Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
c02e09382515cc869b477dc604658a1c_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c02e09382515cc869b477dc604658a1c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c02e09382515cc869b477dc604658a1c_JaffaCakes118.html
-
Size
7KB
-
MD5
c02e09382515cc869b477dc604658a1c
-
SHA1
40a33f7fc3de027209f584862f1f7e0793a4911d
-
SHA256
cf395744989852a05270822d54e36d56552900a6b30983790aec1035a51d64f6
-
SHA512
bf3af652ee00c4797dec8984266c40992980feb37770e3a195abfd1ae4b6e6d6dacefb2fe5955a666bc23b671ec0b6472ad3f2c806cd962a3b9f50a73b93a1ea
-
SSDEEP
48:8yhwf3ERHfvXD4xpw254lf/ITKaJ33hr3hRprJgNx0p2AR3Epc4qIzMOQajMDfz4:dhM3sHfGXyIVJB34qI67bG1BWhWJyMNX
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000d003c575b210fe1398efe21a929bdab2ba95cb225d9fe35e36eb5ca8d3f18ca5000000000e8000000002000020000000941931d38f34ef263901624334a4c77e0ad70c56bd8ed64131282c2577dcd93a2000000070732aab72c414b17aea38a8b1bdf43053e3c88a31b52ad2a471836c354283f8400000003f74ba271afcdb142d0a7ccd389afc9f2d045c84fe9063cb9f506b3d83eb336b105f60c16186ca2c619f69bc0478028fd1e48db5ae1ad5fc089bef4c9a47b55e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b069f156bbf6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82610291-62AE-11EF-A4C8-72E661693B4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430730579" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000008c5108ac147dc6364c73aa6a3a32ea75db13df1ecdec2cb6c8299f0cb838a985000000000e80000000020000200000004ece686bddb9c4c5a0e6e23a3ad562cb0a140510d94f9f61a8f375e0e2c613179000000082d64229567cfb19033ca4112ee5daaa7ec97a60e92e33c2809a285a92a83b826e7588a10b1313c0386cfa43b4e4abefd38c22fb6ad4597c9de0818681a8d4ae37656e7b5c5c1d524ad0df372a1892b77a35f1b544be38cd551a0a0aebc3e0475d29aab04916e9aea135b76963985a37ad3b35d600fc559d88a97c6c03629ae088814cbe0cdb635f0bb049665cde5edf400000008ce85e1a7057d24dd27295d21f88e63d6108fd9814f597a1e760aa6c540eefad44983a9b9a51563dd93323bfed7697023e98669dd1debc12565e3f6a3510dc91 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2408 iexplore.exe 2408 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2372 2408 iexplore.exe 30 PID 2408 wrote to memory of 2372 2408 iexplore.exe 30 PID 2408 wrote to memory of 2372 2408 iexplore.exe 30 PID 2408 wrote to memory of 2372 2408 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c02e09382515cc869b477dc604658a1c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5814fe1310edd3bc24ccaa75d1d8c53ac
SHA16128f4dd00988b416d82cf86959a140378e2bb78
SHA2563c764bd5df2128aa4cd7e9276940c7c6e6806be2c1162527ceb2ee389786db85
SHA512c32862371a458bb1f0c9163821711f36f0a320d5896e89a4a7e93d0737b4c8fa28cd8476171ace5d3dc6355efc0aa828fd6b139b5f4a8ec695397a06adfc408f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c2be90ee108225cf57dca983e38906e
SHA141a30578a781b1c35ebcdfda877bd8a40fb9ad8a
SHA25652d655fb6c69d1a0d0b86a70046be1c7ffee791de14017b4e995d18474605d67
SHA5126232af81ddb0090d0de3e0716c93e98e446660a40418f785c546d3d24581bd6c8379663f5824e5b3b9cd3980426ab37678467c2c158f4bf369b036a331dfefb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528643f0b2c04e7b95b074472cb1c3ff6
SHA1a2310733fb71b598f177bc334d86bbd3530179c0
SHA256c60e7c8d133630a18a973aa37523bc2d710b1be05574ee666541ba518a60c10e
SHA512ae804b491e7640402e224547e38d2f1ddffb53ef3e9cbbce2925cbf794a85d09b5379c17e4f18b310e13be04cc39cfe3f68088155ce44265e693114cbee80740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545452ebdb3ef907610e932a094fc4e68
SHA13208ca192e26a62a058fc55d196f5502c2bc6e97
SHA25627ff8f8c23725c8c45ff88f380671dcf1f662519f5223685b6dfedd9e4fe1931
SHA512e5f0f1e1b4f88b771c511ca1b835a7663a7e12cc13e95a139a33ab7dbfdd082a1e780a88db5d7ee34130bc6f5a73b115a1a9ab40331d28d426edbd1b91c6fce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5408045c7c35b8a3a06392e932b3fed3d
SHA13fbfa654111c678775448e7df50c74bf169959ca
SHA2569a95fc8e3be8dba48782414843aa02a28cbaf507114d68c10ccbb3d33d6eae6e
SHA5129c22c6eea06483f02f11b73a1c91701486b3e1cdf93d3265a2169b7973f10382c101948cf61a8aaf54c07fdc6b31d84bedcfe1bde72e51ad4c218509660fcd64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba0b88a42a62fe95dc9887ad9a1c0606
SHA180903581361b30134b85985cc7f2d01b3ee3be04
SHA25691cfb7386c2d8e931ae02f92977d39031eac1f3014c519f2aa1c35430f0037c8
