Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
aa6a9c19a754521d3dce00232df5d508_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aa6a9c19a754521d3dce00232df5d508_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
aa6a9c19a754521d3dce00232df5d508_JaffaCakes118.html
-
Size
984B
-
MD5
aa6a9c19a754521d3dce00232df5d508
-
SHA1
11a64d9addc46d3855846d50742ffd3242d96fde
-
SHA256
78efbebf50ff5ad58f8ed57f1274ee2382ce30cc894d1f8203a26af32d5fd0db
-
SHA512
bfbf7e94f094e5eadf0d3d15f21a41cf9232b7a71041c6e917b54ffafd2f8a25709b587dfefeda4e523a35639cfee4689d946856ba0fe979a0207897fbcc8b7a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430220530" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000618eaee1c15242db381874d0e78575eac59c8d1a6c1f57abeee30d9acb3aead6000000000e800000000200002000000031b6c8ede8fb4476e54ea7a0edb2231f03823f1fea7e869636d5fa51492a9f4a9000000045271aa831bf0d65847d336e87d65b5bb71095a498d868add4e2f13fbce60444c1f7d7251ff66e049cba25a0da06436092ef1178deb4ef4a82e7707a61c2b0edd2049f364beb029052b7ad0846bbbe6aae8294d67669e4200e4e2e5fbbebfaefec44337a3dc1245e79bb36983ad868ccf505f8323a3938dbdae3ff4338e556d29fd7a5d444c269fed946540c2f96eccb40000000e4d1e043d46ef9514bac7cad301ee4312921ad11cad3b3e5ac40cc92151401b51cc15699f377b3abb4aa1c79572e09a66a5f1cc218326eda2ba83a54416980c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000027546281d059e14aa9225e0dec3dad12aab423b75dd398ad78e624f1470153e2000000000e80000000020000200000009813c8fbf601f4aca21ad8b76d95098e17020b6dd5505abf3c0b09262396d51d200000004cc00c39f5017737e3597e79d7c4416867eae8c19a5b886698b0aa66517be8c740000000ab0c8941e3ad34f5c2e84b8f493767d665cd3d1d697f9d2d5608729d8b3af61e85b96b316af7150e7b4ed10f3c574992b23f9e7456c83f5d4dc014a4c697d7f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4E20601-5E0A-11EF-9C22-7A3ECDA2562B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03f59c917f2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2620 iexplore.exe 2620 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2832 2620 iexplore.exe 31 PID 2620 wrote to memory of 2832 2620 iexplore.exe 31 PID 2620 wrote to memory of 2832 2620 iexplore.exe 31 PID 2620 wrote to memory of 2832 2620 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa6a9c19a754521d3dce00232df5d508_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6e418f010aac1ab364f3d6784499a9d
SHA1853029c1e46fb8b57850d5d54a7a92ff22785266
SHA256e7f61444190670f9f521498028d13106dbac906b94e7389a46cc044c33871a00
SHA512f06d7cfe8cc87b5d850665565fad0ddf7d50ecb81b5733ce4f6ef2b6f0425e1c14c3d537926513e3d24da19228db81e04cb0327f00731ed09a9da0fa20730fbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2b9d321bdbfdfb87bb6752bf51ac052
SHA1cf62849e71ad9dc59e9f34570e0d6d5e9ebe7522
SHA256628c1f5e6286f4a6af62ac0a80d42f1a6479c388380cfcc7f07778c72ed690b5
SHA512dfa7cf46feccc9e08c59352f80b0375a9180f02e5a98bd81cb33e7ab66c6b9b4e24ed0236c99d89efa88aca5a9ce5941bf54983e667e4f29bb9d33d173aedfee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9b43fb2fad725d2bd6f0c4b14ecf17e
SHA1f0c2d7635f3696e0aee4cb80efa9c0835e629fb6
SHA2562758f430e656a4ac0a9b21d0a86b811217d005e31c0a850ad66a1b37c201c064
SHA512dc7e7ad259e7d2277e1b18b70dccfe796c73a77e51e40574a91184fd487f3baca2b796f74a52cc2fe3363b95b109fb95f0d460a2c5bc28024f431fbe8be1e6ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d673db9b24b656cb32a4de3e15125986
SHA16ace78a18e750691a301088b70fe63ad02e93fcb
SHA256c2b922fdb3b46e37075b488dde6a9985dc190191d692b73e60cb76e9c2a7cfed
SHA512c3a42cfcbf74a5b03e7cd41588af158e375de15cd455d62d95678cf14461fc0ebed207c76b9ff6922ba504eba2cdef5cebd01e5d3cb189f25ed1b0d4fd5aefe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5f27a0fe8de76a3cae7cac228ef070a
SHA1e32c57ccd0a52eafd486252720173974f4d52bf1
SHA256bc24439c61d0e37c84d8303e7bef756733c5656bff4102fdd7ca9668639e70d6
SHA5121f4a4ca065d1400ab6e0928ea28a7c9d3fc2079d566f126551f23ba93a4004346cfa58f3d8e2915740092f589f80a1cd204682ef472073b36dedcd226ab3dfb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c99e9abbb54af672165709ef0df0ffdf
SHA1be3309c9d5cee5d1569b13a16de861e3648b98bd
SHA256efdde4cfd2e7487647187dfefe4144b4ebce28f8003c3ae3556c10e8f37b9f4f
