Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
b4e51b2c8b6afbc7fc5db533562d62df_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b4e51b2c8b6afbc7fc5db533562d62df_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b4e51b2c8b6afbc7fc5db533562d62df_JaffaCakes118.html
-
Size
10KB
-
MD5
b4e51b2c8b6afbc7fc5db533562d62df
-
SHA1
7c1e86f997c21d51f976cb101464e9c0e4098af6
-
SHA256
49d51e58580feb68b0b7a6c8c33a3183f33f642e80f846127b7d6203bf6a63c2
-
SHA512
ed6f6abb8f5ca85e147c7f258a3708f8102fcaae9fd247ff184d98a7819f6e455bb85bb0be1dd419b9ae3ec35775c7545d8d739ef758e516bd90115bb6dea4ee
-
SSDEEP
96:uzVs+ux7zLLLY1k9o84d12ef7CSTUOGT/kP+pSps31DvMdlwe60UYRDvMdldlVHS:csz7zLAYS/n8SgaNUYRravPHb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d91780fbebc11f4c87cf75d5d9ba26e63493841bd21f483e96ca7f630a5f014c000000000e8000000002000020000000230a1d4781bc8c5b2c95d1399235000f188f1d7aa8380ae836f8c7ee71dbe8f320000000dd728fb660d4ca17c732191e4f86869d4042827ff577196084e6979e138f4a5d40000000dcd6c130118bed3dc803f84eae07ef2dadfdbf14ac34e57382e330cd3455178f9bd88ae2832ad395f1640a160302801307f83391b5268ba3aa6c381391f49be3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000000eb85910ddfb70b59080c7f2dd919f87fd12699e920aaeaabf6e7cd6f484c837000000000e8000000002000020000000f2e44205bf763644280e6ff142680683f004cf20c0b3d1ffe9fcf7e323632325900000007bfb1a4b5cf9e90e42dc9808445e6048bb2e6807de97a3ac4a24254bf460c9d2ac52da66d793bdd2dce8c106891fd163d3118464d91263233fee1ac710d9468176a3a95ad0a42aae2ba020a0e9e2c7072e8965639173eec8d160b0c61925bfbcc1a30f896c891830aad3a733e847acd3ddc7ecdfd5399867c0c79341ee7b7ca210ce0c0cd7e98069bcd977bd92b3f19d40000000844db937dd229544d5a840c3fbec58601c9e76db9c36c42ae364b320c7ff781becb3ab27ac7c35b10139702b34ef7882b07fa14fb5f4c6165d3508c895264e00 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1E17421-5FFA-11EF-AB78-F235D470040A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430433449" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fc668807f4da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2680 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2680 iexplore.exe 2680 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2392 2680 iexplore.exe 30 PID 2680 wrote to memory of 2392 2680 iexplore.exe 30 PID 2680 wrote to memory of 2392 2680 iexplore.exe 30 PID 2680 wrote to memory of 2392 2680 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4e51b2c8b6afbc7fc5db533562d62df_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565985f07cee13b2a72c902e334ae1695
SHA16f2da6dbe73a8e7d131855b8ce54db1fd8a894e8
SHA256a59c75c58a8f2ed63ddb1e70adbbc7e810ccf53e19fb892fc0d7775cdf804bd1
SHA512c87fb82db466dc663c254fff253463414c8090199470c5477b4ba647373b43556ac135ecd38f0700e076e17ab9dd14344e121df12ec1e78a17e55b4c25d68941
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da2607b5b7e714a626e74c9cf7a4c33a
SHA1e25ef1ebb219f1d6a62bd2d2fb2228d463a18409
SHA2567ef796777813956aef6f39156f929fe3d0f6cdec9b46d5346b92122620e25ce9
SHA512f837b26790b0cbed0b390564b371ae75a623e06c75ac16f714040464c74faa47bd4848c0ff5debb499edbaf71376fe3764f5b17973d8498ea828f2fd25c5a3f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5c8b304c402f553a7a2d8b5264ed518
SHA1baf4cbef043fb69ad360a90b14b07408c1f9d839
SHA2568986b75d261c259dcfb47deffc784efa3c81a0476d5c226cb5594e5b26caab81
SHA5128b16dfd4f682fcb75b7a46a407829026f58855c43bccadbb6fb1bdb3c503f0eb860718fba989f3f4afa3629ef1e66c9e55fbc67efd0f6e0e3bd77054776601ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5589076785b31cdffd65b7c854df521f2
SHA141384f0cec874a8ddc99bd4b1a418c330da05959
