Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
b5448a767c9ba7e4a01a9e8de725d099_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b5448a767c9ba7e4a01a9e8de725d099_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b5448a767c9ba7e4a01a9e8de725d099_JaffaCakes118.html
-
Size
1KB
-
MD5
b5448a767c9ba7e4a01a9e8de725d099
-
SHA1
1f190c3881d79af71b629b1ff5b2a5703aa80340
-
SHA256
51fb8abf93d48668ed255a88558e2f75a1b1e05d438be0a84a36ffab00af43f9
-
SHA512
ae4aa9cdc5388606a7b5a4db527b2373899236b041cf61b4a738dd61297a48ce1f2827cc7ae07b904e6d0c9afe5a87c5a26e78a7e4d3157a489513a5d267912a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000acae72bb926fb4cba5711aee29eea42e34b81d4a2b65ca8a9ed6dca869ab7ed5000000000e8000000002000020000000e4694c87bf0bfbd9c83d17f97144ece1a6dd0386130a7ffe654c44e986b7000c200000009179803d036c64e33e44fb70867eadda4a1051cddba0c83bfa3784c5654eb203400000003b836c5d71007bef1583939f0d0a8e54a76047fbc4477d9d07051fd0103ac3d1e19a232aa4eec0b3df644f42ec2d3a4b52f5efcefd77c5cb9342ab1f0f8eeaa8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000039be60570b8ee9ecbd7fea137ae93be9e3b8cafa12d9a32bb4fa78a9d1a08f53000000000e800000000200002000000067b4694a3d967f75988a41459b10b39118ab2a4da275a0e1c96250700cd115459000000016e4cb992bb2d7c28c264d9979926653e4ced033a0b014fdba714340978d8c1a37a912f1ab30c671bccc9169e726a5f0cccc14ca3dddb769be55b57ce0a0c1e44ac644555f2d06e94431b9250a75dd2c5b8efc3c242b5970875794de8d9f0a094fec870aadfa58bc877656670835447bccad2c2f213d87bd57bf3e99ebac91a4ed7a6f5f7d154f165d68fceb05b2f2fc4000000035a1577b5e5704004d395e780edd54ca0e61eeb12b508d6ccdb7d20dac07afb3fec633ea0bf8f490076271fcb1ac96122b3f338b29c3f4c2af54b3c061a4e96d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10377f5a18f4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D1E30A1-600B-11EF-BAC8-7A3ECDA2562B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430440663" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3020 iexplore.exe 3020 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2348 3020 iexplore.exe 29 PID 3020 wrote to memory of 2348 3020 iexplore.exe 29 PID 3020 wrote to memory of 2348 3020 iexplore.exe 29 PID 3020 wrote to memory of 2348 3020 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5448a767c9ba7e4a01a9e8de725d099_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcf45897307c6c51ea1d32c5f3ae99fb
SHA1dbdf0ee96b7b1ae115f1a4977e8b1c13683f46cc
SHA2561aaa580ae922bfbb2fb4b429b40869bec6356d91cc746575b95eeb61b42a53ad
SHA51242d7f64b43f25a6a896506facc1b2bc23f3ccdd19353805fd93e2e02bbf87589d3091c6cea17a0dab97bc714b017a43fb11517896a3374b4c001a5039c761a02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5727ec8fdc39b1a0ce19e67be4f38553f
SHA18f237416d2263d8c1b1f8cf3002ba82adf3faa6f
SHA256cd01f3afafc876d26e006a3ec37228e3f06f45eb8a7f376e227aa22a6be262ee
SHA512a3f262b3f400f1c3af36cb43602555ef26a5cb4fae239327ef3207b8fadb3d4cfc76a383e2ed74decaf7a254ac6e4ffb448bb446264b0f4f0e619752d53fd576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528e72a4306bc789ede723803a8c3c9fc
SHA1191e8624fc351205cf0207ab49f865e8cfe49361
SHA2569254bf339f1a578c1d73c86ab5ae15803889cb56051750d2c2fd03f6ec93ae1e
SHA512777d67d56a9ea3821277c913b596a1a219e4ece825a84635c727a205234ba5dd70a42e11bf8117dc8457068c90bdbdf9c29782d616ae6e0eeb0108b09e667fa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc21e9b5bb5fcfb5e409a799a07fa882
SHA11ad37885d1f8370825d93f38b0ed8a47410413b8
SHA256da19d8665cb8319dffa9f8dc98f1e0b585fa45b44af4c34d49463fb028f5c1b4
SHA512fe7e1d50a5137069a686d170bcbeac133719e3b28730c894072e19bd67a4b6e358c8d000f5ea0dc52c0dc4b72731aabef5dedf083516493eafa741512ab63258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1158da132dd0d3762dce461786e7537
SHA153ef93ec7e1de21dd9bb1d0b1cbe8ac744011a37
SHA2566c0709ef08c4778264c0bf135c79456a3de2b7dc160afd4958ff4ea0fb7d8746
SHA512bb0c314d1fe9477722b11137b99c971b6a4cd72ed006b68e6a85fe5deb7061ec31a5507aa8ee292af6d4c93383ffbf7f6e5443883501fcf2fb8cfcfd0dbd9fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4a300fff1d83ed6379aa02937b0b3ee
