Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
bf65ff2f83e0646ed14261d826799a07_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bf65ff2f83e0646ed14261d826799a07_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bf65ff2f83e0646ed14261d826799a07_JaffaCakes118.html
-
Size
35KB
-
MD5
bf65ff2f83e0646ed14261d826799a07
-
SHA1
20be833ce6dcb716109fb1a7ae9b7f46fc3dbc71
-
SHA256
4e6b55772634872f499eb43ce9ee7e816c7510869116c89c2edbe56adb85f93f
-
SHA512
79b7ceb87fdfed877726017413a11968f9bc428d87c9727a361a02afe50eba2bfb0a4a4f06cdea60b428e264991717a6111de21e530bbc11849c61939240471f
-
SSDEEP
768:NXJIzyNH1pEXfzdHkdi8yO0z5hBnIHF3m8:MzyNH8XfzdcitBn8Jm8
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d6f3051abd680f9b02e825009d9e9e377acf3718074c345d7263647b8ca4baa7000000000e80000000020000200000005525c9dafd543db859cfcc9d97d2a9795915f96f7ab7e5fa9eefdf5fe538b7df900000008acf37c61bbe38dd865a3a24161c1753323ca062a615705adbe6ba0802d2d8a3a53b7bac9d5c0dc45ebc8d0c780a1978a44ee3cc78995a8e6e85f73f894b2b705a2242c6d78c94da83b0db93527286a32aade54d90f817c24f27df59d8cf8ea64472ef65c37d752480f77967a7d5b8237ae4d67b1433f68c8332c54ad26a9132f3ae3d0155b5134027fe9a6816ce5c3b40000000bce2e14b6dfc52bd4616c822d7baf522c1ad939af3474cd73c7bf746d4d84ef4f47a484cad70f07f7fece116309f134fcbb7411d19b5637db13770190a6b6ac2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1067d0a968f6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD8AFFE1-625B-11EF-A1A6-7AEB201C29E3} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000004e4d39e6370796a461f4255d9b90a10e7a46a367bccd84a36bdba8e3436682f9000000000e800000000200002000000010fc4c2327fd45b323a17d9ef0375e060ef10cf7a7ae85840b7bdd263605b09c200000002c378c1bb15e461bbed7a9b72ff37407eed71e1b5cd905be4bea19874cfa52e040000000202c8e9d82a4fdcbd9123a5452027b4127fe7577c5d4f1c340b79f78d7ecdd996b42ed208691e2f0620d956bf9ee60968ec4a31c95927e51fc2c35f593b70a42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430695032" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2768 iexplore.exe 2768 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2804 2768 iexplore.exe 30 PID 2768 wrote to memory of 2804 2768 iexplore.exe 30 PID 2768 wrote to memory of 2804 2768 iexplore.exe 30 PID 2768 wrote to memory of 2804 2768 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf65ff2f83e0646ed14261d826799a07_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5c713575a58db74318b89d4760ddbd2fc
SHA112dbeb3347476707443b14b04870abe6b63cfb8b
SHA256b7de52a3311b567753f90a6855454f5774fc107cfb26ce82c5fc56b97ccbce5e
SHA512ae587ee4e7209d6f63fec9348d4a48fa5eb126454b230fc06115c861459fc63ee70a539a81d0900cc44f6705f1afa8819a70bf85c9dad5b5eefc0e301e2c41b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee28841a6259a632f29115170835171e
SHA11bf8f96a397266bf3756244de9fae4c5b939feba
SHA2567db4674df5d88651c378b48c947fdfc6dab48c2b253f272bfcd272f1d14d3e40
SHA5126a70d0e7df2e08cab55a1779398011f80a815a24414df0c6741c99edce3c51929e04c68b42110c3d6ff38e14f4dc45bd43a8048d99e83182d320f46fbc2d48ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b4a6e48c399e87ec1ab8f301d8ef0a5
SHA19540fbebc88302baa3382faf2a1456621d042de1
SHA256e9f2c8a097576eb2ed714ac565147a3efa07eaafd52bd59c45966d445f75f951
