Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html
-
Size
120KB
-
MD5
cecfb98bea011d58bf20290c8dbe95d8
-
SHA1
f53fe4e79baa79f83ff2eccbe340085f104c8e5b
-
SHA256
b4176a10db59aeb709b92dae63a193598d968c17291297854aae44895a73f9a3
-
SHA512
e2fc5c64d98ed4da5533cb296d41cf294008d8e8ce08363ec6c83093e21f499495b42fb7f0d798de9f0d807cb25c3a30b9a25721f08311e9a83d52372d84d056
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcnjqHAIsfLAcaVnzcZf2SEip:sLpiLgzK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000a72698d4a1f9fc8c37c06c4d46ce8d747392c49a9d1a35c1642ce49886609b81000000000e8000000002000020000000c986c08f4be3f163ac93ebb550f98538915ae4137f7be3ec93eebfba4726abd290000000014d0ee42d5478b255ee832573f49ce47179971a967188d9f30c5fa5cd25e69896172da16cdecd2aeef7e14b57caa64573391f142fe8851a43ab267d634c1ae033b95f74fada6cbda2a1cf851df48b40d30fba9201c902fa59a865c2acf8ccc61b6ceddec33d18e01720aabdf4482b7192a86237efa6c1848ba6b28331028389c51185325fda64a0be9c798459b139704000000067939e906cab77a7e294f58424f99f0d0d81c760102baa37c912a51d9abb3c8319f406dd37a06827a718bc61a801285fa563b58187716c233df0acb026e6aefa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431763572" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000002373cce46931af66c1690d49fcdd3fd2ad189a9bbe3951aae4ac0125a95c9e35000000000e800000000200002000000037812d6adfa43133d92427f7039a3ac19fa26352c0aefa0a2870116451b83f01200000000d053e6ff5aa196a86ab1736e0574473c4d37c09d5c4e5e0574ea82a4b27ab524000000077b3b07c733974eb5f6e3ea50cffb2654b1f78644027d5af9b7dd76b0b1d894d3bd1301cd028c7c1f4476a85f119892e192e24dbfddfc791452776847fc0d063 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A06886F1-6C13-11EF-B57C-E61828AB23DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0055698f2000db01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2172 2368 iexplore.exe 30 PID 2368 wrote to memory of 2172 2368 iexplore.exe 30 PID 2368 wrote to memory of 2172 2368 iexplore.exe 30 PID 2368 wrote to memory of 2172 2368 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512be5ce6de853c29c4d67d277fe7afe9
SHA1a4d607d81fed0fae2f57f23f011e690896d54e4a
SHA256909816c129ea4b227362036efce046e395f47c2a0dfb73fc1abd187c0a2a1ff4
SHA5123155f80f0168748ae485f5220017079342bd534cbe27fcb9032eae6d211f6d6726bfabe6d6f72e88702dd3f6387951a002c7348db50965b179422595d2bad437
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0b2e8884c3a7986edc0317e8f7e1e83
SHA1af0670fb94c32cb3284bd704c3061929e050215f
SHA2565fb2e9166d710ff4cc6ff62057f9234a0aa060280d3e7df73513ae4405e9da7b
SHA512a24b3c7ef936cb14987b6ec0f40bc3191200e88cf11be38e55630d0fa96a56e0b0dffe7e5282e5fd18f5e21f0bc88d9f33439a18da9eff972a1d9ea40c805c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f2a825f2707ccd5bed92f218b32a15a
SHA10b23d5b9adf4effc7752ec93798c6ca89af46784
SHA256bb507bdc7c4627c53cbbd9355511f92233e893c075ca15364a53010de1fe4ea3
SHA512868318f93cacedd2e478e3dcffcd1bc2c8a43098cf71fb19e919e4eefb8347339efd01ba01e91327e35bc03deab90f0f6d340b1404a08209a937b33b79376b52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55041e151f35bdf3efe5dea191e1bc1fc
SHA16e12370894975694465b6dbd38ef92ff10243544
SHA25689ccd2f4ba9d4e8807e9c9f78a8dd14d3f1d146d9db987f746673673212a70ae
SHA51254f4bed193387ba21954a163f90b3d5bdc042c0ea1a2b1b0caf1038c227038f1147e7e5640eea9f6a880a5132b85ac7eae4929594404ca1e4261e9469c29ed43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0435909c31d4c14ef9cc3c773eaa579
SHA137fead89a53ecfc29be250aa82cee96d3b443f15
SHA2563abc7ad94f380c1b735f776a074da9f36eebcc8ca0d0b9bce16b9d16a6dbf03b
SHA5122a4efe8781cc48854b9589d2d148312f4e86f27457cb6a30d6d512c03654bc181da64d5f50991594e7ba47707ca304eaf5302fe3aa13212429157a31141d433e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5441acdfc6737309505bc1d8252a5a9f1
