Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
c23a0879cab47f8b16b1bd245aa33534_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c23a0879cab47f8b16b1bd245aa33534_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c23a0879cab47f8b16b1bd245aa33534_JaffaCakes118.html
-
Size
23KB
-
MD5
c23a0879cab47f8b16b1bd245aa33534
-
SHA1
73a209ddcb4a394c00bf44ea6d34f32e2227f4c4
-
SHA256
7ebd23b1405e9ce3c61698a509f90a72d801ca7a903d5318261a2631878a6987
-
SHA512
3b258c37cfe962dc2652bd7c476e7f058fe536324a1e12c3d4a82acc103e764490e3259df44a9f2f191bd6e145cd542cbd52fb73b7eede880c722dd954417e5c
-
SSDEEP
192:uWvAb5nOH3LIDh0nQjxn5Q/2nQie9NnTnQOkEntGMnQTbnZnQ1CnQtxwMBdqnYnn:qQ/LvGC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430806146" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73490E51-635E-11EF-9403-6ED7993C8D5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2280 1460 iexplore.exe 30 PID 1460 wrote to memory of 2280 1460 iexplore.exe 30 PID 1460 wrote to memory of 2280 1460 iexplore.exe 30 PID 1460 wrote to memory of 2280 1460 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c23a0879cab47f8b16b1bd245aa33534_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5037026edcdd70c89a0e1565cc8b6e147
SHA195f0e25fb888ae1bca8f073d30951492e1a9f3e4
SHA25668d594454b4e47e8a556ec820a8cab235baa8be85b45b6e6064c27b11302cc18
SHA512969494c4a3628d558beca0937d9de926b5ad85899fe6a1b38aecd02eb2831d85ea933df3b8d913e0f086fd10066cdd0e5f4528cb344ca553c89668f39de3fb3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1a7b3393c313c3bdb88940d7c9592e2
SHA1409c9c2ee4c92355517630a8a92b0d5f744d8182
SHA256c305f719bf77242a048e06425adcc5fa615768c36ebe01d14be7ea5ab2dad7e6
SHA51291cb9c1151c74ebab80ce5c6cb875f39af584abb628d9a1f48f3581ec26704bdcbdd1bb48c422142e9c1c8617bc1c8140e28d519bce632d94ec2c60c650ce7d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df9f1cd63de58f065563b070994d8e08
SHA19b98061aa681c6f31cc9b979feba7d798bb8e2b6
SHA2561f3f65021d0c375d4b51fffc640ac2d7655d3b68f236ade93c6820a5e54d788c
SHA5126554335aa6a74141f99b7b0823d2289261412efa067b98afcebdcb2688b1eba27c9a32fdf5637cba5d77f9dfa49d1031bee1706dd4fc0bb12e9a218da779bd04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd1480536fb078f1a6b8bfa2084acf1b
SHA1052305c48d815a6306c4d4995d907e8ced9a943c
SHA256d0d35242a2c372678094d1a09e445a3199a61be6472a087599fecd6c81fb0742
SHA51288380209affda45490a318242a6f057f7852dcfa0f3101e1109e145423c24a6100013fc4514019422c0318853877d8f8a4c970c6f223d37f9da27a52e66b818c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a3378d90773667a4e240e9078abc180
SHA1fe13b2d9157bcf2b71aa33bc38654fc74cb0f51f
SHA256b30cd2084e16a5e2ac9137a1cf5863669c6b6d788c99b76231a33da2dfc6d89b
SHA512c26ae93b33caa4547f734aa9148b8faf4f4b4aa5186c97ed2c8728acedb4366f9cd84b684f6090455bff4def86308647f107127fae72881e8dfa4ee5430dba01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffe3db77cd03aa38555fe23c602926ea
SHA12fe4025b3a644d109d627e9b86cd77d374e7a86a
SHA256a16763d8c5a5745f51b2e29e2fdfdfd2beec9e1c3d5d26cee3a4684cd116d821
SHA512656871355a93ff3c39f1e8ec5e980e32b483d1ec38c89b7ae932dcfe806fe060ad8f3b800a3ed8162f8f97cf4e8a555284c2234287f09553a190989241194ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb4711edb1725cbad9400212f10b91cc
SHA177939c950f26ed62af55331ec4841907d51517fa
SHA2562f81b19cd7146465585d732b899764ae0898b7a66ebaab59188b716291ea7ac8
SHA5124e93e3fa187a5a55fa844205869d33994f72b81c293bd8e649425dbe698172a2b7461b6297cfdbc2b818420e3bdd9143a851412d6063368329314a4d5bd3d9d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f2e76714bb993d86be0596c9ed5b533
SHA12f3ca3d6e4f85d58251297cb15614177b8deb0a8
SHA256d8df50090d9796c51267421ab0371d29d70da0a605553ff19992ac5ead42986b
SHA5127f570215df9d35bf6e1325f19767390dba974516296c03ff3bef4d79eb2942c9cf37b946306553694a270912065cafc0f404684762c634006fdf2349c1cf2f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6df2817d77d2255772304f88d0aa897
SHA19737a9c246c911a3f60bfad6810ea83cde2e1272
SHA256ed3009a11a07977cecf0fc8f0103d534b0aec7990b65648423b85ff90536622f
SHA512777990445d2f0e025f426d2ff64c91f29c3b351c755f6ac4ac3b92f9601d24a6606b202ae44bdfe6123ba74d9312bf193b6cac86468e30f61a656c695e7d3b0a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b