Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
b70c9c0092e525f025c708cee9803c50_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b70c9c0092e525f025c708cee9803c50_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b70c9c0092e525f025c708cee9803c50_JaffaCakes118.html
-
Size
11KB
-
MD5
b70c9c0092e525f025c708cee9803c50
-
SHA1
7d7270939d9ba9c8505fa95b28a720f8a2b97412
-
SHA256
37145eb5ec10c3a3eb5b6740f16766fb8876e20f4cf1b98c3ed27e80ee5abd36
-
SHA512
a95e738c3f0343582f641e896f652a516cdf689fd102348a45d1c942af1676df308a110e8aac4a170679993a0d7395d31a916b6250b95d4d98204c7eee6a0d6f
-
SSDEEP
192:xSJu4PaJ4AzzcsdfAVNe0HgH3r6g+KgIzmW9c9HgIg9JghVzgl:Mam2XUNe0KAezmvJgwVw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607575a971f4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA605C01-6064-11EF-83A8-4E15D54E5731} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430478990" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000bb7f75cc3b1aab245a2c6b7765c688797b15a25f8ec87fd63d767b93a0f130a2000000000e8000000002000020000000c396d0f17caf9b21ab7d240def020e88354b81e99d96bbfb2fddde0818515233900000001ba79296d212197ea2d71c52bc859720da487063fe516aa44b887da5b6951a80454ffc39898efc3dea8de6630fb0f407f22973e1831c8095e3a9857060776f6010ce797105fdca966bc325361b842e3bc057533a07be45ed281b6e996dfe18e6eabf6e8f253f06c1725069a0af28dc6ea7d0cfe4bccf2f4dd8e7a9d8c5962ec9eaa472f4b4b85320a165553e62d62786400000000bbaa21ac6434c4de6c3b368f9c967a5b9631ad8778871cc3e512b3afe6e2bc69f8bfd1edb0cb821838ed4304d7916faf95f62fdd176b2bcd4dabc2262c0487c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d3f6fbe52161134d9087745ae84915466762efa76187db2d3dc8d2c97978a1a9000000000e8000000002000020000000cc731d08d20b5119a3d4759cf961ee12360d4231163d615e9515b48b145b073a200000008649e1d23361c15ced2c441e7749d400cabd969a3143f4484bac32c97581a5aa40000000abc1bae847d3b9ec151de4abbd39183286fd9ae249380910b57645d0c6bbae71e1597ac1cd99fcd42e63dc936a677c2130c09d7eea608a5ffc7bad9165e99347 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2328 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2328 iexplore.exe 2328 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2720 2328 iexplore.exe 30 PID 2328 wrote to memory of 2720 2328 iexplore.exe 30 PID 2328 wrote to memory of 2720 2328 iexplore.exe 30 PID 2328 wrote to memory of 2720 2328 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b70c9c0092e525f025c708cee9803c50_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564281f3db590242b07ce7be17a65d107
SHA17db91375095bf5bf49168676b347bc6e041b3052
SHA256269aa95fd7fa5585099762a87257ab4d7d4f32945e70cf6892d64e1de42527de
SHA512081053293d54da26d080aa3ae1c7205283dfbc7e1543b63aba575981bbf6eb6dfb52f58324732bf27b0f77c402e64b2e44b6926776f22c1af16c65e3b7fca566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac499a746514d686ce39cc882d32a6a5
SHA1711d3f1de4ecfebbd8df47df790c088aed312e36
SHA2562f2f91a7affd5699937bf986a65716408917b9369099955b2d544b1f125f1e6a