SHA512348a798c50e3b58bd41fdd0acc839a4fb3b9244f6ddcd3cbcf3c51c0b33593d94fc6b3100f05613a75f4d5d745bf05e1e2ccbcad67684cff1ae31faa39a6d7d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfc42142d1346fdb94885f5ebac907d7
SHA1baeb16ae210fcddcaccd9849afb9dd6852b45c39
SHA256662e1bd1b941b64b821baa739e757b6b5e2b3661e4a84fb7d1bf3471eea4e9ce
SHA512f84b58a67b2f556b333ad4a80a01da5fd46da70165ad7066d1223369ad69cc03ff89036d5864ae9c2ce539501507a8caaacd1d2ca4fd80379ba30ce8a56fac94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c1672079997490ef82868dae90ce6ab
SHA1a163b51cd2618f86f4d4dff5d6a9a26dad1fedb9
SHA2569f02b82dac456558e119ec3e2230aced2dbac7dfacd5e671d1431a9c970937f1
SHA5125526a1e63226894fb7a9c60fea3a017c64a86fd02a646eec8c0ae6e3c4b39df3e64b256b0bb45f704f071949234b199470c34de9efd3df1da15da8ff2bc25ff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534c953c10093a597ce8d4d9885e72308
SHA18198cf8454ee1b82115a3be9e5d8138b4605da8b
SHA25617b056dd7e5b32020f215ea3f5f8440aff0ef86c3fed0aea485ea1d4399f5a6b
SHA51210228ca78571c8915d1d6526e88a09ec105169b3bd5ab134cc771055a790ce8623903ecde26be9c9de68c4694c4220bf957da1f27290518c490af9a1bdfbafc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516b40b48265349a1a7d92eec8c47041d
SHA1ca83650e4e7d4e669c0b198c75880b7720298a27
SHA256c46f29557907c5a1f5a64d3d16b471d3d5cf2d5a2b4bfee43e4f164993c73718
SHA512e2d1c1402861a19697ae8ec45d4c3c5de785d7e588c780c0815f3b8e3edfc20998872821d893e48354bec896d408ad9559583b6c179b1e81861fc4c266e83147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55360b23e275f6c565e26d6940a3b011b
SHA12c5db0f60fd95bcee20700d722a2dbf9f19094fe
SHA256b7f19d8e4c1ebe58d72471f26951e4eec6f05910473064e1d60851b793f4e9d0
SHA51231f2095c81cf122a7f6cdedbb797168c239b6be9b4c34538b87934264df18490f03a190511e2febeed164c2b45e147f97ce13e0d3462c04d1e9373eeb9b497ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d17e16dec6ab3e04a05e2a61d8bcf885
SHA199a17354c8db5a9c31231b481dd276da2813c1ed
SHA25685a0c3a7f4cbbd2b94fd74dfebb1ca3690feafc99fa9b868b977782f1cfa9281
SHA51267007b43da1956d131cf9bad2be222f7ab1829001c450222a7633ad47d537474159e57f97e45a8ee7d30e7bcc2f4bd401e4c4c2cc591ddbd75d79d1ed017fd16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebf67af913d27e33be9c75e53c1bb4df
SHA1d3dd4c679d400a5d6b4fb628b1fcd7ddde0785f8
SHA2560d9f62b981f250f1cd08b3be30b6b700f5343962e0e4032d3e7848e60a2da68c
SHA512cbe63acb584a7ae97a8fae6a8b000aad8a323615980969e7c6212807decb1ed70f0311f0efd17c3fcd732afc9bd313e3c569c5f7a861b7e4e3a1a5238f8bf41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0bfd3e2fe1ac54921f31568f07229e8
SHA18d8ac40c4337eedee5606c772ee9045e79c3d4ed
SHA256aaa3803e43abcffed3e1a591414192b1d5d0508b604e19ef3c8b33c1def32dd5
SHA512201082da670b2cfc34e0d44a440b96f3c6ca9036ab1db9275fa50e8dc39025a3856bbfc5f5b02a141ff86e6755c7e8d9a6a3d7f0dfe722127a6e5da8c9f1af82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3ea13a63e0ec0f8af1db87dc413180d
SHA17e2ff5b11a0af672d68dcc27eec73f6f23613cdb
SHA256cd5665c53318200c09210eba7f439afacba378136f2afd65dafeecdfc6d7d8ff
SHA5129b03a929fdcf8678eaccb92abde578b3eb431b86ec6f97970d8d2e8852539cb623a53e3448098edaf9ee6a92497c575ec142d979bbf2e33c96365ae5f8758cb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565b01cb1ba497c87f48ec21f5ac4710c
SHA158f32a8c8fdeca8471e552d5f0bf270986da16fe
SHA2565b74969718ac08f1595cc2e5c7f9433f1f610cfa375e5c087805e262fed70f33
SHA512de79d4d2dd2f9bd11f848749a6a1d2ab9ab3d9330ce8c682faf0fc80a2765995e671741f64c1d17455628a9e818d5344ff60b2df24ca7866a1e5c0230dea4646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cb2d1835963912d67b644c4a6e75e24
SHA1bbaf8e1891c79b10c6f51a17f79eed5ac0a03a58
SHA2564bea72b0645e983e2b41ea5a5b3e2c3461389cd3e94ce2e2783f6f785dcce78e
SHA5122737c177831dcd29617fee5470ead7186c8ced6cb2cda26033386f565a2e2cdae93701522f5c9d4e843e7150a727c13914b8688790dfb3be46e7932d2a01d0e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3a3addfa78764343eadaa9efc70bc6e
SHA1ff34f2334b68b0622fff91b94bdf0f6a1fe5d5d6
SHA2566fe3115eb5e332a6ed178f62f38d3af28439cd5ab77eace22a7bb978beff4562
SHA5129ceec379aed1ca579b258156f0cf477dc96662d8f7dbc9044eeeafbb379095735128b5e4ff3884e66c35280d4ac7ae7a2425494d381a2baa6de6a97aec5ae302
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b