Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
c7d928866a66a62c193d7e1a0465bb72_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c7d928866a66a62c193d7e1a0465bb72_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c7d928866a66a62c193d7e1a0465bb72_JaffaCakes118.html
-
Size
5KB
-
MD5
c7d928866a66a62c193d7e1a0465bb72
-
SHA1
c76fd447fe7957321f9736fb853ad6c4845db275
-
SHA256
b7e23c9f89a3118bd390caee3f6486ec38f2ae5205430cd60fe1ed840b3a2ec1
-
SHA512
ee988cc6ba43c435a2c19d16178d76249d0bdc718c2fea0645267d56ce40c9a306256b275bce80d3e3802308e30c025e4ae8254700d9d43fb658202484da5130
-
SSDEEP
96:nWTD9sshmhRWzlnaeDztbAroNiFc+Qdm3j0VExvBADjnecRrvBmRguoVo5gQ:W9sXhZeDRbAM8em3YExv+DScRrvBmR1t
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431049899" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBEEB3C1-6595-11EF-90E4-FA57F1690589} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000003592f58b007117aacfa075a5358db62167f92bcbf643ddc013c6562ab4d7956c000000000e80000000020000200000002c9e53276e9cbab941b9e45fa1f76ca19ad83e8e5daa74bfbbdc5ba2ad45ce1b200000001c5af8a6bf3bf8d96cb1554dddc4a2ac0e923fbf0623d6e331340408ee643ef140000000a5e53bd016b40293d39cd97f89696f347c2c7670caf80946f66da766c763c28b50f8f77a5188b4a17dce9b03379d8e043b92715c30e6a723d913eee3573ca22d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506f60d0a2f9da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000020f052905964adb1e85ced2a15391b2d8c9d2b8d24088fde50072ae12b1b20c9000000000e8000000002000020000000f16186a40fbcca7821531a7371a52dacd93e0f33bf8ef7a4152484e69e072b3290000000cf4e0f2837df9f7ac39269e1260fe71ab1ee9f86788748bf51062ee08eda416f15967f8c536135a6d01bf9ed70eb5f165c1390d01a4b600eb17897a93c110c99afa6b432c51b750f31d900d802140df623dced101b7d05ea0d4a614680ec6956fd274d864d7eb989de6ad96c9f8f2c59b115e18818af1d9758c68c0692379c4062ec53861152ee7a06908b1c99fdf061400000007f39cf3311cbbf36773800c6bfd264952d04c1aa95b5e05dc6d95accd20099e2a3239024a113d9ba07bbc21c6548344a8c50ebb1255c0e8dfde392e3176740a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2788 2400 iexplore.exe 31 PID 2400 wrote to memory of 2788 2400 iexplore.exe 31 PID 2400 wrote to memory of 2788 2400 iexplore.exe 31 PID 2400 wrote to memory of 2788 2400 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7d928866a66a62c193d7e1a0465bb72_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aba692583a3f97ea7f7fd713e847dd97
SHA13edc8754c4ac9ca65f3f0fcaa702df8796660a09
SHA2564a55d84c33a3a84a4b6c6ef2078772b86a964045bac210c49dc32706c3702dd6
SHA512bedf7b6859a044804849aa081ec64141a53f551aab62cbdba46b722f73182e98491598354d7f4a98f7ef509a3df3a81dc657929e710edff7ab3c664ae990605d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eafa4b275e0f057c6d9cabb83e936a0f
SHA1669d01ec213d9bcb92f6737f3e65e887ce84a702
SHA2567d2ab2056af2f1482f34fff4bf035e939c20f2b9434ce80ca6bca27ef40c3d37
SHA5123ce2e8f0cc322775ad609f39232d542192d64f597a98c70d5840be72588c0a0a5b3aadb3f7d055d7b069720b6625298f55728ad978ef4bfcaf1ba9d438afa806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5b0187336852b668fdcf80725f38e70
SHA121824f1d5b94168f3610f97a9401135715756f6d
SHA2562e2c49cf862402e4fcae63dd8a22de753d12d275ae9edec7453ba7603fb4c743
SHA512bf6b0caa54cbba6f736c60bd61bcf3fd58be3658a63b72feb2d72af6757322c0f83e1662315c11b9e07879f2ee269d5a213b693984e295fe0991156d1f6527c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593a527a2d83941ad7bcaa7f8263c746a
SHA123fdc2e18bb9d1e2dd0fc0ff3e06f4b2424fc543
SHA256fca31c5b56e5904a9cc1389b6ffb92dc30312a01c72844d80aa84fa9bada05a3
SHA5124707b34fc19ade35bce69dd4cc9f7a0c1a6c7da0dfa0c70a9e20d77813552bd9c01334e03c6f0dac7b187537972da6f67d3c752f16c37ea7547743569320c67b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5666b67823f2527f0dd5cd64511795045
SHA15e27353211a0dc9f9aa280eecff914ff0741bdf1
SHA256a61972862515bba43052aa9b8806e15cc6af71c07c336dedc4275a9f805b9fb6
SHA51209978cb771966ae81aad2efac22e38cd2c4f3ba7ec8b641d95a35f16cf2b2b99ae5f9a8e4905140926f81e299fb1842703a04928558e3616c3eb26ec916c2a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51be66c9c0e39662035f6a8fda1b6983d
SHA117cf4f4cf5580221f5cd8f833543c5f0ef428ade
SHA2568a4c3afefa127c82bc55e900ad48c10fed0d3eccbd03fa141c73ce9beec2b362
