Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
be060c50583cf91f63e72552169430fa_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be060c50583cf91f63e72552169430fa_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
be060c50583cf91f63e72552169430fa_JaffaCakes118.html
-
Size
36KB
-
MD5
be060c50583cf91f63e72552169430fa
-
SHA1
01d56e650610902967005d05d29f033750f03aa4
-
SHA256
6bb0a6c21b4477ea8471413313ee5c93c587536022dd3024d22916a56e6e3e03
-
SHA512
637ce69fc946b3d60c4c7e0c00e466346a2d6ef6d0856898528c3711cc5f8ae60cd00247f0a3e9ca7900c2fdab52d1d8d1ac1e01643d134457eca5067a5882ab
-
SSDEEP
768:zwx/MDTHg688hAR7ZPXWE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLR9:Q/HbJxNVNufSM/P8kK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DE8B1B1-61DE-11EF-9874-7AEB201C29E3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b46064ebf5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000fce879d49da0ab0e6446881aa366304374220a80e24c3f5df725b3667a7e3a27000000000e8000000002000020000000dd030d51506bc2bac1ea01e518eedfe742fe834bad93d331f51b879245535ea5900000006ef11d1de666f36b7f0fc4a6f6ae192e430cda9a2ddcd3fb5df19409eb596fbc50d63a1856e63f2c6eb8691feeceeda60bf61d6d6dbfd048181f7a421edcb1ed87a63affd19979ce6118e4f36243ff7970ed2505d8a9bcfc3d090727f5a308ef73f4068acbae9c902cc6efa5e23465b802d691ecb7f0ec4172379b0756ce7fbb8b40288882277c8f9806a224c6ad1fdb4000000062439e49127f30110adf0d5345a712b44c6d1b3ce3e4efb26c73708c4aa0cea29bf15d203cf73ed6108cbe4fdfdb2ae94a80869e3660707e2735760a752ddb6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430641265" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000007b5c0c5027bdf6408e9bd091041ac095987d5a9dd15006fd79a443da22eab058000000000e800000000200002000000089271c8de4c7ee4d76c64eaaa3b64e874d40fbc6b24da9a3b2aa58149536897920000000fd47655a0c567b9af1cc2f1c42f7cd1b8bcf6cfd3575f78fdba7991e4105a46c4000000080f99689c20ea7791913d1053baea440ef70c4ab144514020a6fb0df6f13e7464cf4a37d2ed924ff7f65bddfb0cc7534b19ff651c91d8ee3ff45dd297db9e4dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2160 iexplore.exe 2160 iexplore.exe 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2032 2160 iexplore.exe 29 PID 2160 wrote to memory of 2032 2160 iexplore.exe 29 PID 2160 wrote to memory of 2032 2160 iexplore.exe 29 PID 2160 wrote to memory of 2032 2160 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be060c50583cf91f63e72552169430fa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51ed5752e3ef80ac50e5e74c846018715
SHA13ac8870b4517a1f947c6d8bc0776e6fcbf5461de
SHA2560950729763ad7c9beaab629c035c0f8aa37dbbeed4d69cb7b208aea2b8a4ae43
SHA5125b3458cde7af58130795aa7817213e5314f7b9a2c82504f246779ff2bbd5e706f209eb105f06ca29125b30dca7548f0cc21fb8e4c8daa98e988287878e03dfee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d30df97e4bdd1cd4866d67161203c431
SHA1ccc6f8a8ee37d5314975de49905d3f4786db21c1
SHA2568298b333050f8b94218e012b1d6f88952fd6e15daae15130c5a700e4988add2a
SHA512af394b85af9fb3b7114d4db68592703ad5aaa10a7387284af7e1bb02358979e2e3cbe14fbd41bf7a9ab95cb6cd92ee02485097c6577796bd9585e6c5ebddce46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1b048fff0a439ab93fdd52123226503
SHA18494ab938bb3a51b92a9159997a810c34bf9861e
SHA256ff1ca1539a7c9411657bc96e7f576f0b89456e661c2d1291bc7543ab6790ac15
SHA512d503fb18702e18ece846a9c4f05ab535e645a721c01ff5f95ebc6bb8274d10196a20899485d09528afd5ec300b6b16d9b9c481a45517f8517ad79ff426d44e51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50023b2b77e7b7f3b115a0f623b4561e8
SHA183422b643084c348e9aa9c8e3f7b8264eb15f8e3
SHA25668a905517b505111dee0aac9e8f604fd9e01a5b812c98352d892637ae2f967a0