SHA108670c9383f1a90d2fbebbcadeb827f427fa50c7
SHA2567793ec5dba5567776a003f80916884a70e41b525790673705c6683123a0d71c6
SHA512b874691ba57ca8158a68b77d50129546292f55dc04cd1c4b6f675ddf2fe155d3c8e42586fe6b1f651f84d11495d6c7dd153aba5b32896ffaadc0adb591b2ec65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c46ba4cc61ea6f3f9a206eb80eea4489
SHA1a982e4f3ea096e88b5c1fb6a8b348f37026a4a65
SHA2563d5cc9456198b2effd458e787014e6bf0aa8a71578e8f6303c6b295e9ea70eb8
SHA51286827e6b1c5256a58c0d945c1fadf932d71d6d0e711136decf7c116609acd0ae8ef1bcedc11df9b917781bf2afd298d2f00a26d9dc463e73f9048560ec149990
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b6a92bcba8a997370addf4de02b7924
SHA1e8f084911210b22969b8ba65bad66c65966f7b77
SHA2564f240373689dbf4e393e4ca216a3b66ab553ee71252b59bb6f28ce5c1f65679a
SHA5121f07d1eea864d72d2a4fa5f538c42c47fb7579cf4e0eb003fb075206f61d7b7f3f4040a07d48f1e8d1a677053f245a03040a52e1a64fe31195b83dc37b2f0137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae1a4e265fcf2067d839de96df233403
SHA1d139d16c3a7a1b9312d3ba7a136cf1cb55a5eccc
SHA2568d99e475f236bac6348c4e4a369f842dd7981ccf4509181508c0dd138d4ccaac
SHA512cb71e850c0245412a2af26f29db0b9ddbf59741f2747a811a5ae57bef576a0eb1add5a58b02642e391f25ffbf9b6b0dff512b6644c055fb0f3c4396656bb7715
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc6cdeca139bb99647533cb39784750c
SHA1d118e175a3e3b37071668440eb4bbe42982aa3cb
SHA256928cc53241b4a4f3b0d12fdb64bda85d2f3a3941201da17dc5cc417d696fab79
SHA5121e5d64f44295592fae2dcaac4637c54d86a65622e8d64b17b8fd0095bbd0ca09d3485fd85a36a969aafe6d690f3e5b76dbe2566d73067fff6cbb1bfd43f5519e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e058bca372f07d8a2482677ede27cddf
SHA1597954b1c2dd9780e7f9a60ad0c3d986c570a5d2
SHA256967d40f847a56010a2dfbbc7a2e4871cd25bd56688dc12b7b8f0e1d1dc7bf9e4
SHA5121e4b1140f35d4d80356c5824c06491a0d64946bdfc8c8a48f5735fdd13814b988bbae3eeee37a0e66a239ef4e28ab1e645c08e57daba7b518fcda42f231b4f28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b86d66b796120126548735b260ec8254
SHA14f693cb63c5122e67e28abe3e47af2cc9e85f287
SHA256c96593217cfdfa7b2b74c86e2dca01ff699305151f12394befc20b881bd36d16
SHA512cd533c84034c8c2c19c0a6870ac4f1807e98d3e0b1a6d852c89b6d54afb61675a8aef01213e2bddceacaa99905fdfcf5538062fe182b0690fcc2dfabb0cf2c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e472c16473d928032f0a8ae5ae43c9b5
SHA1d5ccc0ec89d022da06fc89a3e0da2cf73c175e43
SHA256063eef0a9aa3cd8f1e1d1ecbad9db9ee75a3dcb186b01fb823e40c3d2e178643
SHA51240490572d41e5375ea69021bc497404ff17be7a2af94ff989d89d1fced526c7bf865cf2995cbe9e1ff64bf29d36f94a7e108a238f0294e5e8d6aa4c1f825fe40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544a19371e21f6c8542a8bb2f97d35652
SHA1fa0fc65f0a163a9495a6a507dd70358a6f079acc
SHA2563568299e45932b2aef1d90f011d5056ecb5c25213b5893ce0b6d0d95f24ebaa4
SHA51204b0261720b124dbdaed93d448c2b73dad92223d74bbfecb47d954f6429644831b4186255563b9e11cdeb1967d86a240a520c1dfb9bbdb83454c20a1960ad9b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d7b0f518725fdace3e70eb3c31edc24
SHA1d483a2dc8ccce7cdf2f71bcecf4a33e48a3b1e4a
SHA256b0f0c4e704ff55c90b99a7eac02a4084143cab7c78a2cd25991393b3ea6c66fe
SHA512ee141c4ca9d6993c96fbf121a6aa2c78c46f3ec67da41c897fc16e185ccc6bc0639792e6904ee78d767177ff5e9ee30ade1694969b9f0210a195acfedeac3369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a491ea6403f5c0b41ee0cd25d3480f34
SHA1306dd0170e63a485237e564262a1d65d0deb9429
SHA25604742bab877c5658f1eb35863c5063c78df2c4a63f0bc55d88d59d8a28d0df4e
SHA512a67caa08bd127947f5b82c8c91c2e399454101b51acdbe53b9c6c9cd1f28b6f9c3c34874ee95615b1515f539ed18a31d7a91249d3faaf07500da99176b7dc2f8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b