SHA17c60297939e7c1f027b1e5564894095f8d8f73b8
SHA256ef086c13c931c805cd5f90ed91251a679f362c64b66c91b728845babae5fdf88
SHA5128e3735cddc877f73973c52ea4d4b7233ff9f25946a7fd90d5ee587b527642cfb85eebeb1fd59351a90e2d075dd48191fe3737de467a7ab6d54a4967e76797fd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d1f0069d215886d930a229d95a33bd1
SHA17497e4e026a90be44631cf1c12f8b4305af0427f
SHA256a642e5075dbe3f2c3d2628115f5c30bf2983500d660353ca9dea877328606875
SHA5123137ff5f7d3475511fe609279d6f3933373f15f490ca6f7a8d81a7e8c6bce3d8b58a235d243a1b752932956d78d3cc17214ed9ae1176f1ee03d689868c3778ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9bb7099d9de2f7f848b5c80b02813da
SHA17944882c4f374020d433382109df8c44a02d11ac
SHA2562bd0ff393fe357e71feb04ffdce7caa9c4e3af40e23fc538adb81487c98ad6a8
SHA512701f80f4dec38f5878e774960e438e2c5ad730eb0ef9a5f60b5f20e8082640c31aa52644acb95878339039abf6146afdb840f87b9db87ace67ea0f71fa4c69f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521ed3498f8842b700ced2b1e3f8a4a5f
SHA1f70ec65a1f3bd86bf59020bcceda729af3d239ec
SHA25669d18be84f10d106664850e2f2527ce7fc324907af0f418d4b5963f91af42657
SHA512c1f9af3e063193743b76b02bad806a965b5546727b52e7e85556d0f1556ad0bd45146a44386b91fd0012ac3801cf12d376ada5b737e83d87e44c303e3aabc8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53aac1639c84518f8f5a5cb410dfaab9e
SHA1759c1b33a252f3a72918d11d4d117a2bd7318f71
SHA256af971d60b4e3ce13ee438cfade1e07e6b9e6f80a4dcc5b51c7e566f7017bd31e
SHA512bb3bebbb7b4b25816c0c06c568b82e2ade89b8dc5ba5d54e3fd6b399f5a60b1b389dfcad74b6745f7b6d3a3d2b2cc10fa25a9b77923fea748cdec971b190928c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d5d8b18d28966fd43097e8ab4fc9a6e
SHA10daf9f13d2cfe2d2b02ed272ebc6183f9826a0d8
SHA2569f041ad1156e2e98b6176a9c981679d841e03035ac2ad3a3b7f085dcbe9efaa6
SHA5120016c36209441706415a198ddde7df8a5881bee2147f3afe5584ae1fedaa4a883b3a72dedb2b3d7c76144ffd2ffbd508d52c2b2cbb7318650d9e18cb1f1be2ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5486f6553268e573089b1529e2807ade4
SHA18465316805f206ec4c2bef7a7ced7e85acdec2ff
SHA2567509ab7fc4338aeaadde016a437e58deb31ddbb636a20c33da9fdd26a954504b
SHA5122b398028a1e6af8f5aee8f8c46a39545ef9de10384db8e3eb510509bad40995f067d62d6ebbeb8b0bca8e5f5e7025069fbc909c9aeebf40a42308df7e86f53ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad851e10430335ea923839cf467f5c0b
SHA19255fdd65bf062baef8310bed54c4460605ebc86
SHA256a12b8e2366a767a11e53cc7c04477451ce2781d343684fe4123bdb9cbab5b530
SHA5121766cf94b9969f7815d63e8b5b2e56722bf9e433f2f13de4d512648e2170b591d4be06d95025fd2c7dad926af686e1574507522c0838d1d9b31ae2b5d7c9040b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e82b6021fc0764182d53664d4586f74f
SHA1f39c2c8f05edd0e6e4073704f3135e8e8b7e8867
SHA256cfc0d6342430ce916f25bf546a69375546fedc9187cc22dea524cdb0b0b2f868
SHA5122106adc21ff247323fa0a337b77f333e912e78bc0d53927b44e5ec6cab63f278731ab201404afb95a641c8b81f892fcd9a0fdcdd4307b88250ba11015606aeda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e0962178cda629848fa688fd5e1af08
SHA14e832ee7c484b396b825a7bc43827bdedf78e3bb
SHA25688b922e24d0f6e54c27a2b7b4d27c77b12ab52630773d22cd8dd5406a5e5df45
SHA512b4dadb03248d19b3fb5d5a333635c63e1aa7b0edf2a7cac1dd8d9277a4496be5bec6dbd9b30eb9951207c7e9b4b4ef6a6f4ce3ac1e185d35ce52fe51c6b16c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b8e289cf587d665baa0129e092d5d48
SHA116de6b1601c4b514cf48152ac0d6e219da72fcd2
SHA256693292515e1c0c7480ea065bab85438df690de055e6eda95c82d04366c954ad9
SHA512241a662b1f615f7d309e0f7f25ee8d0e24172d3ca33f22b3c90743af2c2d770806f88b79e17fd41ad50f70f16b06d952f66c2198f3fa6543600594df3a8ed0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ab28bb1b2cc08b28ca9fae2677e841d
SHA18c381b075ed8a5c4791aebdadb6c2a3876deccce
SHA256f12927f196c14fab7300ff74796122ec152defc7296a3938195c12dc40bced2c
SHA512cc7a4e3345e8a3a4ee3f9e36907a5e9cc063c419b90285701df73feb9f8ef8742eacfd132d51ea305a502d9a8642af3bbf6600c4df36ccbf60c5547816d0bf32
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b