SHA5122b6ee13a0d4cd6b91b61380b002701baa335c360e32e228f0246b98a482d5fa2afe1a6da17f71fd3e7fe86a6bfd059f3ed25eb4adc6acdc84039fbeb88cc2307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d982524a203366c03ad9f790ec47dbf6
SHA1f03c88ceef9a7fec6d977d31bddfab9082e0874f
SHA2562707e44ee2a0594f1bac74965bfc35e4a4197a1f8e70fe60f62ed3be6459b9b0
SHA51282399d609769029523094482d2c3d9c86d5b206fb0fec43060df33213353da1541d4431bbec94c2cc79ec630752507ffcfbba6a85bb7d0c33ebce832aae1930f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537ae092de52588737e8d7a2b030200a7
SHA100cd188e3d19577beb77a18b19f3a95bfabb83d0
SHA256bf91df789ef8a7fa8ac56eacb0ca7a281a59df2a24a729b7245a9656306c854a
SHA512f7e3b8c4a7eb914f1d4ac2be6eb641e9177666b7791c11f57c1049bef61ad872eed8c80b5e0d190c642747962c13482e2739a573c2dcb3faf5608eb32b744cf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517abf294c78c5fdedaf2999b0526aead
SHA1198a2f03f2523c0517fa42e6edbfd15b222df6b3
SHA2567b74e5af72b2733f78b3547ad6c1fc487ae0c6921746f83a7ff44206a0deca97
SHA51227d441ab8f250671dcf0d7d7ede44bf2b247653f7b5fbe77625e48f09d6cd4bd98a728f28a9b609fa91ee439f1316b5882075b0629f78aa29ddc0fe1da4e26a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3de33fe874dbab51ece258d52352ca9
SHA1eec39a3a8abffed82dcbd2e0d5cb51aadcd78ce2
SHA256bbab9c8eb12f1af75db44e175957aac7fce7bbcd4c003e306ab9a9a31bfdc402
SHA5123cc06a122115f9965bde0c5ba0f84a256bb714f8f414bc69cd5369f7c97d0a2f928c915a4c0acdbed9d2a1dff40cf9ab921e122de1a5a6cd2c1988c92969bb0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dcb0267c795be8ab3629c0e73cf5c0f
SHA1b94b4f14ec9d52adba9906338e9267f21f491401
SHA2567cf66eb95bf3f4e4a4767c99a554fcdfc0ec39d9a2ea689aca350291672754d7
SHA5127f2bcb2b2c86313fc07179c6b6d6e589e870d03796aa321b8fe0739b342a41659c3625ba93b0753c5402ed3a8ecfa2aa74de5d10af325f03788bd22f8657813a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf536a690325d5f4af5053b869fce1c7
SHA157cc26c3918add807a5fa4093c48c0616a75614b
SHA2563d1c5b30533efd6129bcadced6c668e6826be74622c71745195dbeb32d580ad8
SHA51264a265950202ebd2819a9a203b013ec6bde445f57e8e16b0aa1f5314610a2c5ffa248b7acb9acc85d014bbbf92c4274e9dda5527a97cc14e7ed74a24fec89f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51eb77055780cea6b9c3d6ec6f564e953
SHA152a2adabadab3fed8d056aa89fd90f5af279052a
SHA256acd263b72182347c1b1feee308bac5b120b0641ca119872d3602af42a464c175
SHA5125ed1cafb7ad578b2696758cce3dd2d2737c47e81410dab11a082e6d7e4fcfc1c83f712083ed890dabd5a4d447a04235aee0c4cb02b3c427e98aa52de8e0b701a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526f8093189f19027a6b73aa1b6852b30
SHA195fdcb853d3299e64d8329d4d62ce063942d76ff
SHA2563b32c7e62d658670316e14c2ff8f000df50aa79c994abd1a08918cda91b26e1f
SHA512b7666e5b8b3eae39643fa61bd1ce30e08b02b42165afba43a3a260d75d4bbf75098cd625e37cdea4b7a6307a490ca4b15eb0a4386892ff335989fc786b45169e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541e0f24a91e9840b1dbc65c87bd1622f
SHA1f72e8fc3e820cc91ca5d9a8f0f230b046abb68b6
SHA256b2e82820d198b4bd5f3e01498afe0518c531e7acbbb496b52c14f2f0b5e9edd0
SHA51239c6b330ec123291ccbf6e4278ef5c8fabc7b058eb9367e744f7f7a0f270ba026cb154a65dd6a036b7faef5da5fa610cc8bf107aa1c1eec8856019ddfcba754d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a5e5860fb142dfcacd753615e6c649b8
SHA1096cbaa029d26f838116294d01cf513c5ae56727
SHA256e67e6be4b5fcbd6b22aa709a26242afcd8eef54467ceca0402860dd75771af5b
SHA512ea9a89f8684ea54c30a2c68082f965d6ee112c6a8636d91e33a605f8011d77bc5506a9004f2075b7ba394ac994ce17a9fa116b1be29cea4eb1663cf2499cde95
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b