Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
cecde0f1b75b0408cdfa364fad0f1f89_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cecde0f1b75b0408cdfa364fad0f1f89_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cecde0f1b75b0408cdfa364fad0f1f89_JaffaCakes118.html
-
Size
143KB
-
MD5
cecde0f1b75b0408cdfa364fad0f1f89
-
SHA1
34140f086471cc9661d0d4e9b3c555e7ff9e8fc5
-
SHA256
d60a4c67e006f00271bc3cd79f543c44b1d4faae75f06c71b4da53c6eab4be81
-
SHA512
d28f45b666cba7f162e952170a6513de64c15c2c73f1a80053df674b898a0ebc4f5cf14c4471222b585015f55f7582bacb1c21a09691e8ad80e269f49308c95a
-
SSDEEP
3072:SwEHUMx7dyfkMY+BES09JXAnyrZalI+YQ:SwE0Mx7osMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431763342" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{187DAA91-6C13-11EF-A5E9-FE7389BE724D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1092 2308 iexplore.exe 30 PID 2308 wrote to memory of 1092 2308 iexplore.exe 30 PID 2308 wrote to memory of 1092 2308 iexplore.exe 30 PID 2308 wrote to memory of 1092 2308 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cecde0f1b75b0408cdfa364fad0f1f89_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bdf84c7d2574032630e29394bb2d047
SHA1b4bdd55bcfc08f9ecec15e46d9116d6d3b55ac3f
SHA256428e82623214b6a696ec2d7072134dc2fe33919d4c0865e87c52395ea0e61b39
SHA512cd50be57c75e078cfb25752067e89ff9f19880509ea4988fdfe291af9c3a11fb21b4ee37ad93ac91fd1ad4c2be59894c522eb87d457fc27f2760bce124f5a5ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b2e4698b5f79fd486f178b9db91dcf5
SHA1269687650587f7a394ace1994223f54b84b6f73e
SHA2566eb1e51eff1b3561f93b4a573d5859acb20e2a67bfda09dc1a1c0e936719472b
SHA512c94a9f81cfb2f18edf0017c5a54110c8a0c0de9b6ae14657dbdf810c8999884f5d92b374dd4bd86f0abceb812b290d4e5be832b15e0fda1e36b6d982c0b80681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5767f91b393bdcaba01971261b108b909
SHA1709a825c6f23e44d8dc4dc630a8585b32d999415
SHA2563d5a1293c6099ff4b409da7a3c4551a29798d502baaeab9626108ffe8003a090
SHA512ebf8420e78354876a9c79cd9b95106cdd5f489f94407aafe7bc3dab0050d2bc6d44139fb130405fe940060691d9264d502b44b5c15368a2798422ca5a2f9e739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea2604da842af5154693ae9148f7a4be
SHA19db5554ee663d06a43de5ef61ccbb899cc1d84bd
SHA2563329d452807c57b702d70df9f90a61ac6ad58ad5eb647b12613131e5a55d8451
SHA512603df39dd49d28fcde0944a836b3741757c5e80428df0fad733aab95f0ad9bd9414349687c46aa077ad5d5ff73ebbf8f25f3e4cb379752fca9ebabb662ef4ad8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d93275925b7a9976f43460951216f79e
SHA195f456c4f6d5b93b9eff3776e86c537d80dbc2c1
SHA25693ead2449e9be7661740912c0c7af20dac6915288008ea2a76c5c491fc1e29bb
SHA512a2b6d23fd90c3fcfe9987f337f294102df27b8035d4405b2899d6eb694a3bcec9cc5a817c67d8cd37f030e2c37d856e9d8ebbdccdb3ef6320874da3ae7dbcead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d0ad992a5e91991b747a845828a0ed1
SHA1b0b96d2baa4058039b74eb5600b3e1bb2edc82b7
SHA256a7b1d1da57d19a73db4adfe4d598cc2b9f83b903eea87bb46820a52617d80dc6
SHA512142ab444be8b882b571bfc6474a404fbbc652a442a97286bad3bd02b64e56b26136a747796a33316a9981236106f52da2e6ee1d6efba79e7db6a563af8aa0bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522da934159dc0e38f8d8e62eabcbd9a8
SHA17f85f90e634268aecf6d6f9cb1751052d8e3804b
SHA2560c5bfdc8699ccefa37f71958e0c5ae22c457f44a4a4291595b398b87ec08c4a5
SHA51259573d790fe7d2dc0048569c431e36ac4890d10fc6ef9ca64d5e98762fe5595270edbcdcc47e73e1b9ab574fdea9fe9cb6b24f9ebda012d1d0a8ee15faab4a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592980d500e790d74abe65a19f70a9138
SHA16dbb29ec178f02c1fac6a431f7e6f28861e60595
SHA256fbf243fed1037fe6ed146351f47b23d2273ef9859b42975032caed6b94aa806d
