Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
bc94b1456186c0acdaee06c508c7a75b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc94b1456186c0acdaee06c508c7a75b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bc94b1456186c0acdaee06c508c7a75b_JaffaCakes118.html
-
Size
6KB
-
MD5
bc94b1456186c0acdaee06c508c7a75b
-
SHA1
fe3c3d262458aafd21affe18c72c6560153eb830
-
SHA256
415456415d66ba56ea976b248d11f62bd8214aaeb1f61d6137f2cad46ddfdb21
-
SHA512
b1194ad18cedb283d75adddcc89079bf541d9f18beda079b2ba0455353eb118085139b1eaf7ed2b138bdb3fcce907cfcf243e54da9e3749659a1ad0ce1128a91
-
SSDEEP
96:uzVs+ux7auLLY1k9o84d12ef7CSTU7t/6/NcEZ7ru7f:csz7auAYS/O4Nb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430594471" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000029281cec97728438d69d92bf3b16d67504fe777bba2f509d6a2de865c785c4b4000000000e8000000002000020000000916c4cfb680cade395b03faf861a3b52941834f7a516dcfa93708a22e3e3630b900000007aa5cccffe39aad766030692feec7df9641253a8227e5bd60b9698f5ebb4b9a23e64ee1beb8f75839c86f5f0510d10927d2d055464ec9201681355bb83418c2d672954032faa797996056395d436452e9c8bfd071089d2772a69a6d3d40b7ed8433e32b97d0bde949761b1caf08d34e8c61e6e5ef62489d72ccb40ee1ad66875b06c302193727ff39904333440d5db10400000008bf6b0367b668c607ae98d8974eb9742833cff9605c9780c81c12913ea59d325502853b6f39f53c12df3c3f107a4a37689d5e4c01ce00e1d35f3180d2c157e55 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B191631-6171-11EF-AB29-72E825B5BD5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c192d42b648d8f0329db3aed041f044cf2dd2727c3e9aa3fcd9f4ff48e78a492000000000e80000000020000200000003fd9fdbf3658afa921d1d61fb4783a6372981b4e436809b071e01b7e86280093200000002df5c9e341d68e7c08ee49203f00a0c40659e43d38cfe655698bdb98d51fb43b400000001d634e2937ce686d6887077e71089977493633e5ac6ecc795238b403015e013c41c0bc5e22f291e498156f97dbe8f21c510baef8d214e44d0ce6132a82e2ff86 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f2328a7ef5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1964 iexplore.exe 1964 iexplore.exe 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2308 1964 iexplore.exe 30 PID 1964 wrote to memory of 2308 1964 iexplore.exe 30 PID 1964 wrote to memory of 2308 1964 iexplore.exe 30 PID 1964 wrote to memory of 2308 1964 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc94b1456186c0acdaee06c508c7a75b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549c9533790dafed252439abb94b06f7c
SHA1f29d62108dd8980d9c6a3e5b93c4e62ef10a8bd0
SHA256e0375fe5ddaf04a98afbe13afb39e6b4f04d8b1fc64498d45c4bbf55ff462935
SHA512e4573335ea79a8517bdd5d9367310bb2a010a797987e8acaecbcbc8dc939aecf16564167e66035e42239c0f3befb7ed27a45fd80c488a82c6b2cf7233e88699b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5861fa363795b6de759b0364434b0a804
SHA178a5ea49cd8f8757c838a98bf042009fd5bd0c7e
SHA256b772db1bf2260b8eca6a6b197e336a8f1ce971aef21c408b45cc5300ef1f01ca
SHA5122e0ddc7e27f893df7bac5435ab8b80eba83c5300538fa71923bae2d128156933f79be4483d10aae9afa833248b600e7bba42fed6c95c08ad0e258d8d00778774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e412110216d1129b79e0671b7bb070cf
SHA18d94f257355eea1f28808144cd034b06b94fe828
SHA25621d6eaea0b922a56032be95239de7bb3457c4db8dd6e3fa11e31c46d4ca724e2
SHA512acfd4769f9d10cf30b6bd41a04b8085a2a01a9765f1b981ebe7f5068a11f1b796c0a006b1d41d6e789168bf5d3525a149614f7308343ad09bc7e21cb394ce2ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5117df544ef7fa664789c9a591e378b00
SHA13777f7a4bf89699d13949ebe29d6bbcfcda2033f
SHA256681f6a74023fe41208e33fd4eba00477fa7c142b0d283232bfaec5110c8b35f5
SHA5125c72c9ac48a8cf417d893757e0162ee3c6a6dbf0a9f56eee2fbba5e48880f480426e1b28aae0dbd5a35084f72e08c922608c58d2068efc1862988bf37f88a9d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbe4f45f1db446dc6ce8711731f00720
SHA1013798618d04ba1282ccdfbb9ae1aa22396883a0
SHA25697196be67a16d34e0ff9f6329e1247953831dc6e7bb63b9674bd0c2005f64acc
SHA51242065bd027e79fdcf7588bed76246261e2df759b5f94e65390736404330cad8a25f73ac6ad631ee37502899dfad41d0cbab3744be160647b484c8491d8af32bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5099f0e60296b41aaa980f5b1c8baf0bd
SHA14e274517054089e10dd16527ba43da915e986e81
SHA2566cd7c45665006d73ac6be2c65716ad1fe0dfc025789b618d5e8ab375d0d562d7
