c9cd
SHA17bb6728ea62ecc95da8c3c3f99d12ed43542c202
SHA256acca7e620d17689fae71151aff08fdeb98e88db445b162583a72379b7c7785d8
SHA512bf0b7e8e127914fa30ae83a0a5815e8d69b2de259860eb4b36a3e14a78c0bf4a5f534bdcb5a163e2acc194eb68867f839018ff27afc1cd51b7ba5949b64eca84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f7d29e1792199d3e7f7b41e22d11ffa
SHA11dcf0754e7514de0fd0debbda0503650655181be
SHA256062a45bfa0f2990943539b307a58b797564fbc758381fa3ff7cebeb621dea878
SHA51231f95a4982bbe7cd089a66fd415dfbe9d17cf7bf478e9669304bb624ad27842eff44805902c9cf4f1529b9c8c91d59a8e2e8f949072dfe7aed704ac101eb8c1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1f38db3a8abb364be7f043299728ab5
SHA18cb079daa0166bf1389bbd33778357a3fb284091
SHA2564939c8c000e3e24217cda8ad2bda0c00892414185ee5761559bee57a5e749cf0
SHA5123bf6fcdd3cee508a709ddf1c639ba5e9966b45250467666d6400ca1ff977d454c4717902f93fafcc4978a5a249e625e1fbc5654e3d2ceeb13e396f1e373521a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edb4bea1f820fa58e9d5eca4b1b9ae10
SHA18c596b2aa52dfef923243e3c241003253988bd38
SHA256aaa691462a198742449ca45a7e1bf0b00a816d89b61ff1377df39688ad6cd7f3
SHA512c005a464991313164b4188a1f5d5402ddc6976f2e570510be8e1e51a4fe1bb4d9031725417850f8821410b9e571b3fa712b6775f3e92ee05718929616454c285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d1be851e13d93983808d34307f50aa9
SHA11ee5981656b07edf2851e16bc0a0a967ff389566
SHA2562f0b1fc09ffea66885d02701cd2d79dc5f79ddc634800a61efc0b434bcd6274e
SHA512a724a48701091b1eaea125d095e3d93d2395e82514cd839475ef1efaaa4621ef90c55656dce2dce2a886ec228d548ae5ffe48e7ffc6b792bd15b507448d4a825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c33485cd9c5f849b50cc6b747a58e278
SHA15ca2c1c966d7ad0de69c2ae0228d90ca527395d7
SHA2564d899229b10b409a1e1664c7117cd1579a47f256a60221baeb04c1808c20d303
SHA5126e255f0c8476d0b2c9e45e7764fac5a06977354be9395d4e6d19ec4badfd695bfeef00426d93d1259808b8c2d7a87f7a30c568a72e3443c62f270549d95f49c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fd29c3b7deb70b7db3eeaa6cffa803f
SHA113f40eb1400391b33bb7544f56495258ee858c0d
SHA2560a242892aa9e180c7eb7a92000a1e8e069eb0e57b7a797454340ff66561fde2e
SHA5124a30716ae96be2bf626f52eaeb622ea118c8b4e40ecfb0b78ac8882d17d14e00d36d6d1246007b91a53d9a58f802f59315b36b3851d14264770adc1f8c23d5f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5398443a8875e11704337041321121b86
SHA1f24391fc90ac6302162c691c82e0e22bf0582aad
SHA256a0f9f5965141beccd86e3261fa592c04dc9fcae5e1458f20154a703175b505fe
SHA512dadd287cd4ff291726c1b77aa966eba3d4dc22efccb117d05c786a8c38b10415a3e0a7a58285bd0886a62c680c4efa21bce5c129c2a69610cf6bb5eb3219fb35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5323f170b844c59f37fc5d70face49aeb
SHA102e11454c3d9bd126edb4fbb0124ae630143baf8
SHA256c4d4aee372bb0c6590893b027ac15e08c4e311b6f1afc8c8f3b659120fadb60c
SHA512438e5dd20283e7c0eb7569616ea9c34e4c2b03509bfbd3935dd68d2f5be3573ee10bf97ceef917537a54f93c755a6c5f965d4799fe082f11b3d19836cfbaec3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2b2ea6b045bbe882f70b898690af370
SHA1474f581d53ede932cf582e4c0df90c89d3282e28
SHA256b09f972d4484d28bc38c7232543e506d21ada0453be146451f17624dd3eae5e4
SHA51241d89ef8733572295f437e01a57f8ec4d52db817ef7952d9cd180eb91cd50a32658e1af840dd79c687efd7d8cc8bbe9b6f2bf06c34fa724065fff522ed7569f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5608178fc71e4cb5e672a714ea5e53d04
SHA1d47a8ff7f9d28258235eab6ba3fb9cbb076c572c
SHA256e6cf78b615e74142d6b7eaa88eebb669c54063aa293cabdba67204bfe3be70e2
SHA5124ea8f0fc82fd80783a0ce336c0181c0b5cdbb146410d79372820db1450914e7b687ad9f99b630a5ecce9e262ea16279ec11c58fe987ee1c7bd0460b0362ca474
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b