Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
d046cd5afa220f9b3942321625733096_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d046cd5afa220f9b3942321625733096_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d046cd5afa220f9b3942321625733096_JaffaCakes118.html
-
Size
7KB
-
MD5
d046cd5afa220f9b3942321625733096
-
SHA1
e8e973c01c6575820137baacc053fdcdaa8beee0
-
SHA256
408e2f9d88e627af97d86030c7d76d7ef69fcc3f2137d286c57cb98b3ead0173
-
SHA512
4eebb250c4dbf1ea10e2fbfe5edd1b4b5d135038a12573d83e107af4a6deb997406ab9da4de39daab8e6fc46044b2cb59af932a49b3b54f5d86fc8496779af76
-
SSDEEP
96:IQ+lePdPP5yuXOdz4EE18hBQwtYM9D//wKW5m/1u4:t+lg5yuXEkQQq9DnW5W1/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431811914" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FA685E1-6C84-11EF-BCF9-7EBFE1D0DDB4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e02a35700d59d02bda6de5ff9316da585c3e2595603f607829d6acb2ee9fb512000000000e8000000002000020000000e00a5f45ca60ca4c055774dcc76d6c7f2c8f36aeaae7d58085ef4e73430d6ff290000000e9684649ee4fc91041ad124b256e14bccc4bb0eb4311f0514c9e79d8abdd4e207c6ae02e72d4d2f4b5f67e4e192b39b2d1c0288a71c6a09e98e92d05102178e5902bdf3539128c2cfad9411811a8086556b8dd5740347fe0d2c9ecddd69103ff6c80247be0dc1c0dc2f6c99641d1c88cbc6e2e933e2ecfad1697a0e19bc3b514d5d4d3fab93a45415b024f7eb428b2d14000000002afcbe11ba9768f8e31aa5cd3fa612ff2bdc6cd570e7d9c5997ec0a2985084671ff1670b464f0f86f19041f0c1c94a092609e6a4ed96799157e7c81684bb61a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f2e2791441fa98bf036fd6edc4f6fb8d07f355f15d1ef057e6e06b00089330c0000000000e80000000020000200000005980c7d6041146fbb027d880eb58897441d9c8c939cee5e6c9e423e5e751a1162000000033e4a7b78ca71545957f4af4ba3d4d9178a698a457aa16f0ebd1268121c2de6840000000cd02cc222c448fed3e2d44f076c840f5905a5cbc32b873baa91cfe2265de1c2d06178a3cc33dede791dac49860d789135e1ec97732a0bc7c885ec44370196967 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e90d049100db01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2680 2372 iexplore.exe 31 PID 2372 wrote to memory of 2680 2372 iexplore.exe 31 PID 2372 wrote to memory of 2680 2372 iexplore.exe 31 PID 2372 wrote to memory of 2680 2372 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d046cd5afa220f9b3942321625733096_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0ff65a7cc71ce2df0ba867655272e8c
SHA1c6656bf456e850745c5e6a36e6bec7b8c1c7b17f
SHA25626b3a14377eb652584c6bc3dbffe260e5dc1ac5c1bbcb578237e323a1b3965ce
SHA5120377e77dfc586d6addd1e3adf945b0175f1596bf3cf65f8f8eb9f7f3e500e401fc7b59043e331a1de484e7bc38ae4d3e3ff3ee74c2b6aca82984e0c90dea6df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ded4efc7c937a3a6c7e78a8e1dc566b4
SHA1590f74df2f6b08f37aadb897a3de152e3cd6e863
SHA2566b60be6b8c28554b0ca738a91d6d931de14b3487a044a8539bace2e1fa5f1191
SHA512662599314265d169587537b8b72e0e29f02e6d8d0ac040b66b9af22c4854d4d48c912e1adc69a37c42f7587d563787046335804a2ae354317f8a025f345d9eaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5390e4d50a59667c82f50593b17345c11
SHA185473f53f715ddbcff5ce7d98a98ab11f4f4a9f5
SHA2560817abbbcca1eb86e4b8b28be271129b69f3e8b2d4b8a863fc7a656ad30576c9
SHA512b3a5f1a08251a687c81f94c1de66fd4ad23fb57ddc469ee2658bb10ffeb34460aeeb7edf5b999ecf1915ae76671917260f9ba23b5c779dc1ba05ea2df844599f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aac69254c0b9853a203e9a6a75b9c881
SHA1fa97234163ce737d2fda0f1047a9856c850f22f6
SHA25636dbe74ba9f4297b8e0c036ca621b5a2b1589b71f9d236d30192c6d7842fba08
SHA512153c6b0d4386c81fbfe5b4d6408ef1e169e249b865dbbae1eea942144a4fc7337b39945ff6dd8660199cc5da1ea2939dfc45e1c6d24ab93aaf560b4cc1f5c324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b45f3a8267693543e79495150b0342
SHA1c43a9edfb737098d6f39693def45de6c987134e6
SