Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
be61dd7ae9d53d41269f275475ddc274_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be61dd7ae9d53d41269f275475ddc274_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
be61dd7ae9d53d41269f275475ddc274_JaffaCakes118.html
-
Size
2KB
-
MD5
be61dd7ae9d53d41269f275475ddc274
-
SHA1
a423fed7e6cc95cc9b8bad54c7164d02a731d2f9
-
SHA256
af6ab9979e15ed8a7db79e17af5d16d160c251c0d25263edb5e17b4a35a49e8b
-
SHA512
a14290935a1221b818f795bcc53ec23b04bf6f5b7212213279554894443a86f7f3c9de2b4b94206ac24a8ab984f26629501640b34b94722d85c358387d14a71a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000023b8890ae3e0338edd8574004ad9afff59a26098632dca60b2c7ee62f1803376000000000e80000000020000200000007d07d9006ec495b858f05e3e220d74f5ace82877f2d82b0b9b65492209ae7509200000009d010ea6085205b9083fe54fbb5e86add92712e330bb5756f3e8eb0a01a0f24940000000be572e594e787cb0a5bf9f7bc56a460041a705684a0c19b04b3a4c4d5c3c4c77704452395b5b559266f5595f9fbd916fb902e48350d30bfbfcd9a089fc18a6da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a038a2c10ef6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c3687dfbecd21f155c7b27946e21e1da427125b9953b12a82601115febf63557000000000e8000000002000020000000934f1435440b97a58471491b4bc79e260dfeff15098fbe915877903b0d7e4e9090000000113466922d0d8395fc724174d1170240dac92c6a1677b050dda361d8d0f40914c4281418a1bc962bf85eadafa86e87b174e391f4f94ba47432e4d7fa6b1332cc18de1bb398684237e66be89d31ede69d34a4f23e0ce5c621fd79b9737e9cecb57e37bd0d96dfea94410e45a5bcbd81a7dbf7fe968231a40a9dc981ce84a595e7ca12550828385d94d3e7693f4b882b9240000000c7c856d513bfe3d02cf98235db413ad0c2ad8f80b66695ca61a0dc7bbfd6bc79bad9d65eabc78fb23d48a4c82c9eec4033615f92bf3644a26c7175825df3401b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430656456" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED0A20C1-6201-11EF-8ED3-72D3501DAA0F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1860 2164 iexplore.exe 31 PID 2164 wrote to memory of 1860 2164 iexplore.exe 31 PID 2164 wrote to memory of 1860 2164 iexplore.exe 31 PID 2164 wrote to memory of 1860 2164 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be61dd7ae9d53d41269f275475ddc274_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5385d2fe8c7d8e0fec4d38c8b9bd854e6
SHA13341c3214b01fb31a635ae331d83919e8fd0ce02
SHA25658db50c4520683a40c3185e375feba92d42311e07d43e2c566efdfb53b520b33
SHA5129d1d6b3dd8e5e14d8566c785f1518403d3234d911d4a658a3bdc7a34c3cba983b9d3edd02a24e3857fef174b4a88cdd12d57902849257b42cc0df97f7c0812e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eaa4447e8f2816f7e4f0ca3c2b3f69e
SHA199b5d09ddd6eb618525ce77462e2eb858fa53367
SHA256edc782171c53c05bfe42732d34bdb816ac38160514ee0c0665a539f43c8bc3a9
SHA512eb07aefd3c20752bd3948d439a83159489f5a1ec2abb8fcc2b74fcd0caad2c25a81ed86130470f5dbfd487d7bdb27ac2894d974b54eb917c873be597aaed9333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a2c03df166821567a4ee34ae5aa9612
SHA100bfe6a81b456bf740dbaa93bbaa5fbbe0ecffa2
SHA25647d946781616e94843a6a219e9e111a243a195b30ac20aa107800be1acb59d03
SHA512ac7e7c15935ec70a71cee3d2fb40e1739024a00ece106811dc153d9ac7bf20f8210ba3c12fda1e6a7f895c455f138348928410bf67d4f1d2e2440e62b9ccc993
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5675352eafd0414e58b04e79330fbe535
SHA1a2f149328dd5c85f5c16f8c1bf4a280c445bb779
SHA2560e11908aa236c7ce524b664b06436e1dd45909207afab905827321eab5fa2153
SHA5126a8fd232752db52e96db8bdda7c694f6d6abd5176b4cb9366028b5558c32d315a7a0d8d103e227acd27527c9ce4f8d5126da75d192ce31331a200ebdd439cb10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8fa1a44f33c5743f023bc93469cc887
SHA1f6c1a43f532a734a69cb41b4ee01ed770dbf2018
SHA25685a5cdb5d9b080afb50b4001731337e364555480f21b94b358901d637b43be51
SHA5124e1be46eb982cc4560f297251db16be1e636a9086943eaed408336cd0a2e8f0eeab32cd10fd0f99abb48ea85dc97a8a76e66ec42544120626e292be986cba3e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccba6d6f7febe0816ba149c83d96c9e1
SHA1692e188c1381cbf4fb6503bbc5a03fea8c21b529
SHA256f6ed1f6bdbe367adbe556c2cf8f85deb719b04951429e21100c9e6ab7c357a1a
SHA5124936adca06206db9097c162019baa55a8e1e5ca4b43d63a41caf0f645c56409ae57ec076a55f0f84f8942f29bccd705016fa771f1d66783ef24d1dd3ed4ae49d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4c10ca498ae18675f9299ca63d47b35
SHA1c7410ff34184eb6596ff7c2232410502a6abac84
SHA256a9776c08a1e1fb0fefd1734bb327b24e4c404c00085e3fbe10bc27ba0caacec1
SHA512d65df61a5bb39df9f2004ae5d192acface2c67e46c9814a78d92853373249d750763560fc957f8aa0dc1db4a2b21b8d450a47744a55898afb8f4812d3729d260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8246dddd1771a0a0e5a1580d04642d6
SHA1c48137af930080e1b05a2c472d91a5482c1a36ff
SHA256edbf08422b2c318454f4ad5ff37396cc4dcafca63852c09411406216025b8e5e
SHA512c1f1c5e30441cb51abf1c7ba9fdc14ada31d942013eaacdbb4a9df7d61358a729137d03da79188a26e9729255af7ff05248d4ae723ab06a8cd57e2fe468dad3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ffe57c00a1f3d402526a25dd98252f8
SHA1b709c66e4dac74064ba5aee0f0289decdad00e5c
SHA25603612461bcb0b933978da02853f47ee8fbb8d9d3e7080f009e248f5871f1f22a
SHA512b879890af834d39ae344b8380b7fbc021d5ab9b6b46addccd80bada3074ee95b2b9262a70335fecfee4f7bb714f12120559b122fd46711c575b6915ba389ff71
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b