Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
be0b4979fcbad32424058659c17c8dbd_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
be0b4979fcbad32424058659c17c8dbd_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
be0b4979fcbad32424058659c17c8dbd_JaffaCakes118.html
-
Size
230KB
-
MD5
be0b4979fcbad32424058659c17c8dbd
-
SHA1
50591644b6a98afe81b068fe6935fda0594793bb
-
SHA256
1552fc3faa1bc6c26d900fef94843b936ac2dfad355e8d9803a7602971f0d434
-
SHA512
f88245f42d0abce21fa3bfd6ce6249acf58755b3456e08be58f97f7db9ddd0d9ec4ada739ccc727710f9839302494a3cdd57b03162c62a038c8495491d9ecdb9
-
SSDEEP
1536:dwAN0ZAn2Q5WRZiQ9kUpcFSv8Zp1pDUd0ZsQvTSuRZxF4r1XgGfOFe1HPh3PumDo:BtgQ3g+TyXgGfOFe1HPh3PumDo
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01f07a6edf5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000082a301fafd69e3af04e376672c6bda6f8e32bc8a87e5002be1377b6cf7cc55f3000000000e8000000002000020000000741b26d54f6c04590b6f497392a1c7090a279d428bacdef04778e407fc63bb452000000051babb6c676f9c2b5ba4782320bac964a161d0dfe61c938954c95ae42c8620d840000000e3d4f592781f9f39514660a7f26524488da69015e2a8eed8fce0daefea394be476483b9e773eb9a017cb6d98e291b0df42ca89b36cdbd78a60615fcc08e3d317 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000642d725b09f71620aba8c45bd7e8bde5495907bf1bed454c3a42c510ef44bc6f000000000e80000000020000200000009de492cedb0f2414bdb59a4b889c2ad3183c65ded5d742e80a0d5b6fc3a0941b90000000baf81f1d58318826c01740cbebd1a6832f70cb527a61528ac2c48247532d6662c2b404333c4456e90a2ed2d4430bc61f03dc25a56bdba1e37c7a991fc866d63a51a5332c74ee83363db0a3ce2d576754b07d41227b33fe9c6b44968b765dd75f25fbc1521bd991fcadc5a31238e82c3cc1cf64f0e251418f54291874c5eedfa0cafef48fb07b2b20d3357778782842bd40000000d7deead8fe43903003d13a87d002fdb78adcf129e4a960b531ef61fbaca79c68f98fc76f1cb235270963c23b693be0e362c1ab79e4eaf094fac2019464881be9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430642165" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1943521-61E0-11EF-A205-6AA0EDE5A32F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2692 2972 iexplore.exe 30 PID 2972 wrote to memory of 2692 2972 iexplore.exe 30 PID 2972 wrote to memory of 2692 2972 iexplore.exe 30 PID 2972 wrote to memory of 2692 2972 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be0b4979fcbad32424058659c17c8dbd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5d54a694295a8334bd7bdd36209d5559f
SHA18e100dbbf3d9459b620c1de385920abdc087c09f
SHA256638a15b1a1d97b6950c126552d483fc43d734b2f5af7946591189c01c14a4163
SHA51254ab5378bd1c6a1397361c9dc1900e53d35ebd2ad4101c0df1bda75cc57d51a70a0903340afa03c49c197ed7f96e239253d1933ddf7d61b911733da95b7860ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d70a2551c82acdae3183360d21c9b92
SHA1d5d5c93e75725a9ea3faa001ac05d93f070992a9
SHA256811f9dd2cbae77eadb7966148eadad6946b8c4285e515da5f9ea2b270b62453c
SHA512d62ff8568741bca0e52f074026b035efcd88e920956d34c354b602cc0f5d50fe33b158c9102b12c497d6a60d2f21bf93c3106c952bfb9eeffcc9c3c09f484c1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb24f49231ee1ac3a66001823b7c2fa0
SHA1926484510bd81d1f1249852950a151d8deb4ea40
SHA256796cf8ba83e7ea1729136856795540df963390d96560e2da5c109cf9768254f7
SHA5120295e9fe8ada203c10f4204551ecb62b940bb262b9ceca9e194110cf1f74db02f507366ef38b9dfacbb470fe5f68794b9e8c32629b570f2c2d6523be05f5b03e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0b9163a1a53d536b298e9fb0a347100
SHA1e01ee5e8957e7bdc46963a10bf0eef1980dd8ca6
SHA256997bbe633007479734f330c2e609203f46d677333cbeefaee58312c66717d234
SHA512a2818f33c44da132774e0a9e3eb8afd0dc68da6c20cff50536b86f1811d9def42d57f5d9039596ac4c6493c5365b88fdfe399275cafc24fb23c493c375f1bab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f60e5d1b24626f89a0a39638c113da88
SHA1f5a1c96d291e9b2e9c8ebc285618fef6339c0276
SHA25679f4058f18933395111182558c0fb44961b9c7ca06d810ede1b1aa567249f4cd
SHA51217a22f3b9ac82dce2613b54a604b8e1bb7d4eebd5231bdab0c93d25eda61e4ebcf2544de87686324796fa3854278a8b64251f14baf1798c1d8db865c986261f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59e7d3d2eb110e25b134da6ae0bd6d88d
SHA1e423bd2e4a0172c18017af1df9652c077ec8a719
SHA256790294a72092a2aab50d763711a92f89c37526819341a82b5affac77baae7d40
SHA512ca8308cd2ec621000ab0bea3a726980ed914df09e5bf5b14afa89325253c2a79f6b19a2f28dca59b8babb9b428127f1dc1d95561a44cc270bd69364e696d8045
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b