Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
b128d7800c4826146cc447e2cc37ed6c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b128d7800c4826146cc447e2cc37ed6c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b128d7800c4826146cc447e2cc37ed6c_JaffaCakes118.html
-
Size
6KB
-
MD5
b128d7800c4826146cc447e2cc37ed6c
-
SHA1
f229f11fbd8be3a7e6d9a0baceefc59504f8d931
-
SHA256
fdaf3986fae73a78236e594c303a1fb23400fee3d3ae0153577d78db011bbafc
-
SHA512
b3c21797a28e26791a64fcd8fda48aba6834a7dde7267bca2b5cde52c137566d96532c174067bc0e8cc6b6692039f8f5cfe486ec7004160a6ef030344e1b9775
-
SSDEEP
192:4ml3yegwtsGqMMUi7q/+TmZT1POek6pIeo8:4ml3RgLMMUi7Q+qZhPOV8
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{768BF581-5F46-11EF-8BC1-6AE4CEDF004B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000a3b86ce105a0e8852308dec2b77ddaf8b19ba3ce35ea8ad3de214f521b369d6d000000000e800000000200002000000019069d0fd1cfe15e3a22c34a9e81d5cf2326f5ff139539306f76f276c9ee93c82000000026653b065d10f03ce13a0c7c9ba5032fc56dd9e57b400b2cc5510834edb3c2c3400000006c3663d737fa3aa87d674252e027b69626239b7aef66ad3c6236fb33587c4ca6d5bdf61d5da26a15e6805510b3ce390142548e096e28252810e11d59f5e20a93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430356038" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ee1f4b53f3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009a2a793a009c74975bb734a7540d3a988fb03b4bb152a4e2752b8a5f5796f928000000000e800000000200002000000058cf2476cf6f01b6528a0e99f2776e4147fb98d185259cde6b200a4519d0fe4e90000000e6b34f8a61655fc28e16f10040b0c2ddb852786cd0494d9978263c5e5fcd74fc2578f64f0ad58ed5d35ee1a3dcee0fa3ee38655d9e5cabb7e8c518a81b1666bc76636bf9844da41ab5d760c72e42a47f2f2f20fdbc1e55901ab41a50d4b839a0159978e034bf90e0f5817899857217089d4af03380b6748706728cc29fae4c5d4c32ed3eb979b7f65c68aa5ebf102b9440000000c435248b62552e82b9fac2ebda4c9cba4ccecc320cb2f068b449247a79f527151a1fa8ee107bbe5c1297df30444344b149c93a9309a779b9c794b013f1a114ce iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2712 2360 iexplore.exe 30 PID 2360 wrote to memory of 2712 2360 iexplore.exe 30 PID 2360 wrote to memory of 2712 2360 iexplore.exe 30 PID 2360 wrote to memory of 2712 2360 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b128d7800c4826146cc447e2cc37ed6c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559660d50e92b7e0f02bc180f2edad66a
SHA16bfe174cdf88b7fb1b1557edd280fceaafba52a8
SHA2565825d2cd89f83a49145c8d6172b3bb32bf038567813e3852889a669a11ece0da
SHA512d1bed721bf8d840cca75bee67fc403fedd27dfcef135e91bd9b0c40e59ea7d876ba01f7c122d5b22dc5b616ee0d3920202b46b91b94062befc5e5e957c5a9adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543e90195421c310723d5e6b09eacd0ca
SHA1f870db4c1f14538a1ca6e8be9e84b2748fefcab7
SHA25699e9ecc47674de1e9c858e6a8a51ba444d0811a0b224187042001d5dc221ce3e
SHA51220bc70cc479aca9ea5bbe19ee54d20394c357bdbd701d16a611817b54dfb4123c4717707d4225181fd50c74e332d7661eb77ddfc21fdd6c9bba93dfbffe1742d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8021ed65fc924ce25541cda6627c365
SHA1141ae9af92fd3e097cea1ddeee36ce757de7357f
SHA2567c4357f90da19a6afec1152f1bf45482751b0d745bc6571d6cc37e73d993299a
SHA5128cff8740ae4ddde9b437630e54130b1b968413043a557f0d171eb33ddd78d596dfe3374d54e15834da3513fa0f6f2fc33ec1cfd37b324e26e36cfd655077d549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55878f3fe1d5d5befb5b80fb52b772c32
SHA1923e5bf2d2e8e33837443536fe71389c948cba78
SHA256e233b838a25c5dfb03ac87dca299ce6f31f93bae9c73f95971a5369b64bba2b4
SHA512e005fd578f8e91e7a65939a0becadb50b4a8855c2beaaeae0d2678e4c6aeea09138e32acbadf68eeedfc4a8f1571bd732f6049bbc4ed8584336b5855fcfd384f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7b688c41bb5c88362baaea474cbf2b2
SHA1bace3144c2067438f3289f81b8556d5cd283d29d
SHA25663a652c9c0b901392b259dce75638c5f80d9839f221768cc4710e3aebf6388e6
SHA51253a301f91b922723fe1f5199a276a5c89d18032b52b2daaf599fd11c1b1d724e007026ab08fd8f086e8c5840071bd9b5032096f5ad029b1d4ef3f0288ee91555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb5d927e8884065190ff5b81fbd40c87
SHA155807ed929efa28db7857576ae95c6db6271ee52
SHA2567fae69c3c2a6222de85d9d0a05a04b66584df2774c893a3e0cca81735b97965f
