Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
b25db4a5f8c68dc08a34599c0e45444b_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b25db4a5f8c68dc08a34599c0e45444b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b25db4a5f8c68dc08a34599c0e45444b_JaffaCakes118.html
-
Size
11KB
-
MD5
b25db4a5f8c68dc08a34599c0e45444b
-
SHA1
603fd2daa9f1172ec26b1dc8bee37c92e38c8e9c
-
SHA256
5bd43acd449942cb3a3f31706f0bc2706a999b6cc0e5bb781ad94e5b9ff4db05
-
SHA512
4c6a0b775363a533789384228825f5cecfbb55ed0e1b97fea1c4623cd012b0c9bcc9bb67d1c1dba155d175e77a0cbe103c687f020ca72286e6f50f1adb42324f
-
SSDEEP
192:csz7m5AYS/y+NJowRCVPUyRhYuPikPHb76f:c15AY8y+d0UKhZPiAHS
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e5583476445b0d0eae8de40750a61fd8d5e2ddcec490afa47fdd7b614bfc1a41000000000e800000000200002000000073c8e106de996623e90c6336b538e6562fa5602c1664d6e15590718ab4ce70e7200000003e434b97eac2abd58596ed22002ae89aa13c4b678592c3eaf2a25b6cfb50480d40000000df5d3bc451f148012a023f4dbec20d42a8db8352041d0041f7ead73ec7ecf67b5f3ba5801ac79af4494a41e87538975f12e3d5bc84748e20d03e5ae00acbaf6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a249c890f3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1B4C831-5F83-11EF-857A-72D3501DAA0F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000eecc79a85e358d84eb952ace2512efbedccd9dadf7f1fdf4a43a5f4e4cfec6fa000000000e8000000002000020000000334f8999905dbb07438f67ef6215f80d60da345613ad821e5a9a3d962f5370f690000000488d7635c4327e10f18791f1d8d0db312c9485dbb487444147f05c11c88670da742fd0a5efb5df8d23728a01d8a3f4981f43b6740a1c9a24db6ebdccc074e954743fa217ee0c66a09d4425627114315b3a2ad5aab692440662be0ec60397ede75cda12803478a210929990d20fd351fb31da0c244f862115689335c7dc3f255c3bdde32f9b96f815a79c055a8a82bf884000000019ecc5e99211e6de25470bfc53d8dc20feaac1ec27e0dbc24a810ccb4ca19645832fe0b6d3ac11d20244ed629a8096f2af7abf6320616b64b946037ee647a26c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430382445" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2464 1700 iexplore.exe 31 PID 1700 wrote to memory of 2464 1700 iexplore.exe 31 PID 1700 wrote to memory of 2464 1700 iexplore.exe 31 PID 1700 wrote to memory of 2464 1700 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b25db4a5f8c68dc08a34599c0e45444b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4692a9f6310c077267d073ff47b1732
SHA1ee5f48e080c1ba597a2d22ccb63c02d6799efe34
SHA256e700cdf3daf11172a16178eac60feb71ceb5127c8c8874a66254e48be4522124
SHA5126cba9b30de775cfd05fe39ae5a144b460b08faf43a3bfd2e0dd73ef2cc2c4d26621e76b8e84594098c23f7d71a12077bfe4211267c54c3c463fbed3f17c39e62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cc2a445631f7abe94da04d58ad6bb8e
SHA1e093dc136428c699d714b2f8fff8002152790297
SHA2560c5edce6aa6b00b20567acfe96c725e71257fa247c72d49e31fcf497802b2137
SHA512edee3bf44c15040bcdc193a14e6c5c56999e720f54056c3643d71eca39c4b79ed602b556f1692a5498fe3e9cb1c91ef3301a9fb67917923e19d59f658b65dcd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5790d6a35fb803a0852e8c746443ff817
SHA177d2e9479c7d16764da9fe9c8f7afb7b3676bf8c
SHA2569eb94bb3d0e69809ace1d67fea1f0e7041a5eca0aa99e6f8b8e6b8cef2e86c1f
SHA512c04331a9bb0f67762bcea5589a7d8f7a6b3a565abbf9f494dfd1ce452bad693a6d90d2f8bb9f39d623ebab95c981a8834b2fbe5862fd3963896a682062700c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503e5b089e74436933ed5f16b3c18a0a6
SHA111fcb0c673fdb8671a2a62bc1a8ca5d0ecbe8454
SHA25653c8f5c447e8172219c4d0956b468f0d298fc675bcc6976ea816c0eb746969dc
SHA5124553a27e8666df4aad1ea9f7fe66c62423d3739b22b02f1b3d2a0440cb9e2190d4c27b04006db833aea33c441fa42c215e735088455a148d3b8d795cd24ca37d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bda95a40f8702b2a7883fed3ef35b17
SHA1d67a854fd6bd33e3c41be752cfb93f81b6558be3
SHA256e75e4326ed505e27406db0eae92b29db6cba0f127cbb79c949573ce6a247eb8e
SHA51280a1c8c02e7497524fe173138d0f9bf27d7e603ca58dd5ab879bc684eea84e38bff2f1897cc9695ec5f1e712800a53c3f0c3200060f109c0c2ff3b65adf21e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e7aedda6a25e5e13a8da4ae3a6d45b4
SHA13a5a86656c17b14e36a27ae3bf9130d39f8fc0d3
SHA2569885797116d7059c235f04515dc55d0c14a037c2462d6f75ce9514f2fc1c2d6d
