Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
bf4701010e5b7c76c027d41eb049bad6_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bf4701010e5b7c76c027d41eb049bad6_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bf4701010e5b7c76c027d41eb049bad6_JaffaCakes118.html
-
Size
460KB
-
MD5
bf4701010e5b7c76c027d41eb049bad6
-
SHA1
b2d0e5b2d15ea7e132286260a067e4e5f0bcc2e7
-
SHA256
79be5e49d494604c673ae79828d5f639cbc1a39fbe6bc6a4fb45b9959f886736
-
SHA512
38ecea73cb514d9e0824698eadd2c6fd4dc1b820dbe8841dbc15e1191be0a9f1b4f9f7a04c342d77f5b778765019e09686fa61dcd8e0aa94652ca7adff690f2f
-
SSDEEP
6144:SbsMYod+X3oI+YUsMYod+X3oI+YWDsMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3E5d+X305d+X315d+X3+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000072b688ccee1d9a42ebcd0dffca907ff3afedd7ca673bc15d98b35a59fc4b3ce3000000000e80000000020000200000004bfa7f89e9e4670c4fe7fb695bb7b3f3d491ed194d4fd363c39b9663074b852590000000762c3674ca2dfad736fa5a9051e3a1572ba5ea5501c44fe9121d9f79077bb8a07ccc598f85a6537abc557111c8abb31f2a9d56e9e60bc697b1d0f9a6c38758e1e78ed6e8d599a487116e3fda308d8e07fba0ebff0cfd828b9893c05e88302ae305b6bf703c81ce82a301cb1cea69fc3d0cb8b1c53c543e621a1cdc84467503e358794dfdaaa22d272afff875be7402a340000000c51696b3d44541ab87ba517ff764f217189f5ced92dcf5e3d908ba6e054e266f8fd71908ddca6a7d18e162dafa7e49ee3df0fa0c4cb6913f7f6f39baf94fdc28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000071ce21063189eccf47351861520738923718b0cbeba84d3159100ed263127164000000000e8000000002000020000000b403cff4f37b8d0b573f1c010060ddfc9e0f599a9f702ece00f6b593afbd900f20000000bbd2f169ba424528a41128c7de1bd43364b3492923a2c5f12215eb95b730a67340000000ea3684d520fb325c82c51b5f8a9f927ec5dc19ff956304c76c4680331496dd42f291a04248b8449ec51c0bad4f7d99fdc95154ce17c2bd79feb801342325c10e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA59A101-6250-11EF-8340-72D30ED4C808} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dc6ca45df6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430690328" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2128 2308 iexplore.exe 31 PID 2308 wrote to memory of 2128 2308 iexplore.exe 31 PID 2308 wrote to memory of 2128 2308 iexplore.exe 31 PID 2308 wrote to memory of 2128 2308 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf4701010e5b7c76c027d41eb049bad6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5331677ba522aa8d7fada13a6f75cbc72
SHA1f631ebcadbb0de8f0c7f15a2921536a8c8f77624
SHA2560df4b4a25496067acdd3d78912f38be7ada49181dd07be9285512febe23a4071
SHA5124bf3cb25b54a5f82c72cf25b172af457fd1b989162cf9a7a98cf8ca196d4d3fb6f6bff46d80cdbfe19d673babb16d4969246afa90e099b1b45e9cb1d8097a627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f8ab64a5480bb3cfa7dd2ff0704c244
SHA114ca72fa832b2d6f6e896e1f21682fd05bbbf004
SHA256fee17fe90a3fb25d796e44967400464bd36318ab329224931e34ed25544454c8
SHA512b2c5d983f0904bc0bc8eaee84212a72ef1c41920eeb522b88e864bc2b97d5fdb9c26d96c2f2a5800b0d4f9d8ec10d22266e7efd0f832570cef510e7cc51d95f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c0b30409124871963869c480bcd2064
SHA1ab37692b56c59e0f6003c82986c0ae6ccccc3369
SHA2565b8a949680c86049d344c759230c71c82cd682b25c395f2405afd5ee45f11b83
SHA512998d03c779e4eba8decda3d3af75ce95476ab112f7052974109747557e3c93e92f19be25e1eec2d86987c653b590bc889b6abbb0df4920053b5264b13c385b97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5111b917f3fb94c5e88b441599f5b667b
SHA1e621ecf2ac0b2b9e494aa103126bafd6f525e281
SHA256e831d0d1d59977be566afc13aae6335b02896f2f782117e1bdd1816896dd1c34
SHA512848b22c08adf147db89093d989f8251049f3a39b477b7c6bd4a3ce08517be41a9979a15cb7a2dbe9d29e25818a743482dc076aa935046e81a3cd19f38920764d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f782a84344e9a1cb45d713e9e1821386
SHA129d552f2ff2c248d88f3ee3adb28f6a84fde2f44
SHA256e87a2c22fc06e44b74278c921a105e569eb6d9f59fbfe03ec5c883e879f0c6ce
SHA512dc5e7fd5f61c1d72a5ecfd6f8f178f9104013cb957f1e4061dc3ba2142a27c6d8df70c7fc62062cd70a046a0b16c8bf05ca64a9e8a12cb983043bb2ff64a54ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544fecb7fa41c7faa2a6e8806062800d2
