Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
b6159a24c0fbd981a7fb5d66b8a01143_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b6159a24c0fbd981a7fb5d66b8a01143_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b6159a24c0fbd981a7fb5d66b8a01143_JaffaCakes118.html
-
Size
1KB
-
MD5
b6159a24c0fbd981a7fb5d66b8a01143
-
SHA1
8b3fa3e37c0ed197953c72705e475b388e76ede9
-
SHA256
d733304c5cf8ecf501d3f5eec0c20d94ad9dc52b65ea66687ca1f0d020fa2bf2
-
SHA512
4cef2a5de875a98a57dc36564a8616d6d53ce7d55e063e5e29aaed4ef02f7aada68eb996994098c83a6c82d59c721a2c1ea731d73880fecbabe569397e69c3a2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBDE51A1-6031-11EF-AFFE-C20DC8CB8E9E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04207923ef4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430457086" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000266fee27825746c0a741195629b804dc02caaa984658647402f2afac9eae9807000000000e8000000002000020000000fe9160cb58533d164ae98fbbf8b636fab5e63ff9fd3e2855f68a9659ff20ec77900000009dc810fe5ab5900e80aafe0ddfcf923554131833e1a0f9cb044d53492b1a5e8e5248474c347b48f44d95ce4f0b4ba0106fa64cf53251cc4d3a89d415a44deac7327a5e68570442ac622201f3b85fb1c20b445fcb5501f193d9b8ece1e954af9970c9f12b8c1ee619e5d9c2d724b7d3328a9f66a6325cdfc5b73585eaa480b054ea52d7eb6033680ff328e3676a0604f140000000e6d69fee69b5077aa5874570a2b3ff6989e44fcdcae2c7ad850a0358231d37b6dbc6fe006859c11596499b25f47010640999afe053316d956cb2abb79b612152 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000509e7ba4cb0a5377af03a598d0707d0bb6340ac31ed07c5fcbb58ac92d93c728000000000e800000000200002000000048c296efea130ce9e9f566f23c37b41fd903caf35c0265da5ca5894ac2d68e2920000000b3fa87e317ee2ead8162c64bf0792d8c5876f9b9d10cddab54c2ba14b91125cd40000000d698425f9e8f49add25c63e461754d9bbac8dcbbd66a1f9c4acd539398330101a391fb2666e9d3c7c540e299b65a472b99ce839fddc3645725aa6a848f2e3623 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2068 2956 iexplore.exe 31 PID 2956 wrote to memory of 2068 2956 iexplore.exe 31 PID 2956 wrote to memory of 2068 2956 iexplore.exe 31 PID 2956 wrote to memory of 2068 2956 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6159a24c0fbd981a7fb5d66b8a01143_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c8c5005cf8184324a8ae32e8d0b1aea
SHA186223378cf43f2a5857c43166007aa7d99cd669c
SHA256fc7f71fd6b63ab29a07128948a163d9cd97dc3cd03c7db2f04d30a0c6e298fd1
SHA512c168977ad52e96140c0c4a77ec2d0e4e60859cecb9d95656196ad5a0e1d836df7c919a7a0cf537c21412f2d2134f64a4d7ccbab6005aac00166dc6c9bf295cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504dc50426d01cf9d81abe3e796b7af8d
SHA1fdfc91724ed11173d65b0749139d9dc4a3e35bee
SHA256df23cb07bb6f6283a5398a1ab7865b513f923d3760f621eeb78353c9149f6833
SHA5123b8bb8e12a116e9a754b76b5b1b0663fd562cc44a448c769146839bb97dee70d8421dc9dba1c018220947c39301459a2e883f40080417b23eee2443f7e142150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5459ba19ead6c9dcb957e8ffd48c55c98
SHA150ffdfaa00515f8584f787c48e64be740f5f63e2
SHA2563f3fbbe6f2542f51a196b4fb29fff568030101ad0b3010dc887607ee9d9dc422
SHA5129003139b0fd7c95bcb46c8c243f0e30135085d862076df87943ef58a573e779638e0053f5350ff89e01d4039a9f937acd93a2de5cd4d5ab46f8ed2cbdae755c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd94a879c13ccc8b1ee878d765afe71b
SHA145d4828e9321606e891f7858f33f9b5e7efb3aab
SHA2563d02d48dab24cd1520595fb83c753ce00deaf14424d2fb49e356c9cd4e0375d6
SHA5125b8160cabe33311ac1db744f59c82e90f2334925c4717a6d8b05c5324def9a4f67e754cb0345e508527765702f2b2531ee93fca4c70446198b89601d399f1d80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6b752d877b0187bdbed482d166af1ae
SHA17a58a634b919c08598d37d9e249df64427bc58be
SHA2566ac45a93593f81dba450b767be1a044479354f3a2fea0821c7cebbafcad0b06c
SHA5121fab9afe323718e36b4d4a41893cb547e36a2d4af063d8a8283325417ade9f2de585dc81fd033333fbcc13daa1b26cbac5c67f1c5e7efe9303c2d8bbcfe8031a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d87da91742b0c530993c5a0131b6a9a3
SHA1e364fab2b87d2f7f8f91d28c07d43df5c3c52a8c
SHA256c10c6697fe14a89e184ad8cf92b7c02363a557b3d97ae6264db6cf2659d99d10
SHA512bd911833c99eae8df7d5e01d59f83b263973440a674dcf257c877144fb2c3842ef0d8cbf98aecf87bb24ac8e4c0d330a658dae99789b44777b9acfd562092838
