Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
c11187d84048b26a21090faacdaba2fb_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c11187d84048b26a21090faacdaba2fb_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c11187d84048b26a21090faacdaba2fb_JaffaCakes118.html
-
Size
6KB
-
MD5
c11187d84048b26a21090faacdaba2fb
-
SHA1
7f913be8f839d9432cf613bd89efb721af68f912
-
SHA256
ca3e80624430a5ba14296c0c27bea04fd9d41168b020089d16ee70406f07ab86
-
SHA512
9b358e38f5580f599e87f2dfe522dbe0538faea85e4aec775f2284dca0a4d545d94b0d660d21ded170999e829b1ba252947219d596bd809b3cebf11fb2d40a0d
-
SSDEEP
96:uzVs+ux7MKLLY1k9o84d12ef7CSTUWwp/6/NcEZ7ru7f:csz7MKAYS/Xs4Nb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c021dd8406f7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000075616fadad516e6ca88b71b8cbbd79bcd47e1fb891283fb7d05dcc95ab5291fb000000000e8000000002000020000000fc3678d9dbe4c9db022bbcc1113a23a3acea5e808fec9a41e2543d29a7792f8c20000000412b307d688a8083d492b90b790495af09d9b6ea47b75ab8f43ab851a24693e9400000006046808e39bd76a1df23c98e97823b6614c8c31875c29ddb2a20c5b4e888d98f1866abb18e2fc055ac8694a70bba5fa9e504ad7dbffb0f6618a1ecfbeb1ac2be iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000adf1746060e45b2be4754e4885c5ac8b77e7a7dfc8111559c32ffad1a1a5d77000000000e800000000200002000000071474db8f45f06a9f244bcb681e937bef0b7ebaed22b7632a5c76485106a979690000000fadfc1e8fd7c06ec3ef74b5ffcc7b0958b0c6de06cb734f7bc8c427a0656472bdaf0cab58389ab82694918e8e1f4d2882e8040db87d85d18a54af9105d48210f59bf15356c3191486bc0882b370f8369d23ac0d2871f225c3d3f3356714648f0e38ba39d7b5b4cb68ae73f7638d25e8c4fdfd87b8c2078c307448a76bdc97b2af7b98159de976fcefbdce2467bbfd8c840000000f197625ae99a085878d6475757c5dcba072fad20745b62463ca6c6b84fce3c510ca97a38126ad49fbd7b042ce74b62eb7dd9693ae0d6028b79358ebc88393bed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95DF68C1-62F9-11EF-ABC7-72E825B5BD5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430762825" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2528 2348 iexplore.exe 30 PID 2348 wrote to memory of 2528 2348 iexplore.exe 30 PID 2348 wrote to memory of 2528 2348 iexplore.exe 30 PID 2348 wrote to memory of 2528 2348 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c11187d84048b26a21090faacdaba2fb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c31cc412923497536b025218e21bd033
SHA1fc96e881639de3fdf5fb573de4f06808e89db6e7
SHA256d127bc597986be46be1061b8827c13d22ab3ee4a373ff1c959e40c316bc00147
SHA512db65a4aef598d4f75826debb15a30d7fabedf191dde3e1242dee8b43f9b7cdfad74a90d3a0f6075698f173420fab45efb3b6acd79fb2875c413e3ed532044b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f3a47734d4653619fce66fb60aa813a
SHA11bb84d16bf1b0a6dec3d30cd041c9c3663cff813
SHA25691b2335740a7a92cd54e638a676615eece47f038be66a3db889c1c5188ef4d53
SHA5125e96242f096ba119e1b4ff5a169340f586572484faf507bc1a1bf3db345cd03691f5d4245504667cb1c60c326bd32545d53f9e5c25b73dc859ef20e0bc80dbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53439a1449b68c970b7a8e420d1e3ba7b
SHA10c65b2e528003fc5667f15e2b9b087c228334601
SHA256fba439095dd0c7ad133259fea6e4b85878328eecebcf2d5cff9359853fb77f16
SHA512c627cb303bc2d79c6d5da36a84fd4d6fdbaef2830d1502ff9e4ae05f316ee54d9c3b38996506f71295028f9c9a714337a386a03d82d45214d571fb7e29a9fbbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5170846a5a5e0c18c5950ff837c72d745
SHA17f6e869529f71252b72096313e92453dae299478
SHA256fdcf90db96ecee91f6836784c8210a0185c4c19eb5dc30fbac3f1dd19e361eef
SHA5124d2e1bf112cd33b8a42de1472e0ca287faaed012dc77464b62836310e1ff4516806e0dd486c5bd73cabd89acec885055fe5f404b2e684ae0f1fd1b2fafe3c4b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526882b320115c8ede4ba3a8bbada6c42
SHA154ff5555b2227dea5ff82285cfd06a9f00c5fd2b
SHA25628bcb24be738620c451fc2fef2e8c97dab526dd609679f35a9d97d69f5c9c044
SHA51208ce62ffa48589c073b82cbb7c1488d1568faaf4471cbd812c265676c9ba1d0437645fe3c6d27ef8d3ab7c4b7ad9904d5d8d31e7ad39c7c9e50c251d9f755fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5373f9c5b1b6031a997593a233b436341
SHA14eeaf2da57a1c482ebd2756ff803d7d1b7a84651
SHA2568d2db5713953c8772a5aa9a02128926137b59a761070325ce9d4cae404b5f0c8