SHA512bddd4a34d806b5134bccbbac1ff8d8d84d08aed870d6f24bbf84d86488019ed9cfdedcec5ed08c08ed7cbbe276e3164066f7f7a051a0774d3503eea7309bc450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2e9037061df3f31ae9792475563a549
SHA14327c0f2c20a0e613fe1e06a61c19b2aeff526f7
SHA256256a0d7c2b8f89f5d44961eb7cc7e12dea7e5c212554201361eded06591e070d
SHA512c45ff14861db65de15d4e034608c6a44566771d2f388376071c6e024c072eeb059d31c76f701cace16cf8545518e1b92fff59c9a3219085a2c669467de9963bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5088321bc59ea9e904ebc05c803b97ddf
SHA17f3b6870a279caf7fefab4fde2028732e9cee8a5
SHA2564d87794b721baa3db5769eb2f592a82454cebc07bbd7dbdab3afab7be311bf63
SHA512410e8d8d214b1be5fa600c6e24960164debc8f2793967d5e87d460f2556c56a46db6a8672b81b064ae799cf6f64d06344f7345e843b132bef62b195a1bbfabeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58281d55fe86c4665400e1f94c7058103
SHA1a1d26521b3e57d2b6c1c03afe5913447dfb49a3e
SHA2560bdc820cf509c16981ee9600303c8de04adede045532f348411c6cf56066537f
SHA5125305df726148482d9eae7cd3f661535c9a7a97eda888bfcc2e0028bbadd4f1665ff5f11855bda4c496fdef47b77634567faf0cc1a91bee470aaf326228b66150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506115b5711119b9f9e55bebede07df41
SHA116c18975d4d0e969e3566e5eeeb5337484e2d085
SHA25614efc5cbaadfe56139248d6ddd2cb043b46b1251429c313c0215e2dab3362763
SHA5121637a806bd4d023c97effdd50aa0c8df2d497e84c7c2fea9279d50e442980ca7c00d3c0b2df27140a7406396b4d35e862454e912bf7c196ef86676fc9a9e98a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580e3a979ab18f093758bf0bf870c6c51
SHA10637e0ad55b90d70544c87f8a629b8451a078ba2
SHA2569b92cf6bb414bed55ba98bf7244bd275e57d4eee4e1d80455ec34b53f5f2c81b
SHA5128a2c4df92ffb3f3d731042a21abd11a7efe080db6632fe763441d7d8cfaf37e1957cc9dbe7b7f1b37f7608d87b989092292ebafcf8ae1bf83378403d6c8d4cae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5438a0782c50d39d673418a78344a5578
SHA153ca5ac81c330c0eb31502e4e0d9cc385b7ad2ac
SHA256bc653ab4a5d720896da146b949d955f927f5bc4887bde91d7fa6b78c78d355b2
SHA51252aa4cd5be2ca126bfc4468614fbceadcbd383930f89de06606c44fe01106adb15ef3aa1061f446be4ba83874147f80f62f024c11dc827b3df27972831059cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebb685920fa8f843d8e6d2bc0a4971a0
SHA126e6029884b279c84fd79c94f9a5e42a5380fdd2
SHA25616ac87ac0a94ec2bcb278409f7f020c6ad02dec50c5f8a0ff7d6be48fa45adc2
SHA51247f8155a14daecb90820a6125035bf5de1ace254257af13ddfbcb339308e8c742992378a19ac18f89935cace25ca5fe3dc47c5ec6d213b70d7591680b549de9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582ea26698678d68bfb06d0f3722e0792
SHA13ad787cb5a2c63bdf867a2bf1af0e58485e5aa68
SHA256f25e4bd2a7e09dc9ce77f2391e5fbcae507be3c25e5fbc23c4d5a65200a2e077
SHA512850a3e02194b13de7b05c62f60afbc9a7ec8a04775d5fe9fd54b0bac49be7b08d8e74cec12bb05b61c75a4876afe1b21e7ec5704be00870706d895d3031609ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da07224a58cd5c676762ac680df158de
SHA1169ed41c16188b51d9d9bece6d3d1fa1ac66ce78
