Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
c82c5f2222a215e0447d5d497e95218f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c82c5f2222a215e0447d5d497e95218f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c82c5f2222a215e0447d5d497e95218f_JaffaCakes118.html
-
Size
143KB
-
MD5
c82c5f2222a215e0447d5d497e95218f
-
SHA1
9dbddfd7bf5d380e3bb53d11a9dd03cc6f8a940b
-
SHA256
78808e7f8d41c9d44aa7d69669fef69677634939edb9e2a34e69c23b44db6eae
-
SHA512
646956e084de6b2d3f3abb295237c66ecfa45ccc271c2b37bf84b9f04c60df0949017cb755d5bbeb966bb906ca695927c416d6fc5842b6189cf6acd01d29ede2
-
SSDEEP
1536:SfsdcrUHHBxfmx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SWHBAx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1F4D4F1-65B8-11EF-83D9-4E15D54E5731} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431064861" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2748 iexplore.exe 2748 iexplore.exe 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2768 2748 iexplore.exe 30 PID 2748 wrote to memory of 2768 2748 iexplore.exe 30 PID 2748 wrote to memory of 2768 2748 iexplore.exe 30 PID 2748 wrote to memory of 2768 2748 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c82c5f2222a215e0447d5d497e95218f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2130f10dfcfb3399ce75f3370f98050
SHA1812dd6a7492e1421f7299d14b9cc4b27bd87c793
SHA256e203467960135a35a08c595b2105db414bde4be58b2e04724a03472177d816f3
SHA5120f8a42a83d18b63d2a6b187d7799be6f4b93e203a40ca84acdf1c987b516e7d15a290209af09111287f01d315b6806adb9461fd2e94c5413315128c2addecade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d094842e0cd3e488b14afd72585a051b
SHA142e456ed3d679cd83360a88879d492dd8b5ac42e
SHA256fbbcc58a510328979b348842315eb66f0af6f940a2b3ef97fb7dfcb71256af94
SHA5129bd500401c2c99905f9c239be6e445964e5c53332492ae4491744ebce72afa33e38dc8e24e91189457becd25ddffa7cb7c6809361bb220c44c56487656081626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ce0ed5f9eec0ad1e3d6008d9792010b
SHA1284d533839d4ae8a2e60d9cdbb1d5bd9d4ca14c8
SHA25649ca91e2f32e66205e933c655243c4b57a19ca972ca8eef3bfae3bd541bb310a
SHA512ba6c16bd59c150651e735c92480a3cc06f1d9215f1c8e0074be77babcee53cca9f31103934dc49bd2daea48a0103fe174d5b9f0e4234c4d54e44414b6038f616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504274d5821f27bfca18a7121528b0821
SHA131973b43d8893eedc1e6ccd003dad4533b4f02a1
SHA256f1c54e7d9fc29d9cd19cdeddac9ae5ce543747c28c2ddc2e5e8b79592424c002
SHA5125edb85e0732e233f99e21735b9487f612720ae587f61dc8e1d90add7efa70c24373b9c578eee5cc73c1d0d2591bd8cfa16d11fc11a91b5776bbf71f6b440874f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521bae20d36ecbe2a7a1b3e29ad36e790
SHA163f9090f49931e1b989312a75c766e7ebec98bb8
SHA256f2f88a565055dc0ee49da92ae176c8850a14b7ecbcd3b14132d32a81254425ee
SHA512c0a45e42c901c7b18586ca0d136a4dd0a465ca00146ffbfa7887392777f9d72a751ad86bc34a09fc0040e7fba64ca960b75e3d7293ea51705c7dd47e624b902d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505e35cfdd828b6d3514bd7d31131b8ef
SHA163a85b9418decc26ab24c8a80315cb4fddf9278c
SHA2568eefb501250a68d0ee98bda624480e8ebdcc2c7f0af3144ec0559843e44adeda
SHA5120529a477ad7a156abca1875084177fb94c1a4adac1bb3b03751f3366c180699f954df92cc69cbe2ccc42fdf2542dd947cc2448384daf97ae8de32057977eca21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ce0f46f5dfccecb9b4f55172da0ff61
SHA14743ba7c1cd59009af3ab3a5ceef8d66c34c1faf
SHA256b8176fdce69bc580ce06bfd2cb1a48ea1597e7d1495b811f25ffa580a75f534f
SHA5121578228420e1062aed555b1229863201c1e251fb327bc5ed4112d86e980e5fb3934e65d04af6a99dbf7cf6b0847ea04b46c1a2ad8a660002bc072e8edb355157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b4caff152c082d8563e5f2595922a55
SHA12d32d4c67db81814619381a0849adc642625a3d1
SHA2564c01392606da19e912f49110b9a1380eb18b181fcc40aab67175fd9dfe076114
SHA512bdf460ad579e35a2575bc60bbf4410ca497da707cf7fe5f4762bb90b4f99757c4a0f716b2981bb7703dbfe421b75741d07bfc91ab639add422ab3a1d20252eea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c7b0d00f3e8237efa4e60f31e9f321b
SHA1e9cf77f76aa17e7f23c963bf556869d1ad7fb0fe
SHA2563745b98053906bd1242860af9cd6b2380f550a7777093618aa92332b9e9a7c59
