Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
be10dc97f3e88e991e7945dc544de294_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be10dc97f3e88e991e7945dc544de294_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
be10dc97f3e88e991e7945dc544de294_JaffaCakes118.html
-
Size
178KB
-
MD5
be10dc97f3e88e991e7945dc544de294
-
SHA1
28632000ed451f491a6c5a2a9bdf8aca6123744b
-
SHA256
dc8453d79cc16aea3075146cdfa4d505b9811b926b208274826b2df846353211
-
SHA512
0590a837e8df38fcc5b480c7046bf8af4f940dfd1caf65bccf3afa89e60fd72dbb47626f81d096be7f611f8406795d9f816d862cbafd0eac73370cefe45398d4
-
SSDEEP
3072:SJyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SssMYod+X3oI+Yn86/U9jFiM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50efaa07f0f5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{323F04E1-61E3-11EF-83A8-4E15D54E5731} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000025f45139ee6e3806d95eb50bc2ae194320eab308142e33cb2fbf0f8e0ea44373000000000e8000000002000020000000cf3a1abcbbc689feb092e6f121de95c1d9bc448caf2c605ad1503ceee5d5568320000000ceccc511f62e3f322428de5997b278f57c82efd5a7254600fd1dbb6fc2e5f61a4000000082d5904fc78fb199396431bb687005d0182482a43064b4ef3c0db749bf74458ae0b6a1cb2c2c4c618402179ce85b6a6426550e67de635eeda80374696316a312 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000833a086c7ade89e4e5d6850057c876bdd946d7e0b28d3c46b9bd6976d7dd11b0000000000e80000000020000200000003b99427ef215f121fa5d471a9f2428ee4d7dc29c53ceeda2e3f6beda2b388d099000000051d5600b9cc197c38582242759749427b0ffeca72f67acb1baf161a2572e125e4d5f2cb03f1dba519c82cf8270e2d6f507fa39c7a28e15aabc4292433add65f068eb7dd96a03bfaefa295320e386fcf4125f60b93bf74a7dba8dd0ba9f814bcf34f9f6a6fc4bc2f0dee7ee1b499e14b21d888f1bc3049d4f3e1558de384782476d67f7b64ba893697346db37fa1ba66040000000dac03300220c7f909fad45218af081e4ae8cbcfe3f723bce254bc34b27d436c0460c76c16c3b209e8b9d169e2b1b0899763824542852f1ccc0a29f90d3b44aec iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430643273" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2704 iexplore.exe 2704 iexplore.exe 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2848 2704 iexplore.exe 30 PID 2704 wrote to memory of 2848 2704 iexplore.exe 30 PID 2704 wrote to memory of 2848 2704 iexplore.exe 30 PID 2704 wrote to memory of 2848 2704 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be10dc97f3e88e991e7945dc544de294_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dc7df766ccd0b5fbbf03fb7fd1aad74
SHA18e47a39cc0a0441acf5d5e0e9164f7b4f2b6908d
SHA256a406dfdb6774b76577c19445886f6be30dd7aeffa4f531e165680dcdb65b0614
SHA512be53dd7a4b747731f99674ae8fb0bd01629a4b7af621dc389eed891af804a86087ec7a90ce967941946a4a92bcfe8c7bef104a36eb4f6c632be9574c891f7077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9d91d00061cb60c79a205e029c9de9e
SHA1deb10edf704507f4938e385a6604020c3730b437
SHA25634aac8b42e78169df87660c56a5a2be9637e9eaa8a1ea331886750ac66248c2e
SHA512bbd8fb1c712b7d4efa52cc7d7d8fe42ef6af6f8d147f1ffa091d5fc397179f8354479e77e9ba5f2c1c13e89b9281cfa44dbb4fa569839e226c5b0ee26e04a8d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0b5e4bb346daa1df3e6cfe7bb4106ad