SHA102642ee15fd08371d5c130b2d378a6ac024e611f
SHA25632da1703231caf4d4b7d031f9fa74d2325cadc30fbc1f53b137d02c7ab8c1b08
SHA51288ac5a023cc33b9e58e35d32432f583f9929fc74892ca5bdf38f2cc271e11f84cfb6b7a9ac6e3cf75d66291bf5a7672245b2bb3a8e6e044b96163c00cbd3a62c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533cf760d2b225c504e9b9b594546239e
SHA1fd4475c2d9bcf40651546a6bf8d15a0c9ba2879e
SHA256d2f7a6d37b17294783ba7e4af55dd34a2c3ee498d441f1533b4286229410c286
SHA51224f48bdf2649b42c882c3c83dff0905fb5f6037c57c6cfddaed4c3feb00887bc86c581be9a54047a01ee7f24b7e57320b6dd4d80c62e4fa67e103b32418b4c6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b0283e6be302b6e6ad916404a4eb6a3
SHA1401d953ff0e4d207a71e6ab5d97f7757048a6863
SHA256a3c8560bdf89028afe71b50e77e3343fdf192267d14cae9f49bb114137ce3e49
SHA512049a27a0f7a2a6886eeb0d17770ab82723cc28f5060380967aaec930403cc754f0b6d40f3163a43b1d59472dab42ad7d7df0a375102ef6f42e61c2df441bdee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a99bc8e90eb8b9171429d936e41391b9
SHA1637f1b99a930a011c24d8dcbff70f20473db24a9
SHA25668ed3fe48e355bc931fc164497319b9a9b2d1b150922a33f2a138608cf3fd8dd
SHA5125b207d3c66a319b3ce0c91802de3bd6358a70690edbdf26f12eb7d43c6b308579762919cc7a9d415e0f83e39a2ea2b1b97c877ab9128f094622c4b5cbd9cd2bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9cbedea864c2b4880248e7ea988471b
SHA1bd564853c3dc98b3241b2be1a560ddd66e08b60a
SHA25684b76835e011141a8e6dcfc25f7eb1e419c64ea60a77f56282ff329adb8f5a0b
SHA5128b90202f1e0583ef9b0a112b4731002c0a3f018cb42d7761fc4b020411625de2f1f529d09058fad09a5426049206f96ef06e78efad1f07b946e6e714af226433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53305c40d62e136580fc1464e3a23e7ae
SHA1b88db950e94d3541a528dfaa1f1f348535a524c5
SHA256464964a2865873ec16e860c59e8018bb5e6b1c84b4a4bbdd95173ea41146dbaa
SHA512741a96cd0fbdce265b15bc93bdcb0e670e4f4706bdcb09eedc79c70de70b1fcffc988ebfea6cb6331bfbdea4017fb73a66c1b979b4747a24e568f3bda2f6d479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dd8bd8bf0c8b75a8305963231fff1f7
SHA1c0b0945e1867c0434425e9a99c44016bf782cefe
SHA2560a2427f6daa8604a45743278a15ffe1d257198190a9990aad514d148306831a0
SHA512af1679a352f67cae0b3a8a51435e1dad3137b87c94c047b7fb0c3a48f6af8d49a90313846ae3179ca9dc4007207aec70d8c39880bf61107543497562f4372e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c26cdc4e9326891e0bd8217d2ab50b10
SHA1e5fda27acaf7061a9105320d72e4bcbe3f31e245
SHA256d7eb6dacd89bd955cac67d77461d550952d7579054a999691408a0588e8cebce
SHA512b7661a4c62794b4b5717624a12fd7f8968e3fea3b5300f694287a69e3f416e2c791cba6c3ca2e9c2df25ab13dfd915235c86ecfa2f1f9ead3b761ec271f2e975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6aa398f776475b8edf63bb7924460c8
SHA1338779cbaaa47829fd63cfaef19882093f01cd8e
SHA2566cc21d3886ffd0913fa94bcfc54966ddad7c19b4f2f3fd7dfca186d2a12626d2
SHA51265320139da75a7046e03c1b4643d548990c3cf6f66a3be2655261ae4da61b4db42c929b99bc823c2557eca8d637edbd44ba31ac8bf1190b8806e8024c1b271db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559500b9f27a119b68fc4bfe5ba89e541
SHA19cdb1fe13efd62efe2c47aeeea488902ad4c0d61
SHA2561495261d1e724087ecd20b26b2a34c7605934b39a60a5c7f2bfff5f46336683c
SHA512bfc0cd7b49f87656a27dfc766b4df163c9e4358bd26ca8146ff259c505af19caac8197901a06cc32225b2744992a8b7273dae8f624240f415af23c3ab24b3cad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1e8aca295c21d55f0cd5c3118c18004
SHA1d0d6cafa1445b063d1ee7fac72881a58171354c8
SHA256346f7cebea2015b235aed8f62c3ad0bb2169fc0feec0ccb408fedffcd342d8a4
SHA512cf4d27369dd461e6e464ed8f8a40a29c7e9148a1e19d8d3bb1f476556f3c399db59618c499cecc9d225038cc16588c13e908d55cf311fca988ce2a53e2bda252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512af64485413faedb7b6a459a7f8b00f
SHA104cf3c9a89c14fae45c906e7eb46043f566bd00c
SHA25649c3ac35bf087e0128ed72dfe4bde10377dbf9b66e0780b113dc7580a66e9a17
SHA512e8bc8f502f0a2be345414ff5eed0f4d55a3d4d3fe837ddb4d0f863e65c74c76adfa44b586d6eecdbff71ba75c932e31ab0ee0281c71272ed89d7e0a74f42f5d1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b