SHA512343792d1a5516454567b77f4d67685486daadd1f353a45746fbd8bf48376e5d19e4ffd126bbfeb78bbc4954c0ecc494da6e8fcb727863f21edf81e46f015bd97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521280bfbc7ff783cb059ba5645dde7a5
SHA195e4ab6eb8dbae5190f528358be97c62d7b86614
SHA25679fbebc3d5f760ed3a004677341b81e59da4dbddd6cc56f90b95d9363235ecde
SHA5127a8c2ed0df6e28fc5621316aa9bace128f4860ce53388b9539c8caa5e965080cbd1a8bb5b10dcb0c100742e4ca3c76e88c6e4bc6b542988fa559e0afb053c7e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b933beecf52143ba6532f1fb65ea21b
SHA15ba4c3e1ba4394660f05f0855ffe24ec950bb227
SHA256c8f5dc4207384f5b4c428cf5b397e390e27588e83cae6e60f0cbbdad04a5c708
SHA512e7482e5ae92d34537f2f3790599447dfa7416615839334b9c41274189f1aa88c8d32dc03e904d39b7319864e5e146e7ef968e8385f0f3a60b2cb5839a30451c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e0b887ecc6efe4bc5b3f0945bf75eec
SHA1a77e71af2010e1a061642a46e8dd07fe8d004ce8
SHA256b0c4642a8eb29278c0e1777efea78427087306a5f1f64f9044f4fa7a96959a23
SHA5126eea5931d41945ec1217f3189edd84e69b32650fd20feb2f857550b65b1151f23bfb87782634d968a6625d522efa52ce451052ff21aa5eea4861f97f94c5dd83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d776c53dc8606ba136ca4871c6998b3
SHA1bed2ad1d45ff80e32111f4cf447155a470f921ec
SHA256fbb05cbb16895ee99f8391ce5b42001cb2365687f683e7db893ed83273475ac7
SHA512b00c4599478b79c6e12c1401bb6a9e8eaa2702d003b16de73dc1fc6e48703476ea0f200338435b93861472227dff8b687b2bfe005ab0e4367375df169eeeabba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f950d8c809d44ae4c93d0ef78f1f786
SHA12aafac0bafe321c1d9e13bd5d38b23db66f8b79a
SHA256b7b4d05549f06a64fae23226ba90234b4b1d1883a7f33b82bc97d5a89ff44d8a
SHA512ff1617ccf24ed1ee1af4ca010be822c27bdb0d8d3f390d7f6bdb96eb394d2c35aa8ddd55da2ac407f1932b8bdd0fbd877e5a7dc1bff3ed2fe43dc83b93470c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595a7a6135c5b9427eed6979c70440251
SHA10e743314707515d18f121921201ec2fb541420ff
SHA256af5e17859419ee9e452ead7071f3fdfb000e3a4bcfa67899e563dfa9aba10433
SHA5124e84528fd820fad6e17cfd2d0225eb64c8d5789f890a1cbfe20d54849a84b6e5539a47090ba079668fbf983d71db36662668169559355ba711d2d623e47928f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517bcbf424217fc9810fda88cc3c90193
SHA1da15db9d7dff1c100e195a371ef7513358352213
SHA256dfc61a101fcfdf7973705f27cdbac737a0779347f59ae79e697405003c0bf471
SHA5122a950ee704d0a89bf4c9e06af3e3a523054af15cdf89ffa64eea3e2567edb4267381d96320bdb1512ee12f5dade315e312974f5d3e9472fa65fc6997f36f9b4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5163c631152e8dd3a4c44fcdf313c1f5d
SHA13859d224f3450f5f6407b83d78695a91c4ccec34
SHA25618e24e7721b04f7b8fd2e3830607f9142eea74f867e8f12b63073cedea0440cb
SHA5123f2039faa7054a85dff479f1f72e841429e64a4af45cb1bc4a2f6a44423d136576e2206794d70c6209126bfaa2e73c1aa0a6968622703bc34c72d961fa23e223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a4adefbc63f135733bf695a619b53e2
SHA1992196fb0bc1be4529ddf9f423642bc257089c4c
SHA25688a816effcf3f61c46a9f60052f0aa5de3af250cc188cf71f9e9cfb82961cffa
SHA5122e71a366862f62879aa3cb9bd13de054221ff165534ef65c95a943028d901606f933cb62b5e8de71d6d4d9860c34f6d8fe918562d7a139c1c7e9c415c69bec9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585f5605cf6ea5f2f7cced53e3ed0ba3c
SHA1a1c428854115d73c38336791e6f4861c218a66d5
SHA25690870c60d655e72b9f56f50aa05e28b1ab2d24ea070c041af64c98c2654a3eea
SHA5129b43cebfe6197c70c782383d5217a672a727830bd7b41afaa76abafb537388c4fa1345298623bda80b66b68f672460a8f36ebcd404db4303ec44abbae7e1f713
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a7c1b6f1fc509df0d08f81fcf8c6fcd
SHA1f095a22baddc8e61ee39d1698a84bddc48e3488a
SHA2561be0f43fad6a2d0f6363b5bf2f39a972e047c55d17df6740177794d38ec6a98d
SHA5129cfa489e881795f045f6135976353410c254481e5f43400fb17c6404a2c99cbe38ab372d2965ea4989e70e1bb6ccbfb01733cf332e81a842ce5889f059382379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1ea2e649abf032c1af1e1a1ed61708c
SHA1796e54ebd9c7c0fff5d18ec7c5e1c8972fbc72f1
SHA2569cc3a6ec50f8702859816bf949d6c810d6c44620a46e74df1437f29a74ea1c6e
SHA512e9c09fc7cc8490e7fc86ba6326e5857da0e20c8ec05d65cb2e02a19cf7868da70cdcd604c7cd46c72cac75f2d5da9aadd84760ffb8a8fd0882a152403aa50ddb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b