SHA512aa36e64c5e43bcddb0f8c5520388a8bfeb019a8ea83c9a8db5c22aca772eaaa5c21fd7367b31088fb302237b69a3afc5939ba5d69d2088f64f7678997c51ca47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2ccb876b7d0bcd3d271097b2c6be9aa
SHA1914edf22a384f7b172803bb1016e9f39d8ee1006
SHA256a0919ac579f7f2a3971ab9af70648f425d8350e3a7623ee8573e1d1d566c7226
SHA512c5df48bae313c99e8d75fd04c0018375eae397c2cf8ca3feecc85499f2df6c92b703c674d4e87bca37bb4d98b34f265321c7af02d7b81d831f23f3bb561ff6ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f4f61e49313842561a2fa5e74268b96
SHA1a6b679e59a102d9df384697a08a401f61f21d385
SHA25636bd006c92403c6da97da5cc98f53c59dcca658284c5b957ea33c8a649cb3f63
SHA512c5fcf1353cf230ff75d3d12a2c5e5c4ed6a2f5becf6d8015daeaf45e1e83e314528ca0c63a853078dbb02b585359fd57b0c12b1f72002b538e057fce8b9f221f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2b11d4d13ac6aeba2d7bfdbfde13447
SHA133bf8b6d03ad9ca6b3ef07f6976f3a4d53a71acf
SHA2567869dcf55fc3fc71a88ce744f2c7656920374297e6a3e71dd13a0c7a096ec872
SHA512b54f77ac2bcee0bd8dbdde29784529d24ed2796a3a182141f87f0ef7300a05faed5f2337dffbca4f38261ad2704bf163be617481b6f50d16956330a3c83add79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c65b77da9bf18026c1a74b664ac60774
SHA15782715cab0f7859c3e7184eefc13e0c60382e36
SHA256b6bdc87ad86d61100e64e5301ce6c39f6d19568079259c114301923d2cdbe18b
SHA5128f1efaa3014be0fbf658ddd30f3bfaa15e3a76f2ea056be557d756bc5bdb04ebab0acba98d6d9b743acf475e95b3f57ea363f865d584264b55c57258b8795c9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8143a522557fad429ead249f2d82ad5
SHA1113e6553e6868c4e100fc15262ff84426e7658e0
SHA256361fde3dbb3652248221e9dc30dcbe3cb24670a417c1507fdd251d6f054aa63e
SHA51283ecd6b3a8f442c3544a86f92ec06413d8d0b2ff9094f0353a56fa155d4994bd62ac834e5cf14fa24c48b7cb11e708ec606accdce1476dfbad215399813045c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b98a3d33a74d1ba52d814efe9dfab2a3
SHA16fe43606fdd0964def485a453abc5882c05b96c4
SHA256bd05b404bb8076fb6ddf239f17a86cbb88003c8ec69e6bebf36d04ac43d6bda9
SHA512ba889577be8559fdb057326cd721fefc78c3955f9101a2cae5c743e22e9d3a54e14a14aadac58f07acbd234f92c89419969a7581fda888f68b7fc772ff56d76c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b6b66137e45b12ff6e1dc85cb02cd67
SHA159d2e865a25529f9b9d5ed36d51c40e2a4485710
SHA2565a32727c1b3edaaffcb684e3dfdfe667b28aa88d94d5f64412a1e4b9e7c98683
SHA5124cdb86069eb855cfa15419b542c32171198887b873a83aac919a3e99cda4d006edc85e92283a4c84fd54d40c5d09ccb79b3458c7180cf6e6343a9ef0c19b37f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533b6b370a5ce7a2b0ee628ab2461d496
SHA1fbdfc89728cfacee5e481a0babb4f22d0c439f85
SHA256fe17402ff27bfbbc973e56c9db08c32c8af6fd822442555700b70d526ca423db
SHA512950224419110f590d7637e1843351e546483aa25ece22a439e3a3378af268911db68bf97cceea30231c7a270b0ea11cdea88b0157fd84c5984f90b67991c5857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5841ec4833f67bf2f7ecefb92e46ef53a
SHA11253c9067da53f5e1ee24101999ee271a97ac30e
SHA2569649e6960fc2a3ccc6382ba68a6de901d2d037ad72836d3947930ee7e03f59a8
SHA512fda04a3635d2bc5226ac48a07dea870f8fd5cc619897f39342c2c9a4276b9213f602873a78f10e373239d73db67f672bb794163280b33edfab73d128f7946447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb8bc3e5712d5e3b57f287d8de83b394
SHA13c9a5c717a43cdbab0bb4ba1441296bf1df93e10
SHA256ca88f28bb0c9c5e9c51afd93485bfec709ad7f0035f9175fbe318ea78c38b4c2
SHA5126213247fab2a231e8cd488671f71e9cd9a36d1e554b5d07e8a23206f73ea4d8024a247971a167f8fd10212033df7645a79359b9f048e48700145ba555f0e67e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc29e77109d10bc0c26e3975f4aca036
SHA1a75568c44215000309b153fbac3fea61620a7ff8
SHA256d2e550b80389d83e126d5c334705a0ebdeb156743988d1639bf0f548a769ba15
SHA51211b9e5427f910e231feaef79bd33e00af1d90101eb2b9a51a84709d3917ca674e8e4fe4cf558cfebb8c2324e9b071eb5245251a51b456e07042ca8d5e362d529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dd50d8fa33c110b8cfb6c1bc3ec36a8
SHA149f223495587811a642cf1152642dce1ff279c43
SHA25658e2035aa43e676287103489e6b0a33cb251fcbb49999112f1836ea74793b6fe
SHA512edd2ccbc5e3e0bc36c122035fd715512e66fb557353b3eeb1616d768ce22f915cf570a4699aecce4a8ee9862466ae7c044334bf07a9390a5fce6cf2519f97b77
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b