Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
c231b6555712aa38229243c1fc424112_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c231b6555712aa38229243c1fc424112_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c231b6555712aa38229243c1fc424112_JaffaCakes118.html
-
Size
112KB
-
MD5
c231b6555712aa38229243c1fc424112
-
SHA1
35a7a35cd90ebfe906c7ed7e00b700b4d88e7347
-
SHA256
586a4918ce408c5fcfae753362afc8a834b01742935728cb9c36e83b46994732
-
SHA512
5845250f00e1049b165a85ffda3e11c550e5740ea767f920e006c5f9d04f8ac40e0bbb05d38884b43d6a5997fe6d45b4fcee2cb2704139a6aac607148a570332
-
SSDEEP
1536:8yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQS9:8yfkMY+BES09JXAnyrZalI+YW
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f0743b68f7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66FC0971-635B-11EF-9CB4-D238DC34531D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000092d90f822b20ab38e8cee424eb710b52443b6d49fa576584df9645256258a618000000000e80000000020000200000004355c50d326bcfcff0f823e0aa08c8e327c1442578627a2d4b8bc98b00d9790690000000bac3aae897e7191ec17072b64fdde3f51ac07962f6a4eaf71167a48e1eea5d1de82ff5466f1110ecd64d50f507e1a66f485b1e2d7ac7103befc62477851ec3af91b57981deaae8488b87adcf5ae3a3c6856eff9ebff2d60082d8017a3d935f357dce172236cbc8a362ccd8fd4cd9a87138ef4d93e8cb34764258624f8dbfaa2f3bf0d5a1b9e9868653f829e0bf71b16c40000000f1909e49d712dfc515efbfed35ae144c16d6bab2c32c6ebba9c6a08f079287a35deb912444bae368c9d5b8a1dcc0e8186bd830c6d8f4385389bc728b1b1a2ede iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000013bf2475d85c2ee9809872e90350e49090311499864b19278a2eecb50aa1035b000000000e8000000002000020000000b6c6e7848cf1e663bc1ab16e9a4fdc77662a257e98f14c2141d8554cbed6c0432000000076e3e4e4cdfeafdf849cab6fa6a6f3be36e5323f093f138f5d16c6193a5b0e1d4000000096e88277368929d76d6f8b88ab67a310f61e68da69db171a717ee68baf61667694621f3fcf14629c702bf00a67d2742fc47d1823806f3b483af7b7326ff05efc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430804837" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1928 2324 iexplore.exe 31 PID 2324 wrote to memory of 1928 2324 iexplore.exe 31 PID 2324 wrote to memory of 1928 2324 iexplore.exe 31 PID 2324 wrote to memory of 1928 2324 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c231b6555712aa38229243c1fc424112_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5093e7fc2af67122a763f02ac77e78000
SHA103433a8b5750e393b3a0ca6ee1b7e1a8eb74b913
SHA2564590ad1a72f94925606d01c22ef1844ea5e04c061969401abece7085b7ff368a
SHA512bc5bc086fa4c806d1596714db1f8b7fca79ff0b221ec2855d041471c5cad6da7388ff334482bd9e74f7c3a8adbb66a64052ae226161b559408e17ec215ee4dfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5722a47d39afc6504366e55f4859962c7
SHA1dadc85fe370ae7178c661b064cb0f9c92bc2c2f3
SHA256cec7a709e7fcf1d29e91a1bbaf7c09b141660225db94f60678e4d94ad7281ce3
SHA5127fb7999ff635d6856e2abe45bbda69d27e8e351ee834ec751d2d9051df22712a854d32843a8fb19de2f39d954f8e4460b05cc8e821e44d1cba7a5dece6eee1fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a34cf112dd16cfaebff6117c963f184e
SHA18ef44371483ce3fc511c7d37d107f121c501906e
SHA256cddaaeafa3250d35d0f55f4c7e4b973167f1f5b9c06b9147a6c4b62992d2ba30
SHA5120f75f1f1794dbb2cba8aebc849bbafb1b27db5f558e0ecb35cbe0e00a321a3267b01e7dc9ca2857d9a41a04e6f6de760a1b2a91784e11d7d02afa42f401e4c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58771369ca7a8ae2f42ee4209d22e4665
SHA15b0c90f9cce292aa0187d8ac743f7f174d8b8056
SHA25655391354d043cfcaef1c4c92284958b323f826bd5ef467de9e7f52fe51fc7a98
SHA51237a4d0b758072ca5441edb703e54df152a7295b23cff0b114c7170421f17f307720e306fa4349cd85f17da92b20fcd4f3cb55a1cb19b1ebf5373543fd714cc2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ecf1075bc05d78c4ed1cf6f89090720
SHA1fee14035cf9dfd8ad6ce76c2be80e3cf1081631a
SHA256e61bfc6a11ccdea28d05f7fc965e9c29fda18daae896483d443605178ee9b4fa
SHA512845160c0bd2bc8daae6a1532f9ba526102ed6d81899ee500787408185712d07a418eaaf77cb77e76006bb097da5eac1034eff1da9e5579189a5f1880674636aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a22dd9957e579f8f73b057392d21d0f5