SHA256dc114a47ab9547d98526f3515ddb41f88826e0870f01c5f4120ce7da6efb785b
SHA512b1a27d71a5955dce21f062bf8403772a3d00143a8f12fdbefa73c61a46e2de5beb1616ae0e649aaeb190dfff5d6dda9d57836ede06cdfd2cfed4025883facea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aff792002f9a6c02af5c5ee9ba54a129
SHA11399b55430be4186f7ac140ea70b01ccb01e8cd6
SHA256984694793544ab5ebe54f8b0d66eb939bb8609667b9ab95ee57548f9f1220e1c
SHA512a1caba2f7e8fd4bf61e2926b3b17824f20b4ec0d282d0a3cb08764c020441cc786f2fc068ab857c27afbafeec572c3f473708f712e3dd4580c9da155c5acb68f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546e71dabe67c13611cd640179450abab
SHA1abad2fa60646029ce24621cd16b44396637e9281
SHA256c007449d8f52cbae0844f82752bfd59511e7f3f86aa9b3b89eea3a6707465045
SHA512eae4c464f04a1dab4783e19d0381b09cc6dbc479d9c65f0a6b9577ee95815deb77e3f165fc13c3ee143e562143b09cebf48089dc932a11221bcce4ba004b10af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1922b5bfe1c5d1bcb9cb8b9cb053c74
SHA145c093c037bbaf078bad7b7ca2a4568c794bfa4b
SHA25603c22f60fef2801706301b385a40400e4198b65c1bb1960fc518fa844ea9cb5c
SHA5127202a1fce09d607454092b9c89b49351cb6b914b1833d573af8f8aa122807ec2990595937d4a987736db033f59f7fef38ed5d0916dd067065b7e577853cb8f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ef5a2c30257bc012e9c656245d08388
SHA17f08bd21db4ea0201b89b7bd354d6841f0c92db3
SHA25621a3540e67d026d4066ffc6b5bf84230afb1e4d6439d1eb0f1c3560dc24d06f8
SHA5123b4b09347014241e6cb2c24064a225f0c0827093ce0c84a83bd7301ddacaf3617237f0817cca18b701b37743241246ffce46cfad024cbbdba5abadb545ff16dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c19b495268a0adac59c567688c7e64c1
SHA192cf67be4b932e78197fe669ca8963166b4a678c
SHA2566c407a12cb7a47f1f21e44ff45279088853436da4b063e647441885d26b90b87
SHA512377ff292bc897c59625632ea9ed58c7659673801ec83c0a43be65074740ffbdafabd97d39ccc3fd969d7c7abac0682f332b5cd2aff80267410e055b9858abb31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557425f7f820597faaf3e081c8d64b227
SHA101cb7bf1835a482682ca7b3e78ea5f9ca67aeb33
SHA256ad7a169fcf41ab2fccd9e32096eb83556e5b99a88de8cea34b5db72278056295
SHA51228230b8dd693850279b745aa91d3a05a4e3b4b83d46618f5a29b9cc3bb4453296f72e185e1b209a8dc65d4a2a500ea6e76bac8a85ee143312b5265a8c502130d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5587ded3b9ecd97305442a00b6807158c
SHA13cfd508ddb714a8a30df99db43020d77d64b85fd
SHA2564d9eec1ba26e3a250e96a41c5e8bbf30e9301481e26d1f1466da76856e2c0d79
SHA512567bb47ae3b181ee5dfe995a7870d7b937d971a4cafa7b1e8eadb9a5e868e263603f1de0c7bfee8aa4904bc7594e65b070b2d6a9e40bc702ce7fee3459badb9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564f980e338eef40b444382cda4c58188
SHA1b6e73ef8c085695c1f0718abfd420fa978eaa2d3
SHA256f97b80e490d90979dcbb8fd9249bf883f10d6a2dc239cdd3da8242c46df9f406
SHA512f9eb1f25a00ac23ac11fd5bac2d872f0a4eb7243ca6fd67f1392b8fb70fba1ce031d724f46ece9b45762ff25df2c0b589bdc5dfd923cba278bc0d062d2930b65
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b