Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
cf55bed716f17c06acd5f54c94f51d36_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf55bed716f17c06acd5f54c94f51d36_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cf55bed716f17c06acd5f54c94f51d36_JaffaCakes118.html
-
Size
7KB
-
MD5
cf55bed716f17c06acd5f54c94f51d36
-
SHA1
6d966aed92d8ce870bf46f6d7987b6c503ecae81
-
SHA256
c48683af515740d951b539cd0efdcacb1d8893087aefa6280b1911bc61128f29
-
SHA512
757a6e29f223c63c07b669c6f6de379efcd0a63e87efeb96f0b36d87ab67714363d7060ab7ec43bd6095696996cc1417669a1d0721eba5677c60de836d9f47c3
-
SSDEEP
192:/fNS+9Ib2dTEZeAeKxB+Y3/EmuO3uuuXQcQBr7h1Y:DTqYg+YBqpXfGs
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1A43371-6C3A-11EF-BD50-D686196AC2C0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431780351" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c2cb433628aa5e35c48462bce820bcde1e2e8555befd517268fea63a6b4dfd97000000000e80000000020000200000007169d02b8dd3ae01aaa92d657779c96acc2521c90761822043e8779e5f60ac90200000007ffbb8e39cf8679521e8afc7d1032892146e4a40843e3f48265e3152f94f918f4000000089f7f54756fecfd71c7ebc6cc589f38e49edbd9bdf588a3ff6283d11803e3ef0ea60ce3d6ef2fa679de8f3e26dde0f2736ff5c333153d291efa91dc458b7fd83 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000069cd9510841a8029a2ee87f0bc302f6ef1951f94bce397695cd62180688efc55000000000e8000000002000020000000eaaa8c2f579984dd95245badd94c0d8b912bff0562fb350b132f2a72c46f561e90000000eaf2201f839c91b7bcb7cd03635a2943a82873d3254072d6ba8fd61dba35f2d30e992c07d6afccf38269a893876b9a22f3a74ba7c2fa9d674f04c4a403964602649d17cca473157b8caec70a9d5ecd8e542968d18426268e39295f9cb0499aeff7ccc0ef73fb982f7e1b667926217d7832a73dc866b7850c298b1a134e7215d314c77c0dd5ab9a7c783acd52547ff2b4400000001f84f4c68d0dda95afbeff12b50c1e3a4ab8d416cccde78a482ddd4e3a2b2a9e1b3e6782d981aea8657255d20985b49afed525a7cfff9ca2ed29dbfcb8f0612e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e30d8c4700db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2524 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2524 iexplore.exe 2524 iexplore.exe 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2292 2524 iexplore.exe 30 PID 2524 wrote to memory of 2292 2524 iexplore.exe 30 PID 2524 wrote to memory of 2292 2524 iexplore.exe 30 PID 2524 wrote to memory of 2292 2524 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf55bed716f17c06acd5f54c94f51d36_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542bed75c064843e5ee191d266f9e8ea7
SHA112e2d2ec9509ce372cc0baa451346c8dac5492d8
SHA256fc6aee8e1c34c1874553b2bae796cc164897fdc6f7b123424ca722df07fb8a54
SHA51215d0d96cbc6249fc2986c77d299906c5d92268f80142a26311e3356f69255881066086cca6bcb996a95eba17c43473bcb4f57a23bcdc4d2da9247645b5cf20c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b40d6a2eb41e211349dac30726be938
SHA18e17ef38bce09a012449fd69b5a5e4e4f48245c3
SHA25660890e7ff9de071ff3cefaed25b9f60f14b163ce687ddf379db1c8e855851852