SHA1f3c2665265ad23b46219f84d6323bc41b46aa217
SHA25608121b50c23755dfc9c8febca38c3fb83ecc9cab6237bff2fc6bfd7dfefc48d2
SHA5121c07c8e3fd14c11069434f699e216773ba81f3de4e332b3381b48309880fbf6792a06ac2aca7b0dc60bdbd48c6bce1b63445ffa53a7d8a07c7ea7cef152836f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c9f7a399841cd795fdf343f78dbf844
SHA10561dc94f6fcdd6d24656095f4e1d9ee4f06507d
SHA25637dcb4ba33e30d4e42b9914d6ce6dd77ae64329b71c5b2eb9e8180f40e0932f0
SHA51228e66e2fb56ce5a8e6502888b2ed1cd7823b6bb85ffd9d13c0c877296166e5b01c7e64dfd3c2f3df3aae78c5c8e769c3c4e6f32b7d0de3aa248778833dd8a389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5392086f6c6f7fee7275fbfa4639a3729
SHA1592fc83568db7da3946fe6affc8b444bb51b049d
SHA2561538064beca4f9a3bb66668dd899eaa357676fa7329934f713982a85f45abd13
SHA512d44311ac2c852936bbaa3af39a18a41258eda598c266d5aaf3fc036e88b82bb12be3f88b10fd9889d2a5fd49d4b5735b9d4266df361093229d9e75fab8f4a5fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc980efed68c257b6007ba7e21f4caa4
SHA1b1139771ce36687ca750782079427256476c36b5
SHA25641d581ce6d82c1eea2d83b4698fe32750997ab27e266e19222f4847f3f8e329c
SHA51229e9ed89f6996612c1805ffc7d8577c118f6d545c87c19d5179b7af3c16e4bf9fd175c0fa1cae7a3c0c5f8e579f0fbda4dfe1c2269c34f84f5e1b2ab171e8b15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf09db6a969ce83862567b288c688793
SHA1354ca752e4df73f2d3b2e3db2590e1c70484a38c
SHA256517e21a53258e09c69f7c37bbfd6654828a4d964f5ceebfcdc1adc8c820b4272
SHA512eb7f11d917bf2517610a674aa0ceecbfc6c3a8d8dd50d9b2ae2cc36b2f09000825ef35eea68039db225cb35d5ae29c817c0176f0d2e6f2d8a2d3705f502f6fea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55538945f050003ae0e7cd09b16e26c9c
SHA1dd91b107883b26ae6134e7f68c3de39e55d0ae12
SHA25664b58f789dd0048e60a546f2aa0c47156a06f0443b92c723a2ba46a55f8e8f62
SHA512472b9fe409219ad4e6ad30cec5c460d001e9b794ba971535a8e55259134f9b4f9910554d1c8b4b1e06f74b3f5991653eb9e1147632a80e141f7c1b6e23e25735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b806e344446568ec3259c676c0a4033
SHA16ed28a9097829c1f01077cdbcd62345a3edf4fda
SHA256f30a3c82bd8feb1f7e37ca308fec8de39a30d13412955455f11319d09268113d
SHA512a69718812946a928db519626058f50c078a408cf1bbe6d3eae657a640902404f2eaf601301871b483bdd22c9f1da74d8f907005b2c52892f249c53989cd37f6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524a734a8f4028c89a7298f1b1ca6cabd
SHA1578c6a8422db4ad5a17bb69fde2fb057b8b4b0e9
SHA256277ee2c7f2924195b9297e1d15fbc8d1cbd14de56136af4beef1d0bf6a7ecae5
SHA512bde8a8687c633fcf018558a749edd0b462d27e7f0d35d231022dc21d113b4fbb853f60440023116876d1ef273847128740ce35336fb55e343cb34c4a6fc0b6e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587c6743186249a10080fa771e08039e5
SHA1172e75b1225e7157578c6d566aa016bc7b5ab7f7
SHA256a8db4359966b2930cbe1f528fff3330bdfbfc89fa388ee25159f52c25b5fff7b
SHA512ed7ad5fcbb8ae8579d11f3e6a96b0f763504bcbeda8e4fae18b33a6af170516172207c62f0f614b7393e9cab2a7827b0999e6aca02117e4698ba686661604bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb87cae55c62d56f3cab7dd997b265b9
SHA19e97a455b6c8fb4eb3f2aed991254bc0e25d83c8
SHA2569fb4aefe790a0ebe836b23a228bbe63118aafee2384eb95b0d5d4931d2d51c46
SHA5122e41336b6de3dc0fb1ec2acc7ae111af58f108b7eeec8f0c7cd3d1bf3f9001c7739bfeb2542d78f1e5cb079dc13196920c931a21d05f016fe08c25ec66a2caf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3c4a9d0d891a1bf042da58f7fd95d81
SHA1035e943c294314c64ed1b1d654dd80b72d451118
SHA256d7d7d1fa9207b2132dc292d29e0a78a7c30f8023bc8b230097ee43224349c67b
SHA512fe8d512732d61da754d4bd1cb0a8e93b8da96397b87a5aed0a60f6b8e11cf49c317e4d2b25ab17a1ba32d9eb2cecdda466f6b269b49958fb15cd5acafa3f55d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a01961dcf21b4f7f40d29d4f91ab66d
SHA182640578cd398a7d45451daaeba478b1954a2404
SHA25632f970dcdf228cf5ff18a4ceee7381a8bac0b7d72f8c10bd15dde95be114e749
SHA5121999fe7d996ef631e3679efc668e7ba0971e39f4d170fd95062c5fdac407e70bc73a4e85c2fd8a68951a3e987417eac5a3e365285ad278c4bfad9e800dc00cc6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b