Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
c9591e04e374e4564459ce400742196f_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c9591e04e374e4564459ce400742196f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c9591e04e374e4564459ce400742196f_JaffaCakes118.html
-
Size
16KB
-
MD5
c9591e04e374e4564459ce400742196f
-
SHA1
c4b8c6d8dae0ebea98a803861e6a0a9157c44e96
-
SHA256
d393e4ff787052d30e5f20cb42d4072f12073b8b86b8c2df3a7c2061cac5e9d2
-
SHA512
8ef9063f578351791bbcdd7c6f22ec1ccf6074db954594e9922125297b51355beebd427590edf5cbd6433e7b7f1fcb2427f6d661bb6c5ab6c2cc203b44306658
-
SSDEEP
192:87l7vFZ7vn6+yCYyJz/hfeZIkeZHbsrsE6mu4C+6m2+8Q4Q/AN6mArXr6mFPxa6J:8VfPMMirtP7z7jChMMU
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431116926" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000dab882ad378bb05e369c19f7193bd20993bf85538ba872f5763a89cd61e46be4000000000e800000000200002000000056736b07bd16975d5ff6b6dad1c57c3081ce0236a13fad2ed2f7247721c050d5200000000a834ccd28d347139fcb90ea71f3cc306b11a83b70f155d3c9c1f9e3873e4e3b40000000b1ae0fa8dcc0a6d3224206f27c76470d9e2ec575672a7bd3eadb95d2cb8d6364fd2ecacb329d1a53be3a4bbe1ff33a4c63d6db43842f95d89f6544b16c31a43c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7073d2063ffada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE050051-6631-11EF-88E0-C2CBA339777F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000a31cd123bff13d4b9a2b969276213c78a496497c18471e50ca0cc98e53ddf0db000000000e8000000002000020000000de0d187b580a27ae3d0bb1af60ae08fe30a7e468ac0fee45ce8ba93d3902b40890000000d63f2ad0eeedb0caf2f310afb343914f38182fc7f672c987267ede0c75f13413a1cf6a87c9a663d056c8e05bf3f6193fae41ba72071a7663f256b76c573968ad391976dba3cd960030424c508c5159b829b3e41b6ccc5807a41e6c0abf508b7fd8cc8dc9e0bc73185b0060c9e61a03e16247da09d2ff6ac4e19584326dcd3893a31b57da928029a461446a8446840bc040000000d0192f58adce0eb1d9c39e0819914166a3b2aea040baa51fce0d58833a8e5fe2f59db21f76ce8fe5e941d0b313553e9fc1dea46369e2ce59154f311b666688d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2284 iexplore.exe 2284 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 3044 2284 iexplore.exe 30 PID 2284 wrote to memory of 3044 2284 iexplore.exe 30 PID 2284 wrote to memory of 3044 2284 iexplore.exe 30 PID 2284 wrote to memory of 3044 2284 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9591e04e374e4564459ce400742196f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55aa366ead2b24ec3e3d421433050865b
SHA157b322bd1100a00f77255a661621865575e587ba
SHA256ac7cecdafe370e30cbb25c1ad8da20fba31bc5c05ae602d7fad5f514ed68afb7
SHA512fcded645cb1292e6c77407adebd41be87e8dd1818e6cd6775cbd31f25c39c3a092e1832020d5649c8e67f69c59ad876c2249186bd1be21068fede9699aeb233c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596b1340c526f26305d8045c9ee6ef1a1
SHA14db16a08ba3261ac6368ef07c6d643e8053dc57c
SHA256a5558b9ab262a3ab8a5692476cb1a48d8638135662b99a309b2d6e38faff02da
SHA512ae520d5e3cc5038779dbe0330a75b48a8b07fa548197fb8763f471e42d254fe9b2eb9d2db6c48a8a4e98710b3cdf1037c756b63192c9f48f889f35288f9a34db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521f56664e6440a5e7606ba11cbecca2b
SHA104d26f3e5aabc0fe883c7e89c2b833ef1e62e541
SHA256cc9c499feba3a782fd223bd6f4c622f6a3bacd40f70f52535c701710f121a40b
SHA512ce10ddea10a15476b27e94818754424258f380de0fd364276de286b53c34f1dc34f57ba34c6d3e16ae763df7e9faf5f743f6f2f52e99afbe121796daab17c45f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562dcd7cf2560b564d2f5012b74b23779
SHA112ed9b019b3fc040b1dc26b0102c635c1330b985
SHA2568a1083b0556cb08ea45d4e320d47f2f28eb72f663bef2c32f8979f57a81116bc