SHA12a019c097e9997fe20a8b51888669cb01db081d4
SHA25681ac9cd03bf5c98c8e72bea2a21a70a3a84a916157a07cee2e87025ef7aa3028
SHA5120e4c095b1fa540c41e6f35c6dd0038d0772652f833477902596df24ba3d93c29bfa1b2ca01490eb19a823b686c83b1caa142328b75e30aa2031939ba2eb1f9b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534bf03ead6c179379cb36fd76d5d4737
SHA140e96dbdef748ceb4726d63df7c12f42b4cc1cb1
SHA256957a381fdfaeffe1553bf0ec0c1949073b6b66157241ed0058bf39e3d24e30df
SHA5127a36b17f792e9c2d2dcc80856bffd0a6b2e82175de2b152de05dea691af8772e20ffbd2c4ce1d682c35eb40254f3a387a5576c7a8b6e1936bf8843b00eb25f35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d786aae70744bdfca10e898abd529ed2
SHA169b9293b11f523f9094993b3ef7280acf4166e45
SHA256a20a4e62f43f35a411f5b7451b4b93398a1abc236edcb80a945c3ce4f0f2626a
SHA5128342259dd389dd70a793c7a73d3eddc41e9b9090ef383ab71c5a6e8a816a01845cf082ca20c2a49c6822bf217320091ac225e8ec8c3c3ffb332e34219255e67d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510cc3c1d92186328853641aff365050f
SHA1d0cab01d42d6e7f70c52cf294fe6695d20e3ba96
SHA256ac1c9100fd2d77351e76775e399350a62fb60879360968f7cda03c786c8fba5a
SHA51295c89f446939e3de731ea210b3c457f9d1f348aeda6325d11338916ea94627db268e8a4b6ac1fd8ac2547b5997514311b2489f25995cc5565fd4f4f941699196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb8917b651bd8d6fbbf0c38958779c1e
SHA12fd087325c5ee935b1f3dce6894325e9ebb9cf81
SHA2566500895135c74b82b09c9ec520935b334f19fc675b78de164b7d54c71c31e4ff
SHA5123c21f4e154015a995067e95bc817972091e40f6da378d045c78b1d0efc3be699ee5921f52a6d61128c80992de409142cab3e21128552f92d25d78421df9d0054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da912b4575a6cb5dc28bfd5258be440e
SHA19271caa0c4dfd811a524b7c9d556c43fdb2fbd48
SHA2564af06fbab87b5c6f4c0059e69a9d108a556a18815d294392db28f6e37e7ccb84
SHA5125df4d88646eeac40fc58defe133c2f0a0940bd06301dfd4b81b878300336da1aa2fcaf26d2aaec55a62a51d9de026f50353585842f2bebc1bb6cb3ff858b112f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541832bfb982969dcc5b6f9e8718519fa
SHA1b4fcc5b96f430b08d36553bd60089be375e088df
SHA25639fe0659a61574025f4610bf75b21d46641b5c9aaf19e16ee1ca262c81946158
SHA51285b9f01df0c204d48859d448743b5fa42cccac240c7cf71122487c6f98b185b4817c5fef0a165e8fc1dc9d1786ce4ee6d024ccb5ecf463a736e7dfc76a2f1345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5667dfa8e64c322603deb368bdc68499a
SHA10f23600ac45b55f194f223fdc7356c642dd507d0
SHA2561872e0246c03c98156c69ab07ba7c792f821afda1e308026f1f127051b13e5df
SHA512eb4036e840a5f358909ecf899b1a5def4649924bacb825569d85eb57805852cc107fccac18f628ae454731d0b80d918c3e74ced51c9718f2e83917199998a7cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f7c4da6c8718e35b4bf3127309a4c24
SHA1aa812a582ac64da8261e5e0e334e8e6b65d2033d
SHA256380a86a8af61d49374c580be906db9b35addae3e74f0a4013449b36307a8c93f
SHA51240a6841eaf18e5a36128d898721f3b436842c1af6d58d3bd7919910d4dddfc2527451c04ff3bb5c877b566d26955ac19653f47e8a2912262cbccead10032ffeb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b