Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
-
Size
18KB
-
MD5
b96189e2a7ccffc2fae6a9d1c2faa8f0
-
SHA1
0f62bea10ecee3ef5cbf0205c481e7b55790649e
-
SHA256
2e26b585b29ad3f8448ec5c22960ee35a8cb74b642726dbf3909cf70ce36b126
-
SHA512
4c596d5e0376c9745ef4efebb22f719a594248e0cce80a2e9434b9f90313eed9ac6700ce5fe7d338ff602476045c8450aa5f9852deba130f7105db8cb2454dbe
-
SSDEEP
192:VQ5cVZ7oxovwLd554ba08EFhI04YLXar4dWZSj0VuPfKuHciXOdJgU/hLallNK:e5cVZeNzeMt0dWZSj0VuPf0EK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430529051" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ccd61ee6f4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49B38431-60D9-11EF-81FA-CA26F3F7E98A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000008ae3a0f580d60e37f8c0e4d32897816051b573c6150c43305e646334e47039bc000000000e80000000020000200000005975d46eba3c6e5499b9b194c4cbd65789c4c5418f6065bbc46101b5902a2eb090000000dde6b8c53ee417c2f876610c54d12dad2f701a805bd7b46b889b88d8c5265e7047398aa0b08f2418cfee08e321730eae5fe59f0bf91186aa068814c51ecac4d904b09112aed09af576c18495b52eddfdb6b42d0b97243124549cddd001116eb60ad4097579194e6cffed25d44a8359488a0fddaeec270f56d7841172982095085f8a1681151c578af99f7b08fc5534b940000000bcb0497f2153460df60be4a8521c433a19d72ef2733f20e22ffa9e9da5541ae6919aa6015c153573909fec96324f91f26d5abcfb5e4cd957a2c02d8c025cca46 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000037ec5e809703ebeb52c6f6b5b75597173e37622aff13d0978e307073cce751e0000000000e800000000200002000000052ef7624ce7d0b809634d4db3e65a1c93dd278d77a1111490d99b58cd3c68be320000000cd943046097bf8221297fb22f16c93e902f44ba21c65291ac4748b79a2de64f7400000003d4c89de568dbdfe69c5f88b2bd6a03e31f4353afe84c33cfb50cab5155514b2a34cf01428f3f3e1dda15b27950cd00f83b168154203d8e99b45315c1cef7d28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2160 iexplore.exe 2160 iexplore.exe 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2836 2160 iexplore.exe 30 PID 2160 wrote to memory of 2836 2160 iexplore.exe 30 PID 2160 wrote to memory of 2836 2160 iexplore.exe 30 PID 2160 wrote to memory of 2836 2160 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ced2dc767238052caa2a4aa0970b177
SHA17711ea12f8b0b380d353c8391ec2198b7cc313cd
SHA25668b9ae1b58b04ee86f25e1e3bcc83995f19000cadc9276b5196b0c897908d5e4
SHA512411c21004e12b2613f22dfa2b4fd95122f31ea05b1d782e788f95ca6908216480d7130998d01c2243da8ab406716543943ed5f79942e16e7c082f1dff4645ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5446251b5020a986ecc37a58517685dcc
SHA15d4333e72994ddd586d795216737a962d8d5d80a
SHA2562b2d7ca370b878f8b25ac7535a4393081649f571e82f653d01f7e3223c66d155
SHA512036d98abf6841c531d2e96237bb8dd20bc05384988cf533edb03c42bf8a59d911e89dfd5ed9e23b91a2183f5c35064e43b39b516c02ebde5b2dba13956c38bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aec4b8b0208bccdb6143fb4b8c6acb5b
SHA10447c491fec1061aa06d230ccc9747853bcb8ec7
SHA256e5e737ff373a8d912ace8abd1e8daad097baf8a77897cffcd12be760e591d8f6
SHA512dd3aa120ba19f5ea78735441d718f4794beb34cccb1bad438020b162896e6f82f8aa9fe1d13822f4758bb527f31d986c02efd612de5e20ade7f27288e074d4e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53278a1bc7afcbd1561fbc6f20e0d7187
SHA1cb88b5490ca759a36458e8b8d4218ed748533fdc
SHA256404e65e1aa936a116ce513374b46ab84583a8bc86a75eeda74ff1839d5e91183
SHA512cff16bdbd7af42fe98e6a94d1935d25430671b26f6869af80b569a9cb190e79d3563f9fc7bf16013337d41827c291e16646f3091927a07c68703f55a5c1cead7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552175d8605646dbb16d73cb60ffa48ec
SHA166fac229ba78fd2effba5a1919079d442ff5cda4
SHA2569d3ab7ec91fe200b143973eeceefafda24d064586f045aa863876cc9a7c3cd28
SHA512be015b2f4aa8e16c27aea412ee85c8476d718f74ead987e2a3b62f8f51c2826aa8d96c42828049e3f2ac93f27ec2bb4ab90ac0f7bf291b317128ae4617341128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbe1208809c72590585bb06ed0e68a3b
SHA125d29a0b3dd1ebbf67f78c26694723dca61e05b5
SHA2562b290415c8770c006fad3fcaf8cb3d734e7432ca6df84c30d732c85598708e72
SHA5122259389039af0a43e61b52e7a30c078bae9bc46656551c51bd2bd1f397aebbc9a0431f3d59e20f883969f17e3a4b98482056e9cb635443bdcd03d09325666261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba9cf8b883a8e6e8b47f81910c25d182
SHA10efa5d0ca070fd33c08d477aa0bff9ca3cbf2e15
SHA2568025bfe1d1a293c234fb9f8fbb982a5c74fcdd0d300f9448969f50e94c3104dc
SHA5124d16f81d883888739f6fc7c77c64841826f8b4d83b619ac67a761a557489b292622de95f4f1d12d4d675d3278f394e0411c58defe432cb6614c57bbc386f7cef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d3fb1354cad22f6274c90c9ddd27def
SHA1a7a7ca4557bff3d26dba94cb06814b2f088c0d77
SHA2562e414a1bd9b2f11ad68512a9fbbf2f88d7d4f7d58382d738f8f50e1b90047ef3
SHA512f3236ed5ba96c85c08e26e4715406d3d58b1fe750b944743098616e694ed1aaef5808d9dc379d055747e3d38e6d0308b66a40843e9235f8674ddb556064a8559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c1f85cdb1d051e888b139dac0784526
SHA17450cac8cd511b51da632e7bf7a5d9357c57b6f5
SHA2561872aad4cd16952e2576d65ba7877ae47f5d3591cf2fdb20af2e9eb158ac73fe
SHA512c7d7420c7472391da3f6b9bdd0e404cdc2e4303c33eaa26c696726dc3f36f8e3ea6bfbd4aad37f42600503eedae959b77dd50f0f4807f6fbbf66e07c1fb5afdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bed1d2eab2b6f83b968fcf0123f15adf
SHA1f314c6baded34f5e68545a03fac85422db6dd07e
SHA256877f7ed8f938ec6386ba6f7a2bed9abb6890a58252780497bdc9fab2d277d9b3
SHA5126f1e1f24e8663cf6a61dde41cef49bc4022d282ab03546dc7135db7fda58d255beea0b1b58802a55b1c9da868bc437350ebdc0c5b4cf9da91e6e646004e32ae7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b