Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
c2969ae8236f6a2de602a907dfebe5a2_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c2969ae8236f6a2de602a907dfebe5a2_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c2969ae8236f6a2de602a907dfebe5a2_JaffaCakes118.html
-
Size
35KB
-
MD5
c2969ae8236f6a2de602a907dfebe5a2
-
SHA1
fa54232901be3aa5f1ed70f470d5027d05d23a19
-
SHA256
3f8a3761e3df9e9af2bc0098ad769f6f61bf2e8f92f6c575c02def72a38e83be
-
SHA512
ed0ded036ceb6ad12d557c25464f35594dcc2926caf576cd54c1c426ddafc75048c5bbbe98abb85de8107212b3ac0f0cfadc42a7f720a2afa082b6b462e4c244
-
SSDEEP
192:uWPKtAl0Gtb5nNBFCHnQjxn5Q/JnQie8NnTnQOkEntPvnQTbn5nQyMCbA3StEiyI:LBgEQ/uxPtEJi3VT6jHdz4lSed
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430821151" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62E7FB21-6381-11EF-8FC1-C2666C5B6023} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2848 iexplore.exe 2848 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2588 2848 iexplore.exe 30 PID 2848 wrote to memory of 2588 2848 iexplore.exe 30 PID 2848 wrote to memory of 2588 2848 iexplore.exe 30 PID 2848 wrote to memory of 2588 2848 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2969ae8236f6a2de602a907dfebe5a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59a995ff9452849bdc31acee4c0b523ca
SHA1b081fbecd24cad4d38dc9d3263ed51b404303da2
SHA2567340c33696bd6f1d58d8021d24b851b0110a0fce809caa7ab68ee676bf93b955
SHA512826ffff6eb1091ce3fd796ee02c3c54d036807f1cf162a63112644d7cf1c30ef20fa967b3b15402c426bb06201b840b253d33862744a69632a48c11b73898c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD587dee17495ae4a82871e5655cc53e053
SHA119eb33033a8862a44486a282fe8f538f3f20b684
SHA2560c18e75afcd3ee59eefe94f6b725fbe34dda7561b98b21167e1164eff3db5be6
SHA512f890fd20f90e4b45a19ac0055162381a03b29ca4147f2e2927809d6cf9fe95e90449ce2fb9595728fc7777b7a5bc9da04b473f98a6bd84670e061966c4fbedb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD573bb0e4c7008702cb239fc36f5cc1568
SHA1fd134b68e7670aa2aec4aaf4bca312c876703805
SHA25634d397536a3bf34dc6bfb4b31015db36ed192e5be0b39f330fce4c689417fe23
SHA512f93ffa214381b0b2a69ae7e720ce74e2b715ec75eb3628ac0cc1a854a70d9b7ab0216452cb4255aa5f6695635a6c78b18af076d8949d10aaa8157b379377743d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57b6a98849c956fa8f65ccfeaf9702a2a
SHA1cfc0d1ccae57dd3e4c1320e477a8dc3421125baf
SHA2560e21ecb613f47c983bdd925f22e8da53ebbac25f0289107b3287c7ccfc1f87af
SHA512083125de4ad8c2666b9cbe2718e946fb12fb3f17a74d1b22b37dff9b1d0a51f7137804165f5cd29763b0949be1cb7372ae208dd2b874d7772886b6f844771860
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51c106656c5a506aa2249283ab82de461
SHA14ecd8842a2b505c9a03b97f6a290919148ea5f20
SHA256c928a0c235d50b9bbae75ba0f3a834b4121911eebfff2d4ca74ca98a1f81ad0c
SHA51245d008e16c9c7a901c4c189752fb0a312913b904653e4daf20e74628c506979f833e28546bb791e9bf1451203b4dffe2020b05d5318449fd381449b2b2b20495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5637a422b9779a0b79f9e42fea33b4425
SHA1cc6bf1a48b07657582c701b1b6bbb23edee6c5da
SHA256e41f8d37147b2d6d3cf2abeef9e80be4bf6625d803ca7075ab4fd4379a91e418
SHA512eea5c89d721d44df534bc484c19b89692a5d542ae92993189bd05491bd873c538e5207a293c09b17339236f9852bdab8e8c9dd1c2fcd94e04a0fa15b8a3b7ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD508102e8fb4e531533447f39dcaa779b1
SHA1f4e9b77e0cec7f38f1ea56caf606e109d708007f
SHA256b58432f5a3c574745c879bc570f44d9d396ddbd2a8a173b92c5ecab2f17a0b2a
SHA51248ac094702fc3b35bb06c16f41fb05f316bb4890cb633e82624dc4e26ad5bf03a5bdd38fcf4dd195a51a8160385f6f5aec3e5806a74c53b75ab4e7428f29ce26
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b