Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
be83258195d35daa5d563d18193c1770_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
be83258195d35daa5d563d18193c1770_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
be83258195d35daa5d563d18193c1770_JaffaCakes118.html
-
Size
114KB
-
MD5
be83258195d35daa5d563d18193c1770
-
SHA1
c3b8907d92ac7b9e80070d61d9e9c2f850da9e80
-
SHA256
90066f7770770409bf019788b200e93d1bc81cb6ae451cb3599b80ba257a401b
-
SHA512
11ce7bdc2602bb017e70a3770c39a92cdd3ee45f5e724e9018b1226e7d2b62fc4e2405bf8b29aefae5f6dfd78beba9fae6d36341f03c31584d86fe538aba3d14
-
SSDEEP
3072:REE6eKhbTo+CEaQ6BrLgee+hZHwXPZw1VOt7CA3f+D22Sfgr0qta+prA:FQ6Brx9POdvmDRLrBk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85570BD1-620D-11EF-A17A-428A07572FD0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430661448" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2732 2916 iexplore.exe 30 PID 2916 wrote to memory of 2732 2916 iexplore.exe 30 PID 2916 wrote to memory of 2732 2916 iexplore.exe 30 PID 2916 wrote to memory of 2732 2916 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be83258195d35daa5d563d18193c1770_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6407a240eeddb1102fed1a25c6ca852
SHA18e5a7cbdd873c378de4ce6b2a1ce4c9c1beff3b1
SHA2561ea00908be99db38b729539f42c563a244bbe6242d0d04465f907d687d36716f
SHA512f7974d06a2920f67c8758617221e635c7e7ea47e02212050ecddac8d5ec450b4d2b2fa1e9c606834891b427988429e66abb14a86fca8c445fdbe5c70d1054bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9482d6c27f8136c43a22c78274c25e2
SHA12b38350900a38670a03568cfc0bd7d46a2c96b64
SHA25619aa3a4dc8cd8addb127355bc997f969c7ab6390c0e1feeb141c4be3ba797cf5
SHA512cc93751b6e5a769a5f8c580d55720f291fadae1dc92eeb35f6fdff1332d2163c01118686eac2f21b83548277961b54e588a483ec74cec7541a19a288cd375bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590b6228c38123e8af811534fe9a39a06
SHA17309fa85defe754459b2f81a3d4698c4e7abff8f
SHA256d1401a2983e5280fb4127cf9abc4ec717c2b877f122e8f1ffc8a17eaa083c969
SHA512947ee0087566f1b142fbcf6fd9001beff6411e26f383ff7b73a26a7642aab30f0b3aea5a2460a1cee5041aeb570abae0bbd50cbb40f8f638b6d54421e3af085e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52358035a1b64d2a060764e474aa45e1a
SHA18525a7466ba4731524fe379d290769ac9affb415
SHA25607e97b51f05da904de479a9b96aa447c6c690e666abcbfa85d664a9a4c45167d
SHA512d11eb96e96fe906002dd3d1442c7af6da1494cadeabad763189472af9b0ce061516f934c4335d4653d4acea68f80b0bb980f4840428523633fe564cbb745a0ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b730440baaed28dc90b908ff337a4da9
SHA10a409068bf5a09cc997f4036bf3d8990d548d6b7
SHA25609e7686361172d50ac5d66edb8af356d1df9b6e442edef5c99f805145c9d15cb
SHA512f06eaac310d98f966dd3bfd1adfe3b262921d59b8b29348acb53a05e6326c12755b20368f0cb23c75ab86d520ce1f9c51168a719314ee4d4e731642a769c76bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a3bba5a99376c58003aeb6163bea974
SHA119677106a4fc8605ad4ad13136ace7b4fad0e531
SHA256262ab322abfc68fe4ce48f83b17345da7e3f4c2748d23fcba28e76f776f6d22f
SHA512c4673d7f42091bdbfec4ddb2912c0b5c6942d1def55c47fdc4f8d8472924be2f15a8a64ec1354a0dc2bbe3c3445b568e679b7b73ce73434a28842228388e4768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b97b0a58d0eb003fad1e701f3a661d1a
SHA1e8b6513cece266e49e4a41aa9f0cbd39f8025397
SHA256470570365e9117beb12fae42fa40b74e2f459996e363eb6de2a3439998a31fff
SHA512efa5a1d0b9240bb94d619f57484b18cd94b3a9dfba3c87752bdc3207479809dc5b4c193dea614350a27bb370d154a426d72d5d8636b4d43808ed367f1163f5e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc7d575cd7bf59cc2bc9f444689e9995
SHA1e22f1aefaaab9a0ef370fcc484dfabd70060d7df
SHA256043197b1fb03b69de82e5497824edda8b936ae028cf9bc71d852c7bde51e4395
SHA51205d0e247274647cd1c02bd40938f3404c80cdc5afe1fb29dd6fe369815f4a7cc769d7ec9d3e524534d424b49e0fbfa6d5a832409a443122d11635facf6c97a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2061623282f65cdced9dcaf6435f9b1
SHA11064a0e342837a857129e1f3506daff03975dd61