SHA51236d96c57ae78d3c2f8fa076bcc255a03315e6f4616d0954d9ea6df90c9ddcb89d92f25431828ad5bf1cd029d999000d14f5387cac947ff3ee6c995761c05876f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5752bed9b003bd061b84c782ff3146140
SHA109fc8c376e0a4cc8b31c233659f239b4d5addcc5
SHA2564ad704b2cefac9066a99c2513b308ed9b5a3d6f4e8d9a730fb84578bbf60e514
SHA512aa495dc1dd5ba7491eb208e39ce0d5b344cc8346d500ac254d6ec32b66d7f639b748ba40ddd7fae071243ad160d76e20c7c5c98cfbfacb16fe7a0bed4fdfde27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dc7ef5a1e47b66cd94aa45bd42da7b4
SHA18b57079eccf805c9c0abb8c08e273e6fd713e06d
SHA256a5b36e6a62b4eb8d3f0faf6b34726cdbc940dd7e546ab3b26fcce29054ef3e58
SHA512fefc727b6276687de527dc8e9efa83bb78ba63e59772bea1ae8be0b6207db6afe866057a635e9cef195ed9127bcfe139d9ffdaaf57e14cfe2edd36a03b2e5b08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561c0c7e09d44e0069b1afd070ad86f5e
SHA1a7d779d78d5d440066cf552d5c0c2d71bfeb4a54
SHA2564147edb0cb4e62a07019c9a971d660515beaf575d37edf2d1b40c981d21b8ccb
SHA512d68d83a183e876da56500fd0d876bc0da16f91e7c789fda7677aca24d713a06d6d48712837b62184d95b0f7781093362e55c4bd77384c94084d0b122c96b65d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab5fbdaffebd471f8af691625c7ce939
SHA181371be612d60dbff399f04434460de781ffaf5e
SHA2565483630912739477cab70273c65a79258ce25fd648843cc63122a966e55bb534
SHA512cee4581326188d0e2969baf16e40b2ee8dd3b7f79c5f1406fb32882315aeacfd494b61273c3fc3e7d8fa63bd911d1df937df89210cb0030abbf0fa719b910c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6d93b92c034d29e6998ae8639a0fa0a
SHA1ad19df63181d8f94500eb2299fb1496e8abcc0df
SHA2566bfec1f1b155eada8a2dc73c33705b547afacb5c91bf4e7739ddd284b127cc16
SHA512bd5c07b28f5b694176505334412ec5a03dd591d57e7b33a81de02b9c90cff6b4d485d88144d797dbe1c8a99749b6f15d659d0562a7b4f6447f036ffd9443f074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf49e0b33c00813b4ae2740149611f88
SHA18bcd2fae0564b17ce786b01d1c746db0a889e88c
SHA256deeacd64df30472f746f4d556c0ecbb9a96b4d6319116d591abd755358031966
SHA5128ed397cd420d43281dab90031b449ded7ddc45d3cad2f7bca8dc3d25f712aa00c507ad28317582416ccf118d235013fc47ea9a74603aab001b2dc67b72941cc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd8768588eff949c52d353e1e11d1222
SHA14e2b56bc89b90e271a19cca71fc08aa6bdd5d640
SHA256a429891af137c6f430f52d80a2f46ba314eba4ded72cd20f285fd77497b7ceb1
SHA5121de90f8769b65e536ee3dafae442c057a2af2e7279f7353e3dc95a3ad84fcc1fd15a188965c5c56681ab5cede2bc89e4498cbb88ca4e5e99f0dd42adb58797de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c59153d37612bd81e0a43e2a994fe0e
SHA12eb6732d6654b67dcdbc0afa3aee85f64fb8b490
SHA256aeae8245d6935175e8fbdee57d08613f907b85aae5a164f89fd8e76ab7ae66d1
SHA512ff3875e96941a8ef1a4716c26e2c2a9acec40994aa236ab2d6af5d4af15571cba55a71f89926660053f3724b2985b571940a4787e11d1e78aaca1e842cbfee53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de9b985e7f4d46b98ac8063ae28ded5f
SHA15300458e3a4e529c8ef9291e8348cc03f24cf165
SHA25612221a8322c4285cef482fba98acab84c64369790dded137bba0a4290e229d70
SHA512384d39a8c6300063ca37a908656d7f6404b418e2c96ccaf3e221b4d014e2d90667419ca49deb5c987a14e36c37d36c0cf7ba353153afad22359ef4b78519687f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516ab46c09124d5b2602bf0152b342f98
SHA1b1408b332ae270dd8cf1250b4deadff5363d0816
SHA25685060f11b7457d6e57a5db9380fc7f0a18088b8d491ecad150eb71a68d2bb4af
SHA5129b575f25f17cae80d6ae48637a5e20865a6bceb8305bc199766d199adbc5f9edd04892c215e5ec7a3b20c83582e992e6cf196a5da5888f9d30c1bc7d25936a3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bd295a5526748df6eb4ba37bc915e41
SHA1cd131ae917a7c44f8aa0525058ef4d484886c35a
SHA25654ca9aef5525d5de62dc71e53a1bc1e90033214bdeecf0cbc6005fd27acf8654
SHA51284a3d16ddc24c27ca266e966c5b03a139b7bdacf58dde1c02649af6da0f83949b87741ac63f4d09bb70d9df19cf627bfc4f01dddc4df52cf62450090d80b1b5d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b