SHA51259555088663829651f88d521a0e5455d82a7f7afb46d7a3a7286449c05354c0a2a9a991de14bc0c6dd85af940750f384455ba9c71c05b8c643911e551e895d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58861917753d313dce44851c6b4a0408d
SHA1abce99c3ecbdf2d5113a1c0d7488de17f55b14e5
SHA25617a287621bce8b5e8a5e008ca8d66ae6b24bb47243547d9f397f358b2ae22324
SHA512ba0b05c198a38a0f1d5363d2e2b0fbc2a88ec824aa4b011e81e81adcf2aee1f54f08a4b99aaafc812722ba8cccf6afe3b937f38b929ed1090d6cb483c8fe5f6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f946e6635efc66af1eaa94313de7109
SHA144c8fe956944c056f5b5bf5688d66368d56ad3fa
SHA256e616912a80712154351983d233382c496a729110dd0498ba5617ad926a42b093
SHA5123ee519a8fcc33ee34443923ec2ec4cd4c98729f587be0020bb27476255673989e337581f1b0368774c2180b2a01a04fdda5fefff1fd9840dd6dcc23c57996ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f893df2083dfaaee90a37d6c36288323
SHA1483b0e86654abd7c411aecfa90629ed90d67fc5b
SHA2564ab078c7dbb509fd0340464c118f4bd321cfb6641ad70ce4f35150939e4424bd
SHA5125394af1159856dcb08edeffc223e3e25386782c8dd10d778fd4c411a329dd3f4bc055bd6a1bad675454431c8a8f3d25a1f8a4c3e77ad92d9d3816535996c3790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d681ddf21a353f34021fa1bede199bf4
SHA11e12fd998469b4d7b78b67b0a63b4e5d9712bae7
SHA256a2e888994e1b25a9b41b3af827616fb518b738d0b73123661b5197f404a7ff9c
SHA512c2c3e1b8f964601fc408a79f321d7ceb9838131d150a71ea062eae290c7816ca7cddc9f8c82596415911241d154bb5d0a87fa8ce9c08a063f66d8db80adcbb1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcb680b798447c1f23391eb99a34353b
SHA1c66f86fc0dab6a9b6051b23b7d1514a984cc8ee5
SHA256d6f44f55ea3a164d77ebfaec8ae8c3fd04fb47540d7fb7cde33f55aa723ef4e5
SHA51223437249d56d64b906273da6b48137279d9e6bf43a6bbbe7b0f7d633040d5ca1bbb501c68830dd4053a1e4bce19b52cd68c7bf1256536d2d3471ba03c7d5b05e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a8b5eea950c53070fbaa4b81d289ae4
SHA1d57f1e261a90afded0e5d33fafcc5f35e1424429
SHA2560213ad7fca229861f6bd973407cacd933019eac324cdcd8c0b51e810898a10ba
SHA512cb99573a2e338e56a59d68c3eb1bc9cba4badf46d34540e3e708bf67ecef08256fe8922122c410007c9965c0f940df2582ab033063bc302d5696e3350328108d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f04984a34c4a63223f2078b0ccf0deed
SHA115d69e768f59362a17c4eeb0b7f684bace755f61
SHA256f6be21e700f2e9d0e1ff731caa0d464c16750727a1d9107a8eeeb79aa338516e
SHA5128f6f0944f5a55065505e747992ad555a2acb7dd4f3f014cb921f598a5b30d610e611b74ccde69e0f8919500fa34be5cdc8f3c240a10d1481a2d616decbb7095d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504934b34645d0267347df06755d62cbc
SHA1658ebdca62d4d51dd8cc2dd75dd47832a1f5188e
SHA25672f3a18653f3a539dfdffcb35b0e3cc4e154fbe11368d7a41546b3d25f5ed7b1
SHA512c39ceb75f80cd09775e2a8922b50d3b3b3a73cbe715da4c7cc4fed5d7dda6ef3b17207cec933225e20434a6bf154cab277e3b8acafa91ce37d0b3e6ea5114004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563c803e2d822f195efbdc00e07ae8184
SHA15adabb3fbe3601bf8e89885597d5a5c497f1932d
SHA256e937191872a7aa2cd016fee44be36c46e72fd01b6c3823fc7929f3b34823aa70
SHA512967c5efdfb3eb6bdc1ae0994f558375acb19e87842954f7ffeb52c1a4737164e922bb02a4d5d62434455f567c4dde10abd238756c569e1a5306ca0e83c07253c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a0ef6d89146c55a0f54007eef44c0c2
SHA1c96bd46fdd9a18b7769945ec8c500281fc97db59
SHA25659fda96aa79b821fe1bb3987c9947e26bc8cf0257bde9ab517efd985d4661db0
SHA512bf7d1725d59073a3c402208767441227fdbaac732318d990f2b31f19859755405879cd87b74fedfc42848152beed5ecb8dca21c87d183eccfe40fae94346ee31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5190fdf3738db17999252c6136fb38a3a
SHA13cbc3a599b3c1005cb4e973fee7857e81196f9f2
SHA2563cb072f0ffe98710aceeee13668dd972cd4052acdd79819ade6e5b8cf2863e24
SHA5126a7a8dfd1085d77d6fb562c2121657df6fd37d764def739fd5b88a69908320d367d1fd49f921962e777194609d5e3df116f8ff0199b13c5d23df2f2051fbe252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ffd6b1ea463eb6818333368f090ae22
SHA1e49e84790dd38c6fede8598e8e0ceecd54b28d58
SHA25647f594e6768db036d167286e0f82a81a35c359bb07372337c494f83585dc5c7d
SHA512c1d8a36b74055f5749874365c9be9c3eea6e7cffd4e4a8526c78ea8fdca2d0a48caa4ed512e2caa7a3b05e9c6f247d4ccb73c06d55c32b78114dd7f5aafb3b01
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b