SHA5124cad35ab758cc86533eb2462d9069848ec0842c123d16056751ed70dc8de640bce819c13eb396c86602aefcdb04f3f2e89dd4f2a9cbd67295fb2d312443700cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5511c3d85c9737a0d8ef9c856709d3dc9
SHA131aae24588cf7fa1e0e19b5e09ce9a6bc5c5d332
SHA256d9398ddf3eaf59682ba5a976bf78a52e14defde556bc53490109e737e888940d
SHA512f896c5d5bd009faaabadef672503d0866e867f26e6f62ee9c43f19db92edadcfc8286c6f42802fc1471d5856b48c18c0d41c1675377fed04ca99c29dee5d1509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a20d578ed02250bd035cc8888fb0e7d
SHA1259ecf09d61819e07cb5600009ee971c83088941
SHA2565666f40a5e64bfc7440f3b185cce87b6ff0693dd298ca47aad9804244afbf8c7
SHA51290ab35cdb3f1e4ce071fe1edeea03f4516cfbd09bb56a544864c5d97d20f1b31712f898d004173903655cd2d6394df3027cfe30c4d456452f2484f79af7a64cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58156705a8f6c8c69d0cf3cc741239a3e
SHA1bbc003f70057a459f754b7cd1ec9604f5831d883
SHA25608379b50e422724b783fe4ef24c369ed242b845b8b43d5b4a873a4a78c931cad
SHA5120cbf46adc0d1f934aaeb959a36187897908b601549683601edd10e18629faf995b193825aeb29cb9ca7e15816ae7094d66e203fa4b90a482387cde6bef09be44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfd1383fed0215e586ee2d6e58f6ea9d
SHA101757fcf4ba5fc5f7dcef572bf8593641aae8806
SHA256cf133f7630cad60ac39a3b01f192b0c674ae2427775984e388672b14b6224d72
SHA512b303802bdbe2940a128593e25a1b9439fd93d2dcd79ed560b10b9770095e3a9bccbd954e7863475c7a32df8b335c374eb99a9b489f5fa55f060d5552b7bffa82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5467910ea76866ae30777c9d7896f965c
SHA17fc865b0bc5037dcfec3d5afdbea16bafcff8b3e
SHA256563976b5cf76b14a3617cffb60634fe00335902cf400f070ed510d82425cc153
SHA51271c609fdc1f6434e144c7806b78f95ac177fbbc8b902604a1897db34c8cc50bf67be8fc2c1d33f75af4f7c105a1333a9a749fcd5add901d4065acecd0d5cd275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ef0e52f64284c04f800810d5772f5bf
SHA17e32c901ebf82ad1eaf7ac9a7af06c4f3e8e9521
SHA2561f5a61593e87ad0882835dce0cfc4918a893a12403200b7973d3e5401f6ad674
SHA5122a95841d0270da2028f641493a97966860ac144bc3511e51d2f300a5588c904323491cdf31ed1f940b77677ebf3a49418e06c62d6524d61abe0144a2329b567f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b78511d378604bbf4dedde9e6d35ce4
SHA15e1d22b6d62f8de4d980bb9c6e0164ed444f8d6e
SHA25625c733493373b8eb20591d507ff9e6c8f15f2decf0029f367a06ec872166a863
SHA51283ec2f31a4579d192a0c212cb97b1a20c52b5b1b1e9942e258ec1f0177b33e16867f7801acba200ac271f9cd2c203f6d50905f7cbc4237b770b875e434ab95a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b853eba59bab2a801c4ff6f8cde733f
SHA1229bb52dd7d358ed60da81f3b0e8bcb1859ec546
SHA256fbf3a3637960fed59126aad3cdacefecf8aad4b773b8004b3ce0d9c31e1474fe
SHA512f5a2308b40db32b190d368b620a058c1e0bbd73fbb742b331a4e599bc169a0f07c7704392ea269662401e30bb84d12d837558b775f7c9bbce41af93ca15fb4de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f285d17af20d7241637d534d95955cd
SHA187ff5ba8556ac94fbc59e0a7f94c92d9bd3c8296
