Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
c1764364367b0953b7f2e97db7a1ee04_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c1764364367b0953b7f2e97db7a1ee04_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c1764364367b0953b7f2e97db7a1ee04_JaffaCakes118.html
-
Size
31KB
-
MD5
c1764364367b0953b7f2e97db7a1ee04
-
SHA1
80e5f99457cb420a85a573d5479870bc6ae5a2f2
-
SHA256
1bc25e3d996b8847ba0612f4fc4d67adf7f53a10707cc5d05bd12a84c0d9a4b7
-
SHA512
add4ec99db3d7317d60615ec9c5a0df7d87afb157ed9c5d2ce2c98fecddafc2dfc2984d4d2890396f01d165f03ec7f342102f568ba0475871cee624b107d17d3
-
SSDEEP
192:VWCk3GDG7GSFGNGeWqGUpGtqhyP7b5ntCnQjxn5Q/YnQiejNn6nQOkEntkinQTbq:ACk3GDG7GaGNG9qG8Gt5Q/sWSeSQ/j5Q
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9775F191-631C-11EF-91EE-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430777860" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 756 iexplore.exe 756 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 756 wrote to memory of 2528 756 iexplore.exe 30 PID 756 wrote to memory of 2528 756 iexplore.exe 30 PID 756 wrote to memory of 2528 756 iexplore.exe 30 PID 756 wrote to memory of 2528 756 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1764364367b0953b7f2e97db7a1ee04_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582ddc91dac2a225798539f9d6e36a30a
SHA181da86b6b97f9ddcb8a2e48f0d8d5d9930965df2
SHA2565a1c8447210c69162fa268f854035b539f7528d6d6ac8af1828b41afb5c0fd37
SHA51280f934a60dabb306b56004d2404139eb91073c3cd80dd0f31faacd087e24039232c602544193cf6c74113a32d1912a9816623da51a48d02367db301f3b35e96a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596e58bbca5adb71d23b86b5d5b2d693b
SHA1459f670c962f60080ade46c19b18f75c2ef16e11
SHA2564e2e68abd71fb601d02bfb7af14a94e265c266feb1559dd0482c13fc72e6c45d
SHA5122a7609d700c5911cd5496b71e5e183d1957a650a974573432a280f1f0b09b2faa876705967a7db35782c04de2af0839e5b1715f512102e57df23fb4e2ab61658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58154e3f972e5e9df464b54e66629fef0
SHA1befa8f76d6779ad8f7c052608f51c1d7119c627c
SHA2564b08ff65046d2132347d8fc265246b6a03e3dd4362d59d7b0a93640a65489794
SHA5121e3c9edee8be2f66658d27d9b76d8c2c0191aa86c747d68b83ffd33f31928afc9ce3281a8173056faac419bb06302104fb18990cf063ff4fb4630be020743505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5302afdc48449d081223880dae7cb19de
SHA1389cc05fad486c5a5fb8339dffc57a1ebfee559b
SHA256130ad802d8d20d9a65106a8ce1a3fc18c3d9da789f9b6e933d1613fcdf8972f9
SHA512bbf8b974fd4749aca725e2fe9b922434df1f0946a6cff9c0b8588c88d18dbb0830b61ac9a04bd62ca3332d8db1cb45878b5b9378e6e59eed9b86e194d1ec8412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55252316f18886f732fdf882c77006d9d
SHA121a90427f9e996fb6afce423ca056abb63ed0b87
SHA25619b6615dbb238a4bc2bc1164b3e1b9cecd263cafd688eab194de74e6aeb02628
SHA512904a6519b016c2fa0de5e5d5c3f2087558d0295f24123102320b7af8e6789630aca6de37a86fb1c6e7df1e9a88060d1d7b2cc37b7d7ab8204bb4ca949eed620b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5107c81b39b26cba3863d3e8e58afda8e
SHA1edadc82ba233710222006f082c09e8a67d75ba56
SHA2560f28d3ebe911c11a389a1816594ff4db7292468e7f107119ab34d07ed838d167
SHA512d5c6cbcfe78f6088842e59150d2019fa7071b55bba87044127d74c2e4628811d1a99fd17af1d00350726c87374ed6ec5446cc90363592f89079787896dd15926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59291f9d11e7f37c92e3642500affcf31
SHA1e68dcb971b37c450167024345335c28b2cef3455
SHA256d9637825243e3d3f718a0793b5233015dfb95e788675ce7ef8bdf9170d140af9
SHA51224cb0ff71648f745b74c5dc337cb3e1de7b41766bf6e5a3e55a204731504a07b91722de69d26d50c94fcf56dacf5adb12f1824691271c3b0c62eab53783f6b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5156c28c2859a64ef121e6ab617ed2eed
SHA1a03e34091b2fcd231dd4ff9eb2e6bfcc07b43290
SHA25643a07112a207b4185dcdfeb092d6ad9096237c38789630e745928ab4a89964f0
SHA5128f724207a423d11919acdafa46f56b7eb9995a6ef5f4806c5ee92c88f2d95d5273845b3d77f813613552edd6ed55e3ade17a361e4279e320f58b48f143eda8b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584102f4ef753fe09a7bed42a101c7567
SHA1a0227f12d9da959393f02e4905336267b042e157
SHA25653379af9d3c320fa1646b0cb42a03be58d04536f7e4261ec41c7c94f16c40edb
SHA512fe0bb82f80d48b0cfd173df9502cdb766f4152e82e05e216556093bf15c0276053d73ac0ae879fa53aa0729cd31de6f334dc01f832c77ce72c1eff97dcaca503
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b