Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
c285be622d96ed0b1f9c28da79f67e68_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c285be622d96ed0b1f9c28da79f67e68_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c285be622d96ed0b1f9c28da79f67e68_JaffaCakes118.html
-
Size
5KB
-
MD5
c285be622d96ed0b1f9c28da79f67e68
-
SHA1
1808054e0fe837ae8285440ee0b35fa7988e4159
-
SHA256
56494cf48dcf84cb1086ceeaa0c353bce78277c98de9bf13b0a162095065166d
-
SHA512
3e18af36ad051f7c60936f49b0c64f2f2d47e4ed0c53a3814f59b30b85a83628a6168201a8bf4f8a0b25eaf764651745ba0302aad7749f80a4e46bc3036f635b
-
SSDEEP
96:vJ96XMIZ0xjNwL4uJSjFTpCguJFgi8Ad5+BjcVer5okLN1BaOltmSn17srlW+Kgx:v36XMW0xw4YaTpClgiuBfdfgOl1OHsDw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430818597" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f06d4038200a8e7a858edcaeac70379ac62a8728eeba2de57e3120006ed3fb9b000000000e80000000020000200000001e028b066a7e974f1e7f56f742d92310954b135032dafc9cc81b2cb20fec5e0190000000793cc40660c58f3fbde23d37a04de8e5b1256c2bc74982949a6b8b8a9fecb87b4b52b2dfab67a3df83c1410e22a89d85884d53065479bc8b976b35fa1045c233ee0f5fb73cd20f3e3314ac0dd83df758592e8665b9f6f45ee9b00d2d6d26123479b46520b0b89b9d1f85260be56129573e65da1b4d2ae3e28ec87fc3aa457bbc218b3d32909ed40265c0780ea1317b6d4000000016968fc8dd98a6ac13e28e18b6c3faf99194a3a13b010154cbd8b32a427fdd868a17adbe1ad7a17dac6a254bdcbb6778d110e7e108128dee3c39e108cb4ea018 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70A0C3B1-637B-11EF-988C-4E66A3E0FBF8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ba6e4888f7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003e9af9ae79b02e7a0c06eb1281f1b312a3b259cd4857aa5303c9fe09c1b5d629000000000e8000000002000020000000c6389d1bd7e8b36f545cd51761b86830e629d8d38a2c74bab41a8d876669569520000000b1ea181055cbd87fb7c5dd9b2ee3fabd8936dac05e94c0378181f967f2d9f852400000003f12f80d6056b9782343ae1f9e6a79280d25079ac5fded5ec88970054b6b476e200fce6c5c668f12a79a8ff8e2c3f55ce4add34973f88fb705bd0a18c486a62e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2688 1908 iexplore.exe 30 PID 1908 wrote to memory of 2688 1908 iexplore.exe 30 PID 1908 wrote to memory of 2688 1908 iexplore.exe 30 PID 1908 wrote to memory of 2688 1908 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c285be622d96ed0b1f9c28da79f67e68_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d0320168991520e811fcddbb771c64f
SHA1256152328042efcfb190f6dd16ee00b75f09f3a1
SHA25675f1c1847ac4d6f53cfc318e24111215e35cf32de2fa9485b7ca770fd427e461
SHA51202b8422ba14a00beacb9b7c76d636cbb5524d319faeac41992731a689c6e38efb7132d62bfdcc79b7d53907a1b8087da0106d4515f6139ec26e231ef1fa646ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eae94430524add432db9b82f6956096e
SHA1236d224f12f56d3a77551539cf413edc3dbed534
SHA2560a3fbde4e61e3323a90c1a2ba0b488836e6618bcb6b84da4f3ca15ee60c7bfba
SHA5124e04c84d1bc0657d12f72d6c98388b224694220b5effb258431bd5a441dc88ace60c49e2ce2f8468097fdc6ebc6c26c827209597afc65399634c27434715728a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccb4536287b3cb182786f387236bb4da
