Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
bbf254e643f9caa55f8084c46c46847c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bbf254e643f9caa55f8084c46c46847c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bbf254e643f9caa55f8084c46c46847c_JaffaCakes118.html
-
Size
6KB
-
MD5
bbf254e643f9caa55f8084c46c46847c
-
SHA1
ac68ad0ad01eac2af31910cbb26ddbda5cf3d71a
-
SHA256
157fa0bb86267b6f8fb4382d802af41ca6d8bc9a3fe07b32730ea4f4467de4b6
-
SHA512
162b7282f55e40794b9df9b0cdd1fdf96147ad75eae1849c7e56eb905a401d63d1b7e0ce0cf6b12a3af1a838ef4a2e41c30c9ef23c626d045f22ce26a4abf4ae
-
SSDEEP
96:uzVs+ux70FLLY1k9o84d12ef7CSTU9ZcEZ7ru7f:csz70FAYS/wb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8051ab7761f5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430582029" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000be3553787b3a9c349c6c2818560b7faa712deafe397434734628f674082cce8a000000000e8000000002000020000000047f7ca72318528b6026281dc03b6966d80f18fdf77018ae1fc7fea9c54bf69d90000000800e12cef074271881f7a537be9530074f92bd15b5473c02181d3c5c986940c411b5a8ea2947145a0ab0f7c6d991acdfd788240b544ae0fc58967f8272a94ac6a8400852059ae686ff45551bb4d91381667b7ba5bb0d741056ea1873708dbc41bc834b59d2753baa3322097b83bf3a142449bfdcaa562ad5b499bc60e909b681d830c4cd1dd07b300575371be57e5dee4000000049de29807d291fa1b61885b3955526deaf22d6cb46ed9020ad24d491de7548d13d25cf93ed5dff879a7161adf56d4668154b8cbe2e8d29e0c241ce8fb04b298a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1BE9681-6154-11EF-9629-7667FF076EE4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e21ad1f5842c29fa8160c65a314cc8de99f7dd42e64f151a291cc0c7cc68aa32000000000e800000000200002000000015336736ec2c0e8d4f548a5a450a986f384ad883e4d6770aa130d29d783b616920000000600a3912f474b8ee0b447243eef219473e42b0079247b9575e9fdefb29be65334000000036f6cebe044bdd6053d12e46f115328645d3fa2ee16e1c238d4c482e1af2094c19d52467c018a6c001a86aec80d060f3b25025b33bd8bf53e6c9abdb7f746718 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2436 2356 iexplore.exe 30 PID 2356 wrote to memory of 2436 2356 iexplore.exe 30 PID 2356 wrote to memory of 2436 2356 iexplore.exe 30 PID 2356 wrote to memory of 2436 2356 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bbf254e643f9caa55f8084c46c46847c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfb0719a4850026190eee5fa66772586
SHA1916c2fb47d0c03316854d9f279433a41425acc2c
SHA2567eec06fb0fe20cf5f2d1ba7b3e722ad2992065cde57b1240fdff668a1b9efc70
SHA5120cfa13e4c005536857a9705d0e0f5e2751d4600bfe5f48d1980aa6eff494307f7424759c82bbe3c3dcd78a3c2de0c11b9771ec112ab1f590ffc524c1acb96f25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d7b2d9bf4f539dc9c1c4311852ef509
SHA13dd93cc37afd264231c489c2912a00cfadf8ff14
SHA256ccf8819adb8f5fac204edefac7de526171a6da2d1510a8ca2c409cebe7c18513
SHA512b78fd0896b0ff5f0725bf8527e3f5990d693a8627bc7dfd8597d3aa344b6f1a4d489368f286cda140368931a5f8fe30597c8ea926b420ff01457d6e299f92b53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b256f8342ce1e3f4aa8807a8f874dd38
SHA17490b7276ffb43d05e20db082ef4fa5eed8e669b
SHA256ee85a28df2710ae20953a52549b24bac0264d95ceb481b9707a9374438cabb5c
SHA51267f4b72db333288910f2880581cd971ca4c23a670c9a7ce04e3ea184c2c7c219cd6aaae28a10bce5d49b09c4ccec872c4ec4d3ebb26cd559a4261886da3d0eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5208411dadb7465103b9ed912c0c8e8a4
SHA100f296b70764e8ca89dd59851a400db26c3adbc7
SHA256a77c640b822cd7dba40908ed3516d6a4b0f97ec9293d2c4cc6528ec6703d9b1d
SHA512585d81c27a6af776dc0af88cc0ea80151ef96020ff70f3118d7da694a24d4b80845edf5b682f55aec8e617743ad71e7625ac2e002e364f3b78853ed65c61f4f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7eee8a5c663ee80527ef03faf4cf269
SHA144cd7b21c3d6707229f6f87b3149a06de1a3046a
SHA25685fb63e6c020dbd4581c198eb4fa4a2e5751b595c9bcdbbc1975be1426b89ba7
SHA512f3013d0b4952aa52e0fbbe144ef7db5b0b0431d43fc66c066ca25e6812f872cfd6f5eb2244b0bab0f4e16b1670351fc48c377f38f17cc78f6bc22805ff9aaab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7841aea39585a3a9b60d8b2e0da51f2
SHA10e7b7eee07d9639969dbc8afa16957d352c66099
SHA256b32b38fd6fc82557cbd9b3644d1f407af6fc877975a145070a714876dfbb1de4