SHA5124c7973306ea03b4ddf5eba2dc797b8524c0729de7b54240e4020af4691fd9605c9987fc0e62dff574e50a547d0e7ef9d35afd04790a652863b67eb447fed4095
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589b3980aa8df74bce12c388dde470f40
SHA16912482014aea94ca2aa34061f4c08e80af87aec
SHA256dc57c77de1230bf65ae5ae00eae86f89fbe16c56445c966568692b9d6e262ac7
SHA5122a5e624229a4f76aac693761929c12b743b2937a55b7177d9ee253e65d375135a9ccd79e12633e75703ea73aa791381a7dd7c393d0001c954e2d9c47ed2d14dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a66ba891865fc704a9e90f8ed25789a2
SHA1f915db61051c7bccc659573abe67ebecfdfd5fcd
SHA25687a697283ba5912be0fac0e72e2588879ae97da6e1b855deee749ae112a6cdbc
SHA5124bf15790ff07bba168a6d08b77720d6846a80db87069ee14862b76447f6c5914be4c4d9b492c4f5a66f6f486a56ed11887eaf729cd1e889bea2a662f82c913f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b5b97d839f963c88b375c961754969d
SHA1505c21c73a32d8d83551d80f755d8dc40162acb4
SHA25634ee4c6ee47d4507c1ef001b354014df497b053307efddd5d39e2f1985b1a71e
SHA51211574e941ad82e094185a66ac5bbd95e8c0c6a46708410cff17bb66dea3b1d0e90df475a4ea4257a207346ca1e9524e4e9b8dc16ceeffa3d4692f53cc7c31c8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bde02a071c2af2df00f4e3e77e2f16f
SHA10b27da31623df6cc3298e011432ff6df82d7f8d4
SHA2560463ffe89611e03d3183f86f53ad56bf70ff86608c581e540198fbc53d3b1710
SHA512de2adcd1be58d21c4881b187476cd2ec4bd4fe934b37257c010943b1f793b0da5dc7880aa2c117f7d7179b17fbf898acab3c6164edfed1bdd98ebde2ac1aef8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7c905294f40970f2ee01b17c25ec46f
SHA1c7c31dc63d7e79aa47ba19b57601bf94642c24cc
SHA256265e1c448f2d18d4723d9d28be6007d22496b2d4143a93ba13c0c35e9a15da1e
SHA512461ddd6b3dbfc0bb08e4dbec9d387699a3234febaac1aa30d245f9573bf62696246c8b4a59bc53e4b1b891209a05d9167ffd01eaa844fc75cee86f441b46fc79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d92619fde2522c2be039896d60958e9
SHA1472413e355884aaa3f9599140064fda041e6461b
SHA256c9240897e3e4247ac25934d0b628549395590f4d631a21570808de57b43ff9b5
SHA512209a906eb5d1ec642b80fbdf99225bdffaccd16bc7f805bbae4eea78c0684b8b2e87563655a97b0f33b6dc96ddcb6eaf259b8fb47958d548364484803bc0066d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5995e0fc27e0d24cb7b341f7a2b93f9a1
SHA14d197cba953033b64f352d5ab695eb7bd9df4bf4
SHA256bed79c57aceb89a4fa5f2c918094b915eb6a665acc0ae1ee9a177e81057f01d7
SHA512f90d552083bc3587c1126609b90f436e7f391fe1b8c60cc6c6e441768513311452b4453de1a2ddaf378cce12f330f665b3137a92cf2c018372a046d9ff905cd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6d4f64cc90e8fefeb894989e7d49ae0
SHA1af71a35d13467b121987c9391ebae0f94a5b22a9
SHA2565e6e3003688da071c5f67ce279abf71dc4bd0adfdde17a9d5183dd2e2169d611
SHA512af4632b3857edd3c52a14e219f9a01e5d7521e96a85842495f21d00a1169c1003c67e14792c0a5be3510cdf0f703285aa6b092bd04374a7e18ea37623026726e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c18a2d5500a4e3af89b3ac9670b2f496
SHA1f3aad76aed2f6503d701d254864e85eb36ca550e
SHA256899266d5d33d90f9205af8a8ce337b24ca2db88c70808ce1698722967ce56b35
SHA512b67357eaa6d676b29590429d737ed31f34911e407e9386db4ea8c1809d20d5e0a340ba5b0d473baaabb3947725f2165232bc9ea952a25dabae5a3dc73ecd79c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5960ac562514711c35734c37fbdd0cc73
SHA142b7c8b13274f0a9d0ad2e7d96be06e6ed5ef3ee
SHA256eec1938fef2e37f1826e64da8d62f68763a385130151b99137012c35dccac4cb
SHA512fd5606ee5c20edc7d11f8ecbf4816d5221fc1fcc86e70b2a49eb7144f4992eb640a35dd5a5e80cb1f1ea5197ea09f7bbdcca74da4da55bcba06e471758efcd52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa46e1239e2d60fc9022ed0c3bcf822e
SHA1b6eefddac62c37eb9b7c63412214d27f4d91dc77
SHA2569e8390ea85a2bbbc610ac895d5aa03dc0aa5eab14fb06e8c8f7efd500eba8a72
SHA512bb2121b54e810ae91454a40a3f34e39d986862d4897cb53c86e59ff7f296b71acf6a995b0fa7bf3c23ce70e3a4ef005e561862ee61cdc70d41a1cf4280995d90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544d899938d4537d982fadc09510a41d5
SHA154642e054ac1cda7a204ab5c7a17e86e65ed0030
SHA2563cecbe0927d509496980bb5d1e507a2897895c50701d21f7c9faf4b56693abbf
SHA512f7b6f6efcdf0672fcb342dcad63815c15364f2c90a093271a70e954e509b8adf61c77ec42a4f8475101056624f2b8b70ac04222e6023aaae96a4219be158be73
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b