SHA1c07a7af1400c52c81018870eb11bca1fa108a23a
SHA2560b810f2f0c42f75093865328b916b27dff590f34a54c6a794b493b192809d724
SHA51293111e0d24463f5cb6908bebf4ddd79fd7e1ddf06e48147e27bcaaf0fe52e142cd4e9dabd926e940f6ed59342d55504992951a186a5e2f72e9f069aaed19eeb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baad9890845991a3e159d1088cb84875
SHA1663ac071c7a86f05f0e1256c611d5f02f3732573
SHA256767de5622f9f55dcb61b128981884470373f9f9008ce85fc67ff3abdbc979e25
SHA5124cd9d4db78ad0ede57e6b493c32d989ce35f36f1404d448b80bfd55c0cd0ad35efb77b6d7670ef27fc33af326d63a7cc3627a5e243c07eb3a933037993a214b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53addd08ee9bba71a2aa84ba4e5ff4c9f
SHA17cc39aaa1f4f5577012926c262bc0b8419619226
SHA256a23a41fd0589c370e75358e4dc28ea376fc09fb6e26b3c1f7b93d2705a3c303c
SHA512fb4452be79ed90b05b4c26f06eb60f955f3ae8e5c736f96b4b46cae7acbd19e6fbc7df3c75edf8a4360da2c8cea5df1ed66d853b351eb89deb41a1ba9a4e2c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f20ba93f1cef8e08ca1d68cc70159f70
SHA116085d7f4f963ddebf72a85ee58563a0fa7c1bae
SHA2567a23d900d3d1edbc881f1d4d328f99ecadf9d8baaf1a3dafd11be4c2be146225
SHA5127ee94310d56f69a4f66c2201feb78118566df39f5f38cda1b0b2a8a718364c8e9f1b3a98e077c80fb0bc7d7df71b71f67323c36191f76005dc5240ac22fd542a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520b2f46db825c2a6eaecb101348d1b5c
SHA13705492396082526fcdfe15cd2d32f9626385fa6
SHA256bf79b88edb7c8970d32581396cd933ae2dd02122c14e34fc7e22a05b6f5f1fb7
SHA512953b8a1b99dbb7ad8f95c5e666a70315058be605fa4f9692f426aa5a0efa3b3444c0424751304c846f3b6439e2e962f6c89c04823124c3ce2dc0acc1dd54562b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536256c6528190d47d71592699e0ba893
SHA1d1530d1e65cde021d369870842ae1bef050c3e96
SHA256853cf9b5cb696845e8ff47c7090c74fbf045f2fca32ae465eb71016ed4649d87
SHA512626e67ccc546f86d713f1e2903d368e80e8b84b892a729aaf1f7e38d1ab90c287dee8e5796b7c37261e5e8891f800928bef68cf23b1c3aee9c4294095c274926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588f3a39d472a0053ade6f5adad2df809
SHA1294a761b11392211e02d6b41a66690b1bd218451
SHA25682bab3461d89e07513a314d1f52191b8ffde7a98470103d6c0901e4ee03ec79c
SHA512ac5e0b65ee9505bc738c37301965894bb54bf78a20aee24e8087a1a7acd0f3e3e0e3761d76aa241329c2cc88aeaf87f8f1a3d8cafb166bba189d6882ca6d419d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d325b17f0153399c603629e957d9519
SHA1719ea4aea886b147e389b477ac03d062ae16aba0
SHA256f055dfdb777233097f08e6f16df9d5e55902bec2c7a81e4f80a4c6652d4b795e
SHA5129adaa099da8cdfaf1e586fbdd496e4331342ac42eea297849456de20b51b3eeb7b1ebf0c82b83d81db233078822312057750d0f737a56035da2440e565a044ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f04a4322279c162548f741f79973865
SHA1192aa16cc1b4fd8c9d7427ed8f748904b997275d
SHA256ec9b6dca9653e51ee96a47de5a2eee68644204793f7018d87819cb0981796e04
SHA5129239c1cf70693db1846782b1c1d68f61ab00cbcc03a0aba87eecfefead76661fbd19959a34d0593b69dd4bd6905ae21512dc330cc5769f09c335ab282e8727cb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b