SHA5122cd84894e985f4efdf7e8d6884cf43e1796a9d93264d567d3a4e49644e1d943d1c834164f57b7c9a631c1eeb73e37ddf25f0414623a8aaa977a1ed40df77fe05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50756f8197f96d3b1e3547630a628c28a
SHA19c8154fdaf2fea08f64c6c5e8ef6214ab2056015
SHA256ef7bf9d5747b861b8ed1ba9a5762e96103bce747aefa46494483e7d018a534cb
SHA51254ac25af5b8a7b98e62fb580a471f296de2ba0f78a003efb42afc66f415b71122063823b0cece5beef59471d384e31ded36cc43a30bfe546cc4154c4b5fec7a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5446f8b2c1a35205f88fa99b241e8a455
SHA138e001b949fd44293c964161e3b9f1dc49d36a63
SHA25699d3e6a6398c37bb4772bd433712dae1e86d426c7061a479c3d17adc20c1e408
SHA51276667b1f762a3222c9d0a0933fa888241fe8a8c6bdcec5b7f2ae5c9fa20260d69b46a5967e6b69e18c042a06b377659f8e58665d9c53e6c807e9de35e5f9f1f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505d948fe40faaebb6ddd9c0f7b6685b4
SHA1de1e2ba101d16283d9dda8a3648cd72f37f6e391
SHA256f09f196b0695e5043f932b1fee7de46402132671957b23544756f3d7439960f4
SHA512c5d5e8b0eae7b3fac4784ad45943ec42620eed5067d632b9d5e2bf55033705584e01a6e5075cb227e579a818bed9271674d09544d8bd8cc7917996382a5cb87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d0b4a314b1e971e3312aea2b7af5354
SHA11df38918c7f86b6577b8b2b7c3a02f9af35a97eb
SHA25654bcd77ffd33b27bf4747370edb7998e433c1641a770468741d5a3de05e5ef8a
SHA512409b6d53b1274e73e92ef11e73336277e1fa22feff9276e8d125917a26de766b2ae9ebc830f9d4a245c18c7678fab693772a88cc7e84a0e46554e1339e46ed1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc966ba182af62f89feea562246185f0
SHA144b8a7bc9f365932352844195676273b0837e18b
SHA256883a9ac7512512e1367a93684411b0cf7e09e420fa3b5d05bf6ef00eefde6115
SHA5128784cf9fb5964cba3f86533f3654dc0bf6e7c8da93ca5b162f6c5c4738535bea2fe1f5f144e1f7d707bf342b35eca976cee2f2f3b6d9575a6feb2719f290987e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508b3c24741c17d024a6b6af48866cff7
SHA1b32eb4eacd9acaf21dfe052659a59875027d9796
SHA256eebf24f2e519829c2233a53451023e34a8666a21dc6d53846122bacc206d67e0
SHA5121e473865486e9b2a745cb887ebdeeb75099b977c0d23f2f0675893b1524debcef4c9e9cf2e332e28c062173ed4544a0bb3b1161d6e0b874c38dc8e75814529b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e30965cfbead0a2e4e8b5a7188047df2
SHA1db60ea151460a9f15e5101afae851d562e7e2f24
SHA2560fa403dd2a19d0d71d98c01a2b96c83d9d36236ee57fe452332c39797d1bbc6b
SHA512025fe599da20f30f1efc0736805483d71abcafca87309b6cbcfe784bd68a00bb9a789deaea5fe41aecc1043ca64c1c91d3a289a099a887c4237b8cdb6dd4d544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51da28160b752e16a9d6f974e7dd5f617
SHA1dec05babd9bbc6d6e4e8049717bf7d0612286d91
SHA256b9af42130fbceb7cb02f888a1365a7ac1161cbf42b193553948604d6d5ef0f44
SHA51279dbb284ffd53c4b99743ba85c021e5efb8d725a8e53d0d7a42820335f8492292b5937576b1af6f1c7bcab34ed8a6a190157b4f2d99c0602a6071f7b40edd10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522f9a441f6d4e2de9e7e48af14f15303
SHA1f7f26bcf09c7a974f5d630e7185b52292911b28a
SHA256cb0fa54e55e6e13c607f1340159d9df88055f38d33f8efc725aa949b367e6e0a
SHA512b03cae9968ef9098b2977445b476cf836aa54220b724fe50909aca29680e2f2dd1eede846599b8d082ef9580f95f548b3371ca1d22fe75fa051b02d11cae0f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550268891e99d8acd6796f2baf89bb3fc
SHA13c14def76f3cc30d7435e0aac967a76d8d1f0022
SHA2566027d0a97bb57ebdf70d3dae648c0d89ceeaf187083c6bf70d6e0f9a89d6523a
SHA51285fa41d5ce24ea5a111fca1cddca44662cbefd6110a6f3760a381d6f3232bcf59303d9bd224496d2029c9b6cb5bb3cbefdf35cb7ecf50e7656a6b07c7149065d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df5d6e2b077f53e8c1b8b0c0e3eeb54f
SHA1af820b2597f4c64bb57b3293b88d267445f422ce
SHA256c9045105cb61e28d609fc1d07c1a35c014a0d25004a7cfadbb52663f40f58ff2
SHA51270c459750825e0f18fa8d7241e9c4e0ba24931ed67ac3c50577fe07a0fef3627d3832c12f50ab8596da75c00d58574f784e85ae84d8fb1fb1d188a76eb3ecded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e7bd4f57277987f5166fe4ce03a1f23
SHA133c940e2ad66b26f8455a1ac5b16acc88e5bb18e
SHA256b63c93e615da0a51b16a160ab47d0b8003aa1e0866c6ae84face93cef8bbf080
SHA5120efbcbd4e9d9b35026fde979967687ec8755961d1b9a20f049ef810f9b36af042ea787a4687fa9df8f47ab7db8c1404755c195939d97cd075044bdebe75774b9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b