SHA256db72b8e136b0bf96f07f6d1a6a724cb834a491f39e06b6ec975470a0a4854343
SHA5121b32b1b2ff1f953bb89e3f6284029261f5b2bc4d8c4202871fa6b0c0540959efbf86da06519b6e6c3217d6d2bfbaf7f93bafa822a74067058f353a80523b5093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5006c83b31a68b43e5d3bb63fef272100
SHA109b5ff51d0970daa2c59d1e927934462589520a5
SHA256c523dbaf6f82120e90f51cec2d5cd32013fb5a66ba1bb7fd0f21987baffb5d63
SHA51298c84461cc3259215fa92cfda306207951417c5368fe4705d4df7c424bd920efacaaa6a58be9194c8b9e6b5e88cbeb10738f4d04e1ae81463e6254f4c1bbc583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d3240032447006656f47448bf80ddb3
SHA16946514aef25bfbe695abf95571b93648ecfd810
SHA256071f970e88caba0f3cb65a7984a574a97201fdce2b32fefdc3bd0952ed792a22
SHA512d1e0103cb501905af37aec85e4d69d5043f48e42996e055f4de410cac007b781e9280cc4af279117158030154e1939183508d9edf70da1bab54a5c9c95e133be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ca6462557e1ed90f2a83bb49e4b4e23
SHA1057981f3f00b6b1ad757a41b3d4f55bec92e703b
SHA256d69a9b9d74b53608e2cb8274a93efe63d67237461d3a4d797551f5252999af33
SHA512a3c5b2dcbd51c23ba0920747897af43a9bf06c68c457f570af91c6a14b2ff6bbb03dc63c2fccaee048450b50914ecc29c2a748004e68691615cde17cf2272322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac7e2c7e650a923aedc21b9faf82e6f0
SHA1e8a8b53d892304d3aaaf98f055c8dd56eb10a22a
SHA256aebb4343eb51784869f125bbbbd0b427b795391e8bc75fcddf5cbef0d6647ff0
SHA51262c0267eef548bb9f7e8ec3ab745ee2860cef0fbd50ec5e6390330c1629a0fa2524e1ea0ecb0f33969af25b324f94b81872db35b5608c3778c38acde3b2dcd3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8f55e78ba9dbd12dbb6aa2a653ac4a8
SHA14df335178a8f411047673c9c363dff0b0e6157ca
SHA25660a6cc30be4403c28d0cf3fbcc70f589fd809d3d4b9659c810f0132257f6ebbd
SHA512ca932e75d014a45a77ca191b134707e38e98773da0a44ce1f3b5180bb64806a905eb0c877ac82b23c9998145d795957447c2a4d6346ae34db1562001c9114217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596c507e9bebb5ddb2fe1514249a57364
SHA1613327ffc9061f16d8d73aa26c0a328e89cb91e6
SHA256ca96b77fa9428f46bc90037250f9dee822410450abf235696ba563bb6b349fdf
SHA5125d7c7362f8a0c860ca6aae55d20a145ab6f7c7a7a2803248ae38560468e4b7c0d1497863013221cfd60f0af3d3f59acc3d0b8e5d2391e6b8e3921409cdc1a19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a22141526c81b484756ab8d8e2c365b
SHA12feb21c5ee567ac7b4260ed712bab7507ff09a82
SHA256719a12a8e8f9c134cb6dd34ac56f681a083d3b2a8ed60b693b0ad0cc48f1ac9b
SHA5123fe7a082ade973d58317b8f31bf54455335b27d27c9e9af8d06fcf7175c766fabc62644a4b564658718729899c53f47d29a9d6d1a4a4a02abfe50df7be008ee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb9dc87f89f74f0f50326bc07c51ab6d
SHA19ddc54f8c0f476f26c92bba125c6f69dc3946f77
SHA256c4bfd8debd48dbf9ea857e3ab4c2837880fa5b0c033d4e5715083b4e0afc4ebf
SHA51276141c313017346501f7fd420736ac5b2fbafc89e3403deae22a496c926cd76c5d83b2aaaba818d0d3234a910f50f492245c9f52076e8cf66465431215a15331
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b