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5093c512d7a5e7ae035c796cfdde0f93c
SHA1024f8ca0bdd2cefe3dc4476d95b1f690ffb4b6f0
SHA2568f40048e42e63678e88a48063178bc00d66a8ca09096ddc1693397a3cd198289
SHA512ebedd1b624d87e309fb98ed4212db70e9020a3909fef2c043b639c3e52ae4420f41ce2480168696521e5684313adc966f1aa7c4dabd7a8c221028b900e224519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5366a9bcbe0a8d8fde116377bdf631406
SHA121afbe6c04682b82b988857a1ca3ba526669cc5b
SHA256e24bb27692589dd0ae69c62cca3d06233d83b507bed0c5ae6e8dfbe870ba6ca6
SHA512cc378e0c1bbc1b4fdbab7d2dc007ea1e4ca49f01dae354a4dc4538ec93ac3a7674b1ec597fc287a68d319eb4ccc5664b19e3db2596ecbf1e4674683af561c78c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500543b58232aa5e88f82d98f2e04ff20
SHA178b0cb018bc5b876687e7246abbda74dfb93e875
SHA2568d60a6e1f3bb14ebf00be625b49e16ceef33bbe27366e0da421f0b5d0f2f6fe1
SHA512fb8cfd7a4492d56dfe4b5ba619a69be0ba17687e91559e9584c990701cd7fcd297a02c16eea50b6c8075bb06932458efbc1062acb548f22904d2d6690f01487f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59894e773f16bcd0259a5d42a53a20a4b
SHA11c46ef1fb0aa1ddbaef68dfba316879b5084fd72
SHA25665b9b8c46588f0d8ab033414a2b3351fb6707d5425e328cca3aab8129e967df4
SHA51240e07bf189fc7397d0633ef654410a421c0308c1912f226c8218e2fb9734d8321d6d6def5fc002d4c7954101726cb25790bc7cf46423dee4e438e36a315bf4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5201e8c80a8f5bb8cf2db7e4c26aa9e3b
SHA167d19f52fc10d863709df1cf5071134103c630ae
SHA25605b048c0e8710537753932faedf61a53b360e3e31b73ccf0a0b910d3b690dd0d
SHA512ef2d5a9bf8b0846556673fee3e68da7361e4cdc32a9b10ae31596799a2a9370872af1cfd1aa7540cbbc0a2963147d3eaf04d1dc4e8b4e223ec81628d5dc6c180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2ef22e22df3854cce18918e37ca82e5
SHA113e924c7da3f31e7c44cb9a632b3a665c85b6385
SHA256e495dd721c89afd1bbf3d68e60dd602e623fdb0fbba37dc8ef3adbfb3cd5ba7e
SHA512c1a72aefd53accd919cbb0099cb2390038bb2a2aaa542127cec3f7070dfbe9439ed5bc67ba6ddd363b30440826dfa911e2061ed5ae4da680d4e98fcde734dad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588419d975b9e34493725283bf16caed7
SHA1da12d88882a4d1737d227a2e877f720cb0e656cc
SHA2562dd03ffebfbadc2eb066aa153c5f2f818ca5b9b27df489c77bade8ae4a051fbc
SHA512d648fa7b0c96b822d48d40c4c99efa7187f0a1c5c2659b0dab45695c64c11355e6567b477a8105c4b391e913bd8c1b0486acea16d4de32a158ea943a4bffc977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6230a98731baa2b3b5d80162abd46f7
SHA1c6d21f42387e712e840636185e26df8f60e80dda
SHA2565953e8b0a445c01f399c6c25ba78f6e6fbce56b4541524e67782e51ee03d3511
SHA5124e7d63243a5dfde4b2d7887a62162b80889a43d04cdbf73f472b72eee64a28cd6e899c006cebd6bc9bdcf450af1c95baf32ae02aa4d528dee12b028ddc6d2c46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5e147cb76a129e8c4ac00eb7d5ae9c8
SHA1f51ccc8b6787b7f402a3e08335394c2d8ac27b40
SHA2565e196bf9ffd77d97c48a1ce56447b13f2a4f963ca7993a6546e2c2f07e28a0cb
SHA512d9e68f2d53c9d135427e6f7ba662e2f9b16bdb45b6cf27fa5b46c1883553adb05073e840515d6fad495d3dedf0ede235ff7b358b2064da6063f4f3fad58fee12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be5970a64437d9d69f63dcaf0d9aab55
SHA1d9b72f8c9da4ca41878b584fa4d30509fd03c158
SHA256ba9cde22a974b83bb96da159a530e3ea26ded6a45fe291ca893b9be7dc378c2c
SHA5125697be67ac85d9d63f49dd2ab0f8d07b625d82fb5cffa42e1b08bac47922e5ee15e5bca400c221791a8fe7767cdf3d4043cd72107ff90aa4663edd4f8b8f3e9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5273c4ea160dcadec2c8ee7c846aa2cc4
SHA1b58d3eb2164e8534517f9f6ee329314c5fe972a4
SHA2568f7974927d391cf875367b61bc9b3f8dafbf63f0ff3fcd90d5ad827ea0049190
SHA512d5bd36f7dcb4c983870f0c1f2bc979c1ec509b227b6eefddf233b242bc6835366e525f7ecc5e7aa2323b8763e8047bcc5c2d4f8c45e48a545948d1c58784ac1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c7fcbb88c938f46e80a42045f6d6824
SHA1ac3ad4ae315b579363f9ef0dead5f1b0b2e2311f
SHA256120ede594aabc1978ed9b4abbe0e40f5a0d72d744ad9a6bf240a9a62faf42e3b
SHA5124f5aba7319c03d80a23ec574c7da03aa4649db1bc9e8f93cf0f71a187819d7b8324e8546a383acd80c622f6c84ac31c15925a05583512802a3d4430779e3dada
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b