SHA512f05b01e8bc8846728b04188f9a3acffe637bff30f06a6f7dcd728b89605e5992851b9d4a2c35d8bf21ded342b42f58ae8badae46d95abf619535326c231f1c3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545039cb70f1ddbb6049d25396339f7a9
SHA147a3b995b071baee8eb803c187cc7a69aff1eb17
SHA256ae4965a0aad228869ed0ce9acc94ae973f7e3018c8e1ab374cbf64d4eae1b875
SHA51217b9ec7d5b2352cd78cae38603508e705e3139352f56decab1ba5f0e2724020fa8d19e881e276f7566333436e691b562e95b004e69b86f2b4a09a62bb6abac30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5902ad9c5c551dfb45cde7c9def25e016
SHA14682dd4c68ae9ea0ae4d88bc96f9e769ddde7358
SHA2568e90164fb485d8ffa3a2bcbd8f45f98f4404e60ce5ea5ae580718504b94fa926
SHA5120ad0144cbf8339e9178ff3fd62e3844ba396e367ec76de6d7b1b363bfb6db90a7fb20d37b6d6bcd7fe073fddb0dcf794fe24c917581ba141d332b90660db3b12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5406f6eada5b3d56c838766169779e94c
SHA11aa094c93b6a1ac79402b2d0002c04a4bc30a991
SHA256b9357666caac1ea07a7964f38784ebd4b0d104cff36ce5214b2ed93ba2abe93f
SHA512b8f1d30a5bdedfec09f0be28906c535c9da38ad716fe200e656439f82bf4dc630856257156719b5c51de7faa9cd17338be75841f0cdc8cf555f3baf7609e5602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595f6ed4f8f6b58866159649d2d6918e6
SHA1b46e6872460e9e614f5ca1f3eef5d2fa1f44a4bd
SHA2560dbe1e48af6606f7d0f922d3181cb1f7b5b0e996fbd915d043b1a30abbc596c4
SHA512488cc97f54a7d37ed06913eec78717c02ee66983d13404a854877d587a77077f0dbc2f44ddbd935fe0b28b81de681ff1cd66010252e90cc1e80bdefe5ebd03ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf9ff40f68c09ade38cbd3a2c7b14e7d
SHA1ec1d86bfc14a16c6916960b55a988861dcec0cdc
SHA256b8c44c40980657cfab14fd5c652649deb06cfcaeb4ac9f7bd8f00087daae944a
SHA51223273f4cbc0c9b38e34f4ca3bee40f59c1fb10fb2ea19a7bbdc150b958ad0557a1b1b7f880ae76f886d451196f91e9197a3f3c3f687992c0537a917a5ff351d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d22a23c9109ef4369dbb9f5ca0c8dce
SHA10000dd9ed13729aa0d129db5205355f2f72666af
SHA2564d48769dadb1dc17c9995bd0bcaf2a8b207bc91c2b8c4b2f13d1534658869843
SHA5124e10a60959afd94227541f2af7243853baef22e6985668f7b6f74a41024ae5cd31577b6df4babdb9e7a1d7b9f7e713e881ee2609d3a422c8308cc46af0410724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57303160c1764a337564132703148f44c
SHA10693dc4bb908f1d3148c5560a3237430231b3555
SHA256b92d7a436d82edade4470d2181dfc777facb0bc5dbe076ef343726549e25e819
SHA51200bb9b4c63de758c5ec0ae0cdd6b3ed12992760511ae9dfaf0b5b3360043520b879773aeca9c7c8f94b5580f37ada13bcd6e9ca15da167bfa92974e08c1d3681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5190ccf3e23a273ed1784950a8800b928
SHA1f40f391a7fd635b7bf6cb0d30ba14bb096629a08
SHA2564e80fb1e53423e9f6fd6d26a0d930e41b0e1409930a85d3a36d9f9e25ab65f5a
SHA5127ec3a18f63775cd9c6fb434daf12e99ed864c1c96cf8c2c9bb9cefa1c0a9cd202a0a16a566f625b96cea81abdda42d11866dd6f0dff066ef344f2a4da94abc5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51c098d69c1cb1b5dabd919583608cc57
SHA15444c2e898840e1b432753eb9e4e9f34c9e61157
SHA2569607fc4df40d50213598917367c759e1ab46fd77609306da358958474e17684d
SHA51256e41757135d7746aba56c5f01781a23473fee6cadc3b88a8a0e69ee6c4513023236009acb39d4cc629bc9420ca3ce7532dcbf430ff96054629a7bb4721d3883
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b