Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
b82bd08f069ed803f4562f5e01923b01_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b82bd08f069ed803f4562f5e01923b01_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b82bd08f069ed803f4562f5e01923b01_JaffaCakes118.html
-
Size
1KB
-
MD5
b82bd08f069ed803f4562f5e01923b01
-
SHA1
f0d59f716be8e49d6f491478d7107c85ab3d7dcf
-
SHA256
be1aaa273168b9dcf7a68dd4e5017fc9f164e460ce6ba11e28f46398ed3f7169
-
SHA512
1e4d9216eac75277eeaf5b57caae0f9271ec5696486d963ab1af6f90dd2e53db2c6f99b432e15d46d9df387a43aed7afebc998cbced8c219636f01b767b813e2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d8b679c63be2066985301f82ff17cb5124c7c1ffa7949f48c22d4cfcda063aa5000000000e800000000200002000000015993d64f19c74513bee58508cfc2d35b21a1045e4e97d5714004a173f18183420000000ecb57ed3d645ba961b318e72bebbd2e0c25be0c84b653fab2e4d1f0ed87df0444000000062d2e09d00dceb65bf5614483214bc9e035cf45b9aaf9b0c9faf631e92e3fdc88ee0321fa1ddaa3543f6a6cf318da68f74b99779d940113320c7e426a1e9c379 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01fbe66a8f4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000005a77f3f446005f5d2e0f71cc8ef3347916a61b7e0848907333fcc88267cdd9c3000000000e800000000200002000000095e9a3e7e507cd2b7ceffb784f5732788f1ed437f5f002b91e75ee5b4e63228d90000000a2fbe8f1c37db549adbcfe4cd1f0ffc6e3b703d5ce5feb00118c313a7e43b46a77a9719accdbd7ff4129491d54aaad70f82070a8c934548fcf5f94f0d63335a1892885d426efc489a42e75c94a2d29bf9345489555c2db9457a47e7c51d4936f0f65c5d8635504c6d0087f5702d22f74d1ff3f157f773500ddcff2c3d9491a5d1929d1a238eff5939bfd2e8114f5f03b40000000ad31dd467684fb419a485869ea985ce91ef6705cde3ace2a6f932dea0bf231481547222d88b134b06f514357c71e067529d9cc60cc468d5c47d539d56e256a5d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430502540" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FF11EA1-609B-11EF-B985-CA26F3F7E98A} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 900 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 900 iexplore.exe 900 iexplore.exe 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 900 wrote to memory of 1520 900 iexplore.exe 30 PID 900 wrote to memory of 1520 900 iexplore.exe 30 PID 900 wrote to memory of 1520 900 iexplore.exe 30 PID 900 wrote to memory of 1520 900 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b82bd08f069ed803f4562f5e01923b01_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc2c0c9ee70a6ccbb76ffdfe54e37387
SHA186f2add47530900fda9e53428b106d682be738ca
SHA256019f8e0f34f2634ff7d4093c87472e817a75cf3a1c71cbf0077a6aa1edd9c250
SHA51294812a41a632c5a8a2b2b90631cab65536bfa60474cf2ddd7a537a653b56422e27350bed53afd86ac6aba63513a20db489f18be7cea8d095e3b6815248a19d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586d79de4473686c34d11e6ebcb102ed9
SHA198023ae009f104fd2023cc8c1f2bdde5b0a72191
SHA256b5a76bce1a33dea6a0291d7b12047ba0009fa6bb89880f9ec9ffaf9a04fa1629
SHA512546d98665510c6dc4909ee48335188c49fa65489cbf6e83807a26de4d4c738bec43f11af3d3e89da922ed0472bce15c2bfa3c003bc502edca5bdcf42178f8cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9aeb5c394f568898b5c20a8c4d50c6f
SHA19ab0c7e977f7abd23f59bcbe73bb772332af4b07
SHA25665698abd3b81dea246c5357b24766766892182d4820240fce81219f1122bc5dd
SHA512efe93e586b1c8ffe3c87e13045caad52c2837b27a3fcd54f1316f596c30c541c5f6ae4b65ffe78f1873769431c1eac948dca2c76c658bb405684689703a248ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abbafbb92c6d4430c57bcc04443a5444
SHA1768b191340ecb3ab2fcd27d5d77590c89a8ef12f
SHA256adb63ae7f6316e38225a60e368b51378362b34f42b261986c667b05e761595cb
SHA512c5331b0d60f1c51d61ccb6464d139a96581f8a45a2280f767774910f4657693b806940f4bbbb762ed7259113d1445d6be81810497223e6bd044c2a92ebeecc26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566e6304bdb4e3c93d0bf5a5c7c11c9de
SHA1c92df1a46f6788408400de6f166605d779bdc84d
SHA2565343340f4375feb5e8a362ac3da7cd32ab9c2f548eda2b07c61f76a05c48ce4a
SHA512fe3937178d7c336ab985c06982206121fd12847053aa3e05e56edbba30c714971ca475553b177eba474801b61b3086b61b375f1059b314fe216bbb9605633edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5191c40f7e5ee5f3000f5df813d6d425a
SHA10587e04c9644d7261af0b3cb6ca87ddd4ff7847a
SHA256c57d942f018acda2df359fe3c7b026ec6fdf464c80b818eaca520ef706bf7fb7
SHA51234d1a96ae4fb0f17f832cda13dc7f3bbb18562f8285769013fe7acc693e5ad1d324947354adda4fc94705781bcc28e5c97c73795c33fe1bb275893c83701cbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d00ac1856ea8fe12b8e5ceb865a8a157
SHA1058de32c3a71c486ced47007f0d618c0394a6a18
SHA256906a9cdfd33c72d46558546b8e1184a058dc8fb5d038ae872abeaf364f086ef0
SHA512ac048946b0f580a2e920ef1b28aed450796665e172f23baf19e9c6c7b3b9b453012ac63d82bb8a8a176e8b9928f4690d1afdf2cf7525245a62afc794ee1d8c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9b1a0d62a66c167e26f6e48c75f018f
SHA10ef0d0bfe527a137238c06dc488133abbcc8dedc
SHA256f103311601b9e2badcec1af443cad3c23d1a296eec612c688e314ccb67a2c513
SHA51257cade0af7557b04418d981e01047032b099072142bd85ceb9a1aef02f5b151fc65c56500e9a02de318a192bd933ae7cc9a8d293517c68a8d2823c612c4b1655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5817ee015630ca73df927b5626c03cbaf
SHA190935ddbb795d8e56015e87a16a3d91b3eba0b84
SHA256d880a48924caa2819943fc574f0d8ce2445bc70a92be478ee3cf106eaa1edf8b
SHA512199e12eb30dab51756ff3522c8cd4fee98d8d528927fe699194355682f4bbe5ea757d512e3e0c32af0ed3a05099dd3acf252d0acb8b31f2e6120346d52bbe9d5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b