SHA512b3090bf72232e1096c5c10add5c6b40773c420a537754013fda45c6bd8a5b75229f6ec182038e31fb72abcbd24f5b07fbe2caa1a74b2e20458638d47c826dbc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb1160a0836f939d02549eef7987dfd8
SHA17c1297e951d07820dfce3c9a68758a36afe52585
SHA256f09dd5e070f7201374f058da01b518b3674c61d35e54251e5294a2c58eb1ed7e
SHA51296bdb380ff489599397b0ea4923b158a33682204137c88c168d1f54897094fdfd2011ecd6ac866827df5895520ded8ac39fbbe99c2860b7e1878e6521536cda2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a60a93d93fdb0dfc64882caa81937d76
SHA183cbe729f8062db5886ed1ca435bb536585cc7ca
SHA256d8ca43e48949f758606064504f2ae669bb6b78c523f2a2ddf31690b1fe927ddb
SHA5120030d4873bf92eab58477ccfe8b13665bc4865d9269499ee2c510ecbeb9a9547e18ce062e682999d20a801fbcd9aaa4e19c0d38e782d1e87a400b9d4809e51b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fc6dc485b9b2f59240d2cab3adb6999
SHA1afc55d8ad91d99d1c294c0ce91c7a648cd378ac3
SHA256163a7170f7fcc518dbec28a89fa0be15fdb93975e7373a3f0be031f62d475278
SHA512d8b9be7384f596db1758872951e0006cf543e216649c5f0b8cb0fb8b55df8203d14842e8b67c933a712c20469742f7922fd73b0d2b1b5df83e5ea9732708d11d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575ba3079688449fee25ec7460d18817e
SHA148a8481177a96ba431548546d85556dc9430268c
SHA256f8ac83b536a034b743635dc7a73d98b04c43e1f75f82cafa0dc7d7ec848655f2
SHA512274fe6258f6de52bf4d3c910f5c0ebbd06b2b880ba82bca9bb0b52b86f0f983e70dd1df01eb5ed078cd6d3fababb3c1f47b7529abbeeba0c21f6c5580e56a1fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539c83a6a9b1c83e36a5e4b0c391878f6
SHA1ce1993e4caa72d4394624f848c894d93846b4dec
SHA25623b852878b0db6bf6b232b1b7ef18a764a5648a9f6b5007162200e9bea47fa55
SHA51220abee27d3fcf51d6d01dd0d3be064b7a02a3906189b9b880255d81bc5b6c409108db3ec62a542519ef03cf8cfaf7c75ba3f38ebb97bb477cb11c69894918aca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c885a36d408a73bbc0eccfcc0dd792d
SHA17b803c1bf0f63483a85a8eff4e5dbf4860cd1894
SHA2566984583229d52db5e19880342988922fbba3fe26c0b6720094c0e627f2cc3e63
SHA51297033ef4a946153b7dcfa1a8e55542525403c52266d140fca1152f0dc536e16b74f602e1cea2ac0bb321d42931f2b5ea7e6ed875cd13a277845789772503ddce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598993193e215a552d48803c5a5cb700f
SHA15b7ed2f3e67ba05cfa28893ef937bb81c049563a
SHA25604a7568876d29405d1f40a5cc2459a977d25d049e66d63e0d2843436e1173b4f
SHA512d3e9e76ab9987e3bad3b88040c5c201a4bcdeb8342b89b4476c281429c54dd08faa8ffebd67da8543eb6b312bfdb435bbbcd7cfbf499f06b829ac8be026b5b52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597865bb6b9fe89110fcb4e2d568f1bff
SHA1089a557239192711a4ebf1b01c39e23a40327c40
SHA256103be40480cd1446824ddd11f513ab010a34f2723f01982abbccc1834715233e
SHA5123ba1a9b9ff364550d386d652dee98afda339ed7fd19762d0de9b96e5d8b1d92bb8012a10552467f2df6cddfc6031247d3e5cc1756d2a0e8809b59570899a56d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5212111fc8a3b3a766064093cd7fc2d1f
SHA1c9d4447c8ef350f970ecc8b2f4cd31216911ee09
SHA256893d42efd2b06ab4eb61925b0f3e9f177274b0bb2679c6be1e0aea3782e4032d
SHA512d0c3a4371de182f01ddcab7677cade81a2e8b7e9c9ee5ab83afe1ec007433a6df89b8d8d61f8589c0ed2de5d0c90a8db2b001aeb0fe3d8236422ad5a6c57338a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa18e5904e0910c2c36f82b87ec6961c
SHA1aadff4ce19d38d7f607c235b37e5e0f0c210ade6
SHA2561e59032d44f867eb93e6ff88d81a0b9335cd38dcc3b9b99bfe5b2cc6148bcb25
SHA512fa6acd10de446cd9dcfa14fcfc81dbeb738659b208a00ea7075810eb8eaca3860032589124c669a62ebc1068357b8e20e8180830104a06cc505c6cab028c3eaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e48c253b3dcac2e695b3915438f06ad3
SHA1eca559b012c0c0c8d88f16faef2f1c079f58ca92
SHA256b75e27d2a8d210c78884fa5c90152b6f02f48fb0ee9a92b270696e1e4c68efc1
SHA5126c6254a5c8b136970b9c628096a1e0deed7ccd42c82fe354c726777c73c1d9c613ec882b1ebcb6071666f815ed962b1f982d5406275d9b6c47bac86d82058f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4f436e2b8cfc8086ea8668079fb94e1
SHA1d41d60d33f04f3197870f47de615d2e6f443c671
SHA2566dc0557043e0a74cba314ff3ee70abd46e000644c70dbfa61d5ae514cfbe8734
SHA51230486c41bacb61324b1cc4c9c41836a09f7352de135dc4672902a7323a6ccc74ab81ae34d42e4ece41c90301594246251c809a8096d09bf29a20c5fe1431b48e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b