SHA2567fa4293e51d1c9f4d337fe6ee4b4a32159b0189e096ef229941cce0a494ce149
SHA512a4200c7cff67b0647bfadedee22009df0d0ec5021e7bccb2c9329fc33bc4acbfe6103f5a60e27b2fdb0b2b68aa68588de1108b5c0c977903601f00b7037418f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bd7d7d926b71727cc418f3cee4e7e04
SHA18c9653c4cf68b52d52f15590740f977034df09d7
SHA2566d6ed3983d1090b2e910d62ebed2b4245fdff0bafa175a73fb5d09f5d0b1f5a7
SHA512475f43c86cb751fc67db57b9d7dc018cd671f7e454d01fda28b88c830a439182d99b5564c8b4d7d8da2ed310bf76030db129cdb9ebc5ec39f4d9021a7c62ea3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdf81d3afafb74813e991f4f0842e4ce
SHA1c4afbcfae281fffa62dce614d098b7c8f16a5062
SHA25677d3671ed20d61d58c4091272f4df534b18f83df6439aa102f57d2a1c7520c4d
SHA512294b95501b1b1705dfa773dc292b7764db12afc70bcc37bf96002806b85cd499607fc1c56fcf1766a6beb3ad0dfa6a9e1ecab1c89acdf38a19a4582469dddf44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5793a5193fb32982a35e2c90105a4d959
SHA185d3919f91663c6ed354b7fce6f7aa40e9a5562c
SHA256b5ce7989294cd4508121f8909925fceea29c078ef73663bd24e6d278d8b11b61
SHA51266357b13f254c5f6a3f427df68b5fb270ad53369ccc9fc5fbe78883482567c76d4c96668e92d034df901911b6a35bfa2257bdaa847b9c8a54d5d9180704a98e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50df0ff47748240957f86c7b2a6f05b02
SHA1e99830ad3a277fbacb7e35db66d6df7618160282
SHA256da151c6bb47c61345d811a0d7cc902bdfb3f6609efc134a50db362839ac8e682
SHA51246f0c3630855d0a505197152f4c66cba9f9cc2721152e0a6bf9bb2fdc7b9a561ac7ab5dfd27353d5a2ed6af9102c9de84f1da92a94c4efd29976fdf899f2723f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503839ce9e6aacc73b6fc5d1bb1b97060
SHA18eb56faaf4e4ecdc2503bfb5d12f7985e576a5fb
SHA2563d5575424a30bcd0053a6d8d63893298e584bd984c563c7b206ff6a2353e5971
SHA5121fb2ef76027bf2078d8ef6f63f2c1c8be13ada9f5b4da0e1d8fa90a42772df09ef1e5a63d36d55890738a2c4b18fb2b29c1c28fcffbec324450682b266f865e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0886fc386b070e367e6aac9dc764259
SHA17a321b4b6497005d92b734c8f28a3e748ca516ae
SHA25639ab7f55c0681ecaf93f0b84c94dee123df1ba54e7a60025521230ce309433f5
SHA512a0ea5ff5434b83d6166175b510e92cbb9434a0cad45159173422a74913ed643d9a5f9b40b8456355bfe40b833dacf1490bba754104ef3eff05eeb6fa30ab6f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f11067f5974db8a6ecf441985db03d4
SHA19cb2dccfee0983e72d6134772ce71707a132b3c9
SHA2562b03fb6ea6d5707dd2b4d875221fb0b02a210d3b59a12a9dba06b801208332d8
SHA51208d326034c793a3dd1551cfc921231d666fd0b82c404aeef5f5e4b1bae51d35ae27aaf9c570647b3c55d6fc44b1648abc0d22be85b1044963551c4eb16023dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5504d62f507cd0b3b2d706dc8d3609384
SHA1622ed664a11867214f82ac2dda1c5e1427188750
SHA256c67b6b1979bd4b3d6e7e9e5d942f41d80ab250cc75da272e6a557411fab8008e
SHA51282a421a190f1b936b3e6a3d99e7cf5741ac77ae7c674c94de9e360bca70d2f69aa3477cb24dacba4bcd9aa1946f9fa9374f1e147df2833ecc6d0dc8af645f8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5110ca196f6555e539526b2549ab5b043
SHA1f16c49c5ed45836f31654414af9b862bc2b6afcf
SHA256e11bdb90e68a9a0715e6b25cd6b95bcdd83d5e8f5dabed4e39cb16b989d87fd4
SHA51268be8fb4bf7114fb6b71af00accb2abff3ead6068eff5ff37ede09316e9c1ddb9686059c30b839de58e7763fa4298c48f78c2ef298bfbd93e04c954066d76795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9d56e7ce02c13e108fd2dfc803204df
SHA1e0b00f2d28d4b422e467f99e0dfdbd1a02cb5488
SHA2568cd1285a5b5fdd1aac2df6f894d079b3728a4799868f153e8bb220ae6e494102
SHA5122a65a41e046c3cdfac7fcf0c735b6b041c0e547602e983f75fc6e3345e3698e35ed0a7e55e8a80dcaeb40ad3dc4bfc074b034dabe3971d1d002207f1272c0dfa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b