SHA512260226a7caddd23d6b71df729dbea76e4dc5e85a1221d39cb0aedee3bc47e95e6d2504bf67fa6749ea915c0bc952fe913b9549e405958a9f6a25b87bc4e171e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c88fd17239dd5dfa9c68dbd1e25493e0
SHA1a9913a8fb0fc189355cfcf19ddd16ed490607659
SHA256f5a481718ee05520dd0e0155e59194f2cf64a5c92afc17730f16ba6a1b62559c
SHA512ae9877cb95def42e341f49df3116527b1b42dac0eb7317f3b29908b32683e9d8fa142cd191ddf21142c8b88fdf507ee657e32b4c0b6d9325b237e1ac78c7049f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57344e8626633e9b0c1556d205208a6a7
SHA134f37e3765cdf89c1a7a582d5db7f743d0180d37
SHA256ba99ae92bcc66eee530a1031a8dd9caf11ef41dd7d354d2f0e32738f7e55bf78
SHA5129ebeb66326a11404fdea0b4d47340bbed5d47cdd2702c02771c71140aae94c2559861ea840cd633374d8072d8b82ad78e338ef09919c84626d6f1ad7d2ede9f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547d45d0f8bab6811f25d35d94e9d774f
SHA1c4855ab9e42c5ab5ef19cbcd923c53630984f1f4
SHA256e4d5cc48376a8048bc4947ed9eba6714b3764896768da6383603483b002d1aec
SHA512d295ffbe67fe705430c6d28503f52e438eb5edc2786819d1446a9f56b432f91812a380e48d0213269f3e2f6291a0912f93c583c2403df3482bf3e9a8b107176a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a445e807fe5eabc29d84889c692e21fa
SHA1e77f894c37bba3f0b1a24227173c851b740abafa
SHA2564b5b0c10a80690f446f29cfeda9eacb3c37210a43a8e663a8ad1d81b13526c24
SHA51293126cca61c51c8743ef65f905fa7fb247eda59054db8595887974a44b7f1e1e453ac53edbf2822507cc196e703325c8378d6a6ab33df440e6ae497751374a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591c760712176e4fd1abf32ef440f2489
SHA127dfb7bb80dbdac2da5c80da7e73cf518b9b7da3
SHA2569dcdfc476f2a497e7ea1aa4a3ec315afdfaeae89b94d67f70da09ee43cb3e02e
SHA51216f0d956e06ebf1b4585985a867ec4d881ab7532ee7355ebcdd0b9dcf3a1adb37e69cee4c0900f8c19973697d365a7e490aa35634714108cfa6064165c579714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503812bca2e7c44303f47f24f408cdb37
SHA16e0f892f1ec49cf3ea4b4c43ddacb39e8b9e9b5a
SHA256fbb2b23ca35fec048b0acd52983cc96bf2d8eb77e401f4fdb9fefb936d509ed6
SHA512a2f6e4c1d3093158759c144b3ab17df0083fc875593b6364c168f9e9aa52d295d3d43a3b6579e0b5c8334ee8565835cd7de0c8ca82288742f457b768f93b7bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0267f062439d627df4e8dd3779e01d4
SHA1c50b0ad8ea0972413fec654e057a4b172f06c544
SHA25673c23c1a7d3754228a39a1b8586ff7938b5480394f777f84a30d4fed7ad84f18
SHA512e181617a24c3c2856e923342d7c9f7952f0322720919a2610464f487a4e3e96a80e0d097409fc701fd94792d580453483d5e615f5c06166494b1f5e5a93a76f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fcd55c6c80cf26e135495f0d18a18dd
SHA19cbc2babcde04d364e4c22df47dc4966cf7f37cb
SHA25691408fe948703296964b320bac38a95be948c045f99d0c99591c9804f3898835
SHA5123737e2f17b3b672eb1ed1fc52c2a1e34d032957e6e47b50c051a4822edb2f6220945610e1bfd6fbed8104609179f70800c9d6074b825e321568629927d364c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d3b13481bf897a2bd295d2a16e0355b
SHA1b42453cac20b3555670f18ca5aa84586cc7d09ac
SHA256ed43700ae0083709fb84760cee7d7499df9f31f86ffaab2143a8fffbc574a53e
SHA512b7e79299104a64b01c93d959e4a310f97b047a52abcfe181a87911c5142f43cc0a15e6db51d1c004f48bca020adbd468a654df4282f9e71803641c97527ff773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b2dfa8430a1e72019a093dc443c0f91
SHA1d57bb3decd72615a3b03fa99cf1357464cc58c51
SHA2567ad1edfdbfe283ecfd7781dc29ab30100af5d88793817306e13909623c656739
SHA512f913eaa21db5259a548b33ce127fde534f8da2451c51b34e1d45a03390142a6a9f0fd14f2040155f2007a6064153884e6f0c62ab5587f4c7349cce08314684ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54454d524fcfec20e54d059f43574bf27
SHA159b20bfc32e962af8db4667e4013ae53f3303b20
SHA25671e4fe72f50c72a27b03624e001dee1d1a2c52470786e168a0030dc5d85795fe
SHA5129b84ab93e0c4961e68eafb3d8fc98a24d1eeef36691692ad1621e8487ce53e9e07ce282a91eb55275c51090094641b3ff8e20d9d73d13b763fa7a80a1b66aa68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9f28c4bf45b26b7425df747fe9162a6
SHA177e5a756387032ea01c6cb08679b9d09218ed61f
SHA256ea54f7a6d55e9f824e60b7f15390fd1de094f581edf508914f32844a61a39af1
SHA512b7b5e85eb3dae4123d0cf8d93bc8bf463840472069bd163f87b74abbd3c2802b6eed62174ab41d6bc45c6cc77aae6d89ee3d3c53606c124b1e03a7d1f0befec7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b