SHA256b95a2939df4f8900b60ecd96e7973909812e4c35cb6c56dd9225f4e3d657ca40
SHA512f13bef8547bc3cd59f0fe2f91c56aa980a36977818953b47d9fcb18042b4259b21a49122db887c3dd3e089c6be05ff923bc2e76a6ea20af765220c47f7112488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d5b52fd1e91de603122397750c8dc2a
SHA1e83569454ce0192f9cb3cf04e3c18394b3cc5001
SHA2562dec50cac833141abbd46bd48f32e26e952263fdcacc0aa7ec4be231a541d6aa
SHA51271b272c6a486f7b99684aeffe9515d5287f735d1c41d38fd7ec4544518419e1e90149fce78d0e5fa2ee6850a58a51ae18529816b6eb9db8da3cd6210a7a6895b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb887478699267ae4a012e1f05b01f17
SHA17a84ece39d80454d951897ef941666f0afee4b3a
SHA256a1e96fa813ed33b8b8389fcc050954df3c66a45a36c1ba97d7c4a6d1143c80bd
SHA512b898c98bb9a118c1e49d939e93be51aa52defc4781005f013db2bd7a1eddecec06071fcd1293479d281bc3e12bdcd9d2883adbb4d2b077072ec39b5f3036d61e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e8ad6584b6e9b56b0191c32e78c0f8b
SHA1f5c9b1e49efd851053e46d7df2c00a23c7cfbf80
SHA2569c3848f38e2cc1fd8a1ede6fe869606eec426d8c1799cca5231097054d5cd707
SHA5126be3fbcbb42c109f50928d83997d0e410f9c9f48473ceb3b0092f097164f963de325d88c3b0dd3f1bdd981408cf6346c72c9abb30bc011bd2690e7082544cbf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7cb1dab8e9e2e9ab20fd343805304f3
SHA1b4aab48abdadfe564da0d8ba2d0606da06edfec6
SHA25666bb3153400f9fb0b391b585a83374fdc2fd6a72ff989b9e485e4bd33ac04d64
SHA512bcaa2781c2fb1895ece37692cc9a6e28297ba6258bb665f4a02261c2d7b48e7bf34954b14e545ad306c0274a711b83618dfdd94747a90d000b29ed9d790363cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1c17687fcb6a0a12c09513cc22c5d0a
SHA14c591e59df4270b9dc53e1996dff7f35096c7f4d
SHA256ac5c5252050be72a06534e137dc287fadaf31aaa25d3c80ad8d3d93016f1e948
SHA5129abf794cc9bcb532100fac0c7c6a43fcdd8a101ff6717291f0ca56ec0abe01156b0b00c169aa7912dadb59b183d09c1726a259763fb167506e1e1205916fbf11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5856af137f292959a79e42d0e03df6de8
SHA100fab7dee66f4c2740a2194dced43004dea6cc25
SHA256af9310980332d69229195a939094573703061862588f447dc8ea5aa47bd345f5
SHA5122ad323d4cb88747a307adcbe1d87630f41551a8cb211d71e699d6546df47e668660df9fcc89966ad444d57ed17dad68848caf32c4e93847dbc504351afa79e3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51abe3faa94d28f553295a96c71b587c1
SHA13386f7e7ce2f97f7e90db4529d858be41f3fb40e
SHA256b4e4be66b7b534e69bac839a38876cc87b2cdf8125eb0168f97b96d0422d3a8c
SHA512b1e012fb62f3364eae9cb2e5761db69a99c4981ea19ec7abfd33e7656e9ba713e760f6fceec8914eb7c9f7a7c71194ea68501c56afe83e31d68d5ce471ac26fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5085bf56b48749b85332706c05f40f6bc
SHA11e5dd8211214fb9be32df4c8efe6f80234b0cc87
SHA2563955e47e6814fd715dc2b0f9b877105581630c7ba841eceaeffa0b3ab054fecb
SHA5124cb4b8ae68dd633e311e025cfa21e3324cdeef22954b47dc726f901f5b9fe1a01634c2b5d66e1cb1737f65f0e09c62fe128ba235ba23657058a29cbe0bc591ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d39d71e26bdec193374207cc1aa02dcf
SHA11cf17b101061a14811dbbbb357ff9bae16e3d3a8
SHA256bfb43d7567c87a9e3eb119e6ea3709f63402da93440237aaa5c94d04da7405b2
SHA51288fc73c6a0ff207a737ea0c2e9918a5caccd8251ea9429a4b1f622632f1309fbb01e8af3824c03fc8e1efa65a7a96ae21b192e810e80a3fc67a6b8593d2da7ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d0bdef3d6cab68d4b0c336eb936bd5c
SHA1516fdb95313c4ae3d7e4ecf9d8b5c4919b8204bf
SHA256b4202ded84c2a11c35465944b5fe4fc358522c33132a42d608804cd82e6b5bb8
SHA512ba9e611dc227e119da6cafef8e6efbbe5dd876eef011d59b393f1e991a4985feda01fb79ba0c6b011d15b61054102b4b3c1742276c0218280f3ed6dc4c6ba6e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a360b20940b26e0ae92f91b39118d05a
SHA10ba82a4868f5f297d43b5c22b034cbf94014f8c4
SHA256edd562f57a8ca5572a62ab7aea14ee6526b777f1a485be948a9285ac8a781e01
SHA512823a40aeb338342f1cd1bc5447d3e655ed602a396df9651b38a5d61b3475af16d48cbb1902c6286892878f94d8aee3bd90cd276a6f75481f2131c7d47689734a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b