SHA512453ed16c8aeb254d25f21e82f6d8426ff25076f0de755ea6f6622019fd591436144f995b43cd541dbef87b10aafa91f312dafe3df01b4a08da0c826590292884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566c40fcfc23b125f3fc4255f9f9684c7
SHA15291ef2aaca1ef22b7cd41381657eb37eaa6d304
SHA256a7f9d1c0235bd534b9d4f4ec3fdbc530bd6d83af2dcfe5736e2909e9c7763cf3
SHA512b165d406fdfb43560eb961525b912f443a11955463b45a4b34e95170ae70343aef7bf96aac78377edf46a21c26075724fe34c988399df96ac603d5ba84ada994
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bacdf1ca283a57374e301ced6b31f27
SHA143d5ebc77a8da9077322b853b37da804fb9158f2
SHA256553a1448c4946b56fa656e40b917e7e5649fb6f9f13fd444358e04956ee48e14
SHA5122d624f240f90e407c596a22c5c074a54fe1402fe5ff72f9d9292600683ae85960a70c5c29f7917d1e1f4e60bff3e2a1fdbcd786bb0a9d4c74b70b56ffd3f62d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbfb508be001cf6ea5d22272ee7d195d
SHA17c658b22f3e1187296eba4cec3f06f551c24ec18
SHA256b2230234316d93752d2bb93d90312bde77d2bda152a9a80d3c22d189727b375c
SHA5127808ec5121636ba3e3ac3311a397519885b8c01f1907792cdb5f66dead69c437a6bc09e776ee3b89b27978661cf21b2d407cd8b7238c2e48f29e21059e5d6309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e395ca22a208eccbbb06582e8ade4cc8
SHA112edfe52aa8bab4ea32127d1c6b589604d97d1e9
SHA256aedad1009156556549fbab52e8dd754a1185642ec98037d0deb1f947c2586ae8
SHA5120277d974efdb6b1ed5ba55a78b66cb1171e77945724fdb4d379c0fc10a08a72e8bbea7ca82f5eb214963a77a560189da576b59b3a7d42e9a42af118b3f1cea9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5ee46ff2d2967d34551f4cc263c03c0
SHA167ecc1fa0ad00b3b53625c85da49036271cde60a
SHA256b29bc7de16752d655e6c8f8ff8a39447c4e3845f1c3061a7967eef132c02b452
SHA512316d33b2b0825be9de3be74b5ba95bbb882831ae9e4ea62430a6a58be6f06613a462e1966663c4d4e967d66f4feba73ece07e0bec935ba6cccc242862e75db6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5089b904c91e153e95b6c66ed5d50b03b
SHA16afee464f4a6436e9c91b0ef534e2e066ad751f8
SHA25670d8a85184fd78cd9c25832949874ef4294b902c517b4f77c3b77772d539283b
SHA51283fe119843d69edcf037831d729d99897ddaa7c6d43f84562a3d027852d6ee008c99d61d52a4534a19740e9826d2b8a2a0d2a0f287731b5acd11171ee34a468b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e54434710cb06e62fee2d4581e1b0d57
SHA109f27d0561944b91667287192438c1b39c8d00cd
SHA256c4e2f20ce7ec716edc6cf91cf398a175d18ef7a9724db812afabe787599e8c19
SHA512d663981762e1e12e381c8ed3e0b30d8e051ae0f25fd12cc0ce10b0201fb7306bfc37a8012fd82d7244241b68fecfb58b551cee929e9347ae4610ae11b2881152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d553785b214d7f24acb7ae6e87eb1fcd
SHA1500910d1e0132211c6cad4e012d5b95c83ba5303
SHA256cd1683f0a76e63720105ca3e26d52e1e2db80dc551c5ed3adb427ca72e7770d8
SHA512f0c1f3bd83c09c236ba3bc8f7801705c49d77a65d1781d577348b592b815afee3d445d3b40dbdc89c707b24c01b66088e5d527bfbe89391c67a96fa71ae9399f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5421827b5d23ee3d28b3a77caa1dd504c
SHA145697c1c80f161a88fc463ef1c6ff42b6361ffa2
SHA256a3dabdc7fd7a3b74b2a3181b20a8e5c1d5d56bdc52256d828bb9db48e6bfa12e
SHA512412dc041dfa78bb45be8206eec73253464e1add97363ab11e8d5e19cbadc60007fa885aec9ca041ed0fd539473ea7e53805f320a71bf697bfa88d6092dd5dfd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd00a2ba1d01997e6305713d48c855cd
SHA1ffaa5ef46ab8fb6c142029b306df81886be6756c
SHA2560805f6f88af511dc4c7e65af7bc9afa5b4c197848f6569da04607348c758d502
SHA512a8bf8585fadccdbe56052af39cee91f22828fb3e436c56941f199a91aa17106e8f9544544b42c72c8a573d99a4b3466fb361b82ce44042fd78fff0d82b4e3f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3cecc16a2fddcf2e6bbf67c92d8d93d
SHA16fc33b038d5c969db567115fc39bb8aab291cfce
SHA256edbe9a226c5701775b0c9c0b585f30af41cd44d439e7a3491a9d262b9066fc2f
SHA5128135e3563e013ce1b560c55b8a2e4cbd135cc77eec9d20f7bc301c9984b491740ee50b2d492a912ac435436da2d123da4efef2984fe28515cc93aa3ea2a31d8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d527f1ebd554b3b31716ab1195a042b
SHA167dfe7ec30032f50adbfbf9c0ff7d3722f0f31b4
SHA25628dbc48e90be1ea185858d34761c4a516e7b8510dd3052cb75a725ce0d2377e9
SHA5127585186751b966b54d67322293fe17948e30736a0d90dd9470039040b3066acedcbc1cbe47718b9552d19e2cbab9a085f367654d5b36f871a2cfa05267df9f95
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b