SHA512e52db2300c558c6f6a28f323b441d1b2893efeea78acaa854d3a667ad6f125ec8d6f75e7d0551fec00e4983ad28292e4001c7dfce3324f3fa98d22e33ee8aa76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af07613ab0c4304332c9fd4a8cf67d6c
SHA14ede86b1b7e9ed79a1883f985ad565ee092d36df
SHA256fe1edacb3e9ba8fba0cc4a42e7b9d344ab9ba734dfeef5eeec8d1c2965899530
SHA512808a6dce3a73d79c575e2a230f9c704177e52a82438415ca42b38fd0d190bd03c01b380f8c6c3d82d96ae6036f29c89bc85c3604af31d7a03c54f796813559f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bea4a828c2e0d379fd4224e25c0aa56e
SHA195eb467514e87c0e00e3475d25bf7bcc3c007cb3
SHA256bf823aae187601af151be73494f12b86bf7b3e3eab670f19ed4466ee834b5b7a
SHA512726cce84a73d8588dd23e0bbee7a6496157e0ddc4648cd673e6b87c12bf6aff11be66b404e569032887d50ee90732101200cfa8ae6a221a8db038aecc6deab56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570846b33caf9e21a338b5a8bf2237cd5
SHA1c639f1c6dd7c60cdccdd7be607bc525463b6b9d9
SHA256d1b447b8e20d1fde4415ab77bd7c694d7926d28dfc23c9febe7e5ce773f52790
SHA5129552c04a538b6c4f1f82df2eb0b7e06d9faaf5b26234899ab7f21b3e1bff9e86c8a694b989e1c7655661dc66ed43195ddc6a880baa28ec87bbf0ae6acf28f475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c78a23fdcd0d240bda33b1fb3b7030a
SHA140af37a1c8d8de6bc8e956580078b584fb470a32
SHA2568c5b1ed56a49b440896b41adf1f9cda1d9cce5cf11e4216fde8158bb0ed301c2
SHA5122d4b2bcf20595884514789d64cc59163158bf133b2bbccc320512da8f7f30082820087ff8f4599753eed1a8b415ece5a55f5134115db105ed1111c6d5c01b155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8f6e9c4760d420a0adfd0362efcd9b0
SHA153d9fe31e6899e6c246bac28af202a34798aa0fd
SHA256a662a7821e819405ba80077e0312423e2b4eeadde65685a7da252ba0c4f62847
SHA5129c6d7fb2d8b625dbb41acdbd99ce4b5a168208587d4d2c1456d78eea2bebeebc438ab4f3a64220ac61ff0fba759b15cd16e339dc5401e3e2cbb90e59ebc0bf19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f69743602ed04480f65dc8ac3544b76a
SHA1d29170066855c70c19fca3e3cce62813054538b2
SHA256b10aa5716913a72405cc343f2982d3f2612b524a6fdcc8cf21f89f68ea5e1679
SHA512c9b04f322d7ec41258eb2c7dc7dcc13cce14973457cf3e318d3a4826342c175373f62d2e1acadeb41fa2fbf92c7dc52c7df4d232e7f55af271f0ec616d553728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58076e0b695f5d61d4594ff55071ee687
SHA1958fd311a813c753160f373f673ece9265bcf9c3
SHA2561a947da2f4d02b133c7333930b387a9d8800326308c04fe54c85b231c682e010
SHA5121be4ddbfe7efe520dfa02e44efd5fc3d158e7ed54c8d7e69f2fcd96721b3cf9deb90f43f54f9b1912356ebf41246d93524d5fd01611ded0d2a7884a8ea86a6a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d62e73dde8513aee31d55ecbc1c42a5c
SHA12900d8580c11c4730960f50249170a7cb66a241c
SHA256b40d8885eccce13288d08d37317a98428bfc971b2533c895caa2ed6c69f2ef5f
SHA512c085f8f2046b16de1140c7a6edf8ef3e2c572e9e454730e7f446aece019581ddae5918493f61bb856bda2757f15dd57ff90592af2f70129ac74fb30cfdeed96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501d3c9e6d978b2f8b7d94c681975c747
SHA1ab03549db3c334a3e2428937b242cb199cf58d4e
SHA25606afa0efa906b77e190e8dea02062e6f604caae0e58466e4ef6f6250cc979b25
SHA512bd7e7e037be349f7bee25f485a605d962f814a81bafc5615ea80d3cc590653fcfbb8673831a9a6bde754b766b178ab6e4b5a56c42e0e7b5a8332fa9037f3faf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6a0a9cf4f1e055948eb2b3408b0be00
SHA1e48f85427f26c02daf4de15d8803ac7e2b173c2b
SHA2564a8b47e711b3230fa198f446575a937ea8eca58b6b07a59c046aeaffae80b7b9
SHA5126a5a2f7f09043aca5206a42dce3a187837fc03a7495b9640ec5b640c17f342e9fde6dde3506bfd33f0d3aceb0514cf597196ab283bdf01921839fe965e603d0f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b