Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
cf478090d6c209663824b8eb4835402e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf478090d6c209663824b8eb4835402e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cf478090d6c209663824b8eb4835402e_JaffaCakes118.html
-
Size
7KB
-
MD5
cf478090d6c209663824b8eb4835402e
-
SHA1
be84494949dab9a9fb2e36db9098f5e672535173
-
SHA256
d299e0a26ac7c88348e07dbbcaa78d20d8e8683ae6d12fb48084da61f7c703b2
-
SHA512
64a0a6392e878b8bb2f14c8150ffc737700fafec2f906395022bf806587741289bf20d598c75e6f865c0d543063f578d3d06aef08330978cb364ab71f3e37873
-
SSDEEP
96:uzVs+ux7wILLY1k9o84d12ef7CSTUSzMcEZ7ru7f:csz7wIAYS/gb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000a05a4515ad80b9f8d943bce8dc5f4a9f578886f328ec81977514a0282d512b29000000000e80000000020000200000006648c466d7a5df3fc97a2946f0b81c8cbf95021c6f900dcf831d25c0d7862e9e200000004c4fd85a06ddefc1bd2af4b87d6730c94321d876f15f5d221a7d676cd392b1f440000000761300ba341e8453e46233debd21f9d42c786799f1d23ce43a1432ffd1ab47faad3d635d942e24a52f6dd97568ca40594858a34168ae6b612e8b7a9f5ecb411e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AA043E1-6C36-11EF-A5CD-E699F793024F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000006b4c8ec03df9cd9bce063e83f563687f352846404279d160098251f92c5241e8000000000e800000000200002000000040dcbd72d8e264c4dfeda481f623a412d2cb8df0b05bc9e62cdf6ebad205559e900000006321ff1fc85e4d4b1994738227c66809103b6fe62287acf6ddcbac8d0538f7e380c9cbd94df442c20b44f16f3d87e72f49031c057b67f550bcaeffdb52eb6e38890528a211121c1353ae735045bcd1a9435e9769946a69fd6c1ef0d510e6605a74168e13e2567bcdc51de69f8c77a5bd6d043f028ecd5981f7af3775d1c598fb449be9633eb8b61f0dae8d9fe8f9ad9240000000fcf63af2508e2cab1a2c5a60d55148fe9e1e826593c3d1a802ce872afd95239e6f516d4c502a8ad31a7cb21e2abc9bc2d99ec8b8fcf7848000da23b045c4ce16 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431778539" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a025b14f4300db01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3068 iexplore.exe 3068 iexplore.exe 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2672 3068 iexplore.exe 28 PID 3068 wrote to memory of 2672 3068 iexplore.exe 28 PID 3068 wrote to memory of 2672 3068 iexplore.exe 28 PID 3068 wrote to memory of 2672 3068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf478090d6c209663824b8eb4835402e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52454791c7575d557b00330a58b8b63dd
SHA19b301bfad785387f554be43e9e1b17766f743f8f
SHA256e0007bb87c076379d275edb7d5d872df45034ef8e8449dbe8599e5e2f9ba4ad5
SHA512eb9c2b0bd29b120750ad62a0ae4f5209a50bd482e22d78578dcc2b052a92adfb6c56b3cc325b7b1f90ba392e30959c81f2f299d2630deee3d478ae0e60ba1a64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2ae5fc3c249a5cd12a74518193f5ef2
SHA12df68216b356ae63cc82d09ab8691f5b2909d02e
SHA256deac27e2023a966be0dc54e0b2e74b646791e9452c6cbc16731e8cccd62adef0
SHA512f518187211ba43436c067d2c11d8ecea91ddb8cb9d9b753f2b2198e4f868449ddb3e9763c4177a5108ab782bee0cd8651a589dc6107cd06ba3e11b3b7c19e166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cb2ab5449e3363790f134a4a6770ad3
SHA167d15e3e7df0bb5292b09bdc67a7bdf0a65fc293
SHA25695583179b4b49a1d5c3ed875d731cf69b8b69049aac6e3ed4cf83857ffbb2321
SHA5126ed3da03f7bf575363d838733ee1f16757aa76917567755f5fa8bef37003b54e363e3ff5825ce88b5dca4bc639c68b2f684b7248a029de49fc68be1cb3b6f288
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cad0b24815f70d359fd7d42d0bd184de
SHA1ffe9395106da8794957b38bc5f51259ed68a409a
SHA256eba6f19a892a32c3d3334759d6600da35a24414b101f053ac922725fce0e14d3
SHA512fc18bfdfb9cf2c21360832a552c850213fd1e80ff271b3d01046b375b0e3bb6a2bbd24b71b662ed4125c8930d65eb3e4d1517156b1f25250cd82ddb1f24984ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575910e5914798db85a41712da218daa1
SHA19daea867d1e0adb2a1c92e31e8f8826a97470e3c
SHA256a5149d711a7db076bc50a5a37b00939c2ec2dcc7a57ca98cb58c3e754da62ce1
SHA51200810cf3840e6c578dbf386902fbc72a73aa34d91a5b50f6f70c3d0599906922f8a0f27a846496665bea598bca3781ca93ea2cbbb933976551d0e5d65d5a33ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e7e0417e0553a764ee5e640b8f616e8
SHA1dc4e19f133d4234838d12ca9834f59ce06b8fb94
SHA2568d2d3d6013fdb0c9161d400d5ace49199305de8d9c7d0c0301a563d126714d12
SHA5121b500c39e4a87f8d1ab79894a00019a5896cf4a4c826810ccbad4c93cc2adcce574496970d64e97290707b3ac63b2b5a6711985aa282aae856e84c84d0ed810c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8be192d43d58c1741b087a91efdb1d3
SHA15b20c3255e647ec17c9733baa4538abeeea023c2
SHA2562d4b746ded9da3d1b9a28208a2b74035f08457d8f5fcac532ccb0eeab51a9dcd
SHA512d11ba139739eaf902398f729224016975949f7c04116098179ac2f7729a04a6fccc365c29e07a91a690ac7b2a6c1077a88cb5d52c7866c8da2349462a2f6966c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd35a6d649a0679d626078465161df3c
SHA1f3fec82481d05975dc5e3f993162dbf860b2a03e
SHA2561c3234cd10f106e726bbfc90077c2e8f1689095c13710f139ee45e8deffac61e
SHA512a0a4049b7557263aa67ef2143947f1d4f790a69701ed6de56a9fd3e97f5c18b564ec48cd40181ebd0dd1d86aba816bafd7f7c1a50ef016697508b5a0bd138ce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea6b20295f654ac1993827f55d0b11bc
SHA149573526145af6a30ddb1a9e22d384a7f1b5fc06
SHA256de7504f9b12d75e3cdd433a3b736ffdff6d282907d0682cfdd3b281d770c6a1e
SHA5126a26b16540ca3ffb48643787bda0517578ecdbd62bac9cf3a859c2841d4b82620383957cc4ec5eff54c314650293de985f2307d087444505489d6f52e0c79c6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc0a910ce7f3fff6a8007be532e320f9
SHA1218b3f405663a6f0aec0b5608994423191803d61
SHA25673d02df881891e840a5513d4c70e664468636cdebac8f44eb572c38e49b2effe
SHA512c05f2bcc7ab2457f26f800fa8fb000038cb53579d9cc57f6a34f2cca6fac677f11dd725cdc9b2c77e6e398225da3b1309c64342eb8ab37c1079711331a14b3bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a4fc8ac3a93677c74e29fdb7e66d4da
SHA1d4763b9719f35fb0f462bc78bc4814202d69e2d8
SHA256af76f56c743a5a1a174d179f8b9b927287cd716fc18706fe3c9456e9933ac7af
SHA5127ae4bf2d25d39e200f0702a63a6dedc74d0e24290579e15560b0cfdbfa76aa1a0edfbd4d40c9d97a0df7dc244189b43ade12ada107b921dd550e6981e7339b0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550e2ad7ad159741dcae45b454612beb7
SHA12bbb944d818661af05809983aa6c93b8a85dde40
SHA2564b0d4517d09de68fa1b1ab6591cea701f44d25b85d44876c351e087d0df66b69
SHA51200facf24e0c1d0d231eddd77fd7a04984265c16f92b914f35f46e28ab5c8ee206ce1fbe9725fb39605df11a3588eda499b83f2750b47276ce3acc9465d0d7893
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59eb90549215a490320abda8ba71ecdaf
SHA103a6d8715fcd66b83c3b83df60a1ac0d07006f7f
SHA2567c6b244ae0fe30c74076775963e5aac826ee08aa277fe9014bb8ce561e9a9744
SHA512f4ef8611152ac6f5c687832a37343efa4f540e13df4352218efd0438a447564b8ff467926d6daf9fa75b7384814e48c33131c9222f4992ccc69fb98ae608b31d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550b0f92b3f8bc136a1b4a3e12547a77d
SHA1c114f1be60dc40da3efbdc4bcd94bc94d60d1d8d
SHA2562efa3123eb6707710f3d7ee0a7b1bbbd7127f8f8b19ab665d33ffe76b568ca39
SHA5125ee63bbab5a094bbdad95dc55c4e454f4071185d1a97bdc58527415b1417004d613b1826ab048407922cf65c7d5d010709e299f77613ad94155bc8638e2bfefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cbe94f0eaec3e58a2ad1f1d3fe1d721
SHA1c3e7082040d020c9b578688ca2d71a7f520a5460
SHA2568866282e2ea55e3216955d473112b955e54a1771e7eec0bde2d71bdb44f322e7
SHA512f493c3b00a9d0ca0aff32562de4a696a66333e6adf3140c47e9e5275c132e249ccae87c3bbecc1f4c26ffbc99c4d29db494d72a02c8f3edb9b5ab99e47bb398c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6f1e1129bcf503176410c99bc017547
SHA1f6a54ef3d927c22cb79c20f1ecb4e9f0d35c570e
SHA25665d5c3078d5cacf86f0dbc2244c7b699bc716ee3226c53511257ce395d9ce0a9
SHA5124bbcb5c8d99f5b76a730f3c0382eb74943ed3ed920e695c74279d5ed062598712329d750c9ffe2c526eda5b57bd3f5859b8dd88b8aed4f24d30d9672727df3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529b7693c16d7be59c43628f628972f2d
SHA1a980d3dfb7dac6661ec62cead8684a33d108e5be
SHA256ffae0faf63bdbbda074f65d7b3536026e98164ffd32b282e2ce9e03b654f7289
SHA51234f68dd241b42380aac492a44d6e8509a4ee73611d0a737a5c041ebf321f3c49d9a12d90f9bf1530a4e258e8dcd0d48ad58db32143cf01ccc727b7083bbeaec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fec933791e6c4f4380a9dff43b70b354
SHA1a9f02e14fc7256500375b6cae709948722c1c5c6
SHA256f009761720136eeb3c56156192de21a3d16802f9bf2cd296c6b5422783b15de5
SHA512bc61b2e4e7c06d7789cb8b725986613a40380313114d6a8f60a41dcf42c6f79e47b7431c09a73421f11ba5b80f8efd7e283f4334bd3d89fe2ff339cbfebfe920
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b