Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 05:29
Static task
static1
Behavioral task
behavioral1
Sample
b68244f9f411d53e1caa9904f4d3dd87_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b68244f9f411d53e1caa9904f4d3dd87_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b68244f9f411d53e1caa9904f4d3dd87_JaffaCakes118.html
-
Size
6KB
-
MD5
b68244f9f411d53e1caa9904f4d3dd87
-
SHA1
35b8c197916365c1171fceb841299505435f79f4
-
SHA256
d282a0e60f13baea9594f790f93c63f458531c6b315c8fd223daeed99224ec08
-
SHA512
08e6e72b47bae3a82d1ddd5e4653303e26a6503af074fc5c83df01f5a7786b17535af518f73595a62b4f0cd8f206aa9ebe2183f6fd0d4e43a6cab24c9ad968db
-
SSDEEP
96:uzVs+ux7I6LLY1k9o84d12ef7CSTUSZcEZ7ru7f:csz7I6AYS/Rb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000173bb14452c34aea8fd0d3d7bdf28c957bb4249afdc6ea92b0f8c43bc38b0262000000000e8000000002000020000000a69d9c2f9d75520d3471c212b3fe05043df1b11e5b5548515bf1baacc1565b7b900000008298e3d3c070b757632fca10666aa6f48cb9a9aba2f56b03ad33e65deaf7932199bd4b42e094d8c91da9a7215d7791524e1b9b21074af3486bce8877f77fc16cfd9ce777cf5d3dc545690cd8ae3eb7320c5b174f825fef87b9389da4e543392a1f73869c69a50c89c614ab263426fc00fbc87d2a03dc6022b8cce88cf9b69447c224fe7b3f74a1677d8bf63c487633b0400000009a583168e3a6a92727a048b8a7549d253bb31ce768acd41b02755f962abadc959db33025741968c602753f22a6c9f25f4f19f9c20828643a3f5ac481875d432a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74EEAC71-6047-11EF-AB71-E6140BA5C80C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e30063470c6ede64e4f34552d3a769f6eb7621d7e9767679c99cf50a56138027000000000e80000000020000200000004e5c9cc8ed87c226f64d6f141b19f19696a8ef5048587ecee1423b709217737c2000000000c1f6379c72fc2e9e87c0c4bdb7ecfef47323883bffc6c51576c8d79ce5cd0440000000447b414db2031cf560c6138980d235f2f2140eaccbe8eb81f7ee18a10be500753004f5cd3eb1349e78a7bbaf7db623bd8a186f9d79b3551da246d8a3d3e96566 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430466422" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9069354c54f4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2968 1908 iexplore.exe 31 PID 1908 wrote to memory of 2968 1908 iexplore.exe 31 PID 1908 wrote to memory of 2968 1908 iexplore.exe 31 PID 1908 wrote to memory of 2968 1908 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b68244f9f411d53e1caa9904f4d3dd87_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549e574cf4b55200a9f4d4f4d467d8220
SHA115017cd52f10e8d21140ebf7da412e6496768196
SHA256e2b066585d3a54717b835727e7c4d9cc961d5eb8bba8904b94ede4df527301d2
SHA51250866e790f40fc00a7bc9272d86a358deed349d4a4bdee4b4d8f46368854d393e04262e2c8023bfa0a4bfc96566f32620aeb818e19da9c6f2734ab207b7ea29b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577b430be1c2f30b0370d4dc641dfee9d
SHA19c04495cecd3f4747b3a81404e55fbfa8cf98193
SHA2567c269eb18a8f1dd87229722979f1d567a6c74fb5866674656b7bf7a99c050c2c
SHA512a7c90a497ff303d6aece2d6264bfa54ce2cde8480897dd63aca5345e93c362ba8113064cfeeffcc1e18d25d5ba9d399185b9b8356f9a103ff3fa3defc619881b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5144a36224975df36cfce625901401229
SHA1e5e1d7438d034e379900c77d48277f23022721cb
SHA256404d3e1aabaaa89125cd5e41e028f7a403a790d75ba9c7b17d2b7523162a6a1c
SHA512a2d6d04079859e102c21c6a66897918a23843d743ba78ddad879d05a1d978dc037d6e92de8a3bfb64e94329186f5c9615e85c3eae5c4f9c981db61bc7b471570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f200dc1ef5fefa9cf1e68572284d933
SHA10713df271b23352eef38ce67e8fae7db14586c19
SHA256f798ab61ba868418eedc9bec78359340aefcbe8850a993a9c1e5cc722cf01631
SHA512c52c68e5e6523d1198ae3d88c28c6f3912d80593032e000a757dfd2df8427594fd948120b34f5a904706c27fb5826733da9b69083d8a1aea2cb347b1d5cf4f1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568c4e603180fff85b8e40a34d2a3ab36
SHA18e8e09dfd1419c9baff28b5df62f8b5bb456c690
SHA2568bc0ddc0c11f7211585ee0357bbb212498a3fe186526ea8fcb5953ef196efbef
SHA512b1887910dcfd80d98dcd74f60e25a480d6279713004c57b2a090ab941c239e431c65bb6467e700bfbe4e71d7d0fa31a8a72c5437a0da4666c8347ae3ca0e398f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee0757da6a4f7d039e66fc74b3bc957d
SHA1f47995343c720a1f72202e0c5263094865565323
SHA2560587413f2fbec8a513de21ae870edc428f3e7123a60b332b2a00b163c77f2ced
SHA512cf18099f6da00e72487ae729f446b9518cd8bec40abfb29e52a2815d00ff14a9c4b205df748e2e3aeedbb3421dc6dda753e628872b4484ff0d1efbc39ada068d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b37ab11ff4afa3df106700937e37ff6
SHA11d258963eb3648a728abebb36eb49d9c9f7e33b1
SHA2562ab6d8166cde2cf8f2449025ecf572728b2906ce935be6aa27fa91c3c074bd7f
SHA51226373a4b21a7477c90e326f7a9b899b0cd58e565db4a988a3ce5ef56956e220d1ca299b99205e3640ea398178779cb78ba598dc0251c397b7c96d19c348ca2bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33f68b024d66ddd518722f43fd9dba7
SHA1dc266c843e0a376b7250e55fcdb93b446e0b0967
SHA256df92c9cba47164978ed779f26b624e285db890c41d4f064a7ff275157341a9c9
SHA51284ac2b1d4cc72492a4703024a6aa6f4dc15639d9eec7ab13d258894da4e2a64baf8b3ee12573bd91073780033c5e2e5a2790c387e367d7e80f6dc0942399de25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfe7e02f62356cdcc05496ecfe0a6aa1
SHA13829e8ec89dd38cbab59200649fddf5a6a5ca689
SHA2569bc5843a25e8d2431d57902ef960aa81a6eb8230440a0788c4ae5d760cf67ee3
SHA512b46aeb3bbed2bcf89f266c8e19019d8091625ba496b3780431601e9097fe99db5616fb40dc0c9120c2f089cdf82b6ace309594b498717f8816c0135dc55a20fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c049ff37602704f764d8c60e0cba427
SHA18ec12dfb861ac84956197e69fa1ed892512bfde2
SHA2566744153ed19e234bdf4ca933a794676cde8ac0491e8c303315c8995f808fa7fb
SHA512bc7f0b66f640dbb2ff372224316403534811d5ce3c449d38ded9f783390cead84d19c6d58e2bbdd76cb6e37b307b0d8e058c2caa4fe611f3085825ceda0e9acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b94cfe5b8ca563d93e286249995f12a
SHA1168016fbb36b440d71c33cb3fabdfe9e53e282f4
SHA256652569377e04d419987a251f4d844f7e8aa3cc02cb6ee2a23f6ca6f081966736
SHA512aea08556ee0593ae4e72ffb3291b0e6d6a44069900b9ff79d80cddfb37f2ddb98722683e9cbfabb86b55df762d4da01f484dd9fdcb0b02c2a00c7256a29473bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b19207579fc194d47a95cc14fd21888
SHA1eecbb3e1fbedfe6b5dc4a052dbc0159260ef3370
SHA25685fd9ccb0e8e6821ec1930061e2702016bf375c8153f9c1f3d0b4fd4b078a7f6
SHA512d35d15d1a7f52c97de19f1a1318306926bb767e9e6efef8c3d7fac384e28c4675b76a9d8a73ddb8bb514b82a22de24c611d4e1d175a6e02b200de806ea239dbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5857d46078097a1f2b2e75c128782d161
SHA1099f0385aa367db4842a09d9d244dae0a17a70a3
SHA25614f70fab1f8eb50ea80ee6b39648a01b110b472ba6891edad6278669998f75b5
SHA5121a91c567c3eeb4abc2020c560b1f9f50fbe138574cd502880bf7a91c781793497a8259304d083685afa317ffaa1e6a0408c314d9405173eba4169b396a03c946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc076372ba09db11ba84cb1ecbac566e
SHA11e3d7c31db4e2038723d327b2865f4545e6b4a2e
SHA2561894c9fea90b3bc743c9f4aba7e10da022ed1eb2aee40af946b383f4c4ebb19b
SHA512f42cf9a48b7c2824bc87f10a954bdeb6f88c11afccec22305ab751c3041431a35a9cd1116ba48bc02d9c71adb89146c5a2098afdf214233204dc43f1440d2af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599f18a7e220b63c3e67caee73ae2cb19
SHA132f4c2e5df35d35a572165cc18d9fb8e3732402b
SHA2567ef4acb6b63b29a7627ebb6af1e15aca49b13cece73487e990d962dec3046042
SHA512d007165fa1f84443527a29d64f30a726263606b2d9be2c7f5a4ecf1680704d81c845bf1354764eea24aa059c79e2d1e18232f780c3ea04423cfd99dc9122d9ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a45d75b0bcf55c4a331872532ec07df
SHA1086facbdc73a2f607e6bb104df5f3d0b91896f91
SHA25691d409db76501afeb136fd5a917d27977196a7b779b618eb223ac6d2559bd074
SHA51214e5397b5fe5c4b04ffa8f85bc9b40ce545a339aa3ad112289496d68e5c30e908041fc7c1c9994bd248457e07ceaa149586c56f1d50a2d73824a1f514775f5ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e46bd19aa7d52564a67eb616542a8241
SHA10298c0049feec5f421e6d15f54035731f83964ed
SHA256c6ad79016efeb421dde880ba51cc3b0fe71d0e1018513a16826080560452b95a
SHA512c3fe514cc41a6f4253c40b706848837d94d8975483cc8650b4dff8831e3fe2876f1df95e00f122134119908ebd9c166fbd668f452c21de99ebbd88c1df6fc6ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a42e6d4dbd0d4bf81b758e4692daa5f
SHA1b34cd1c8475fad0225db386f768f50c215f6d950
SHA256f4c03638608525637728ebd0dcadfc5064be507763b95340ae33007629efed77
SHA512abc6e082705b84b80f1d1c663e3e2e0145f69104b727c255b49e3b7dee677c32c18cc8447bb1fd1b9fb27d60b3849d0194ff561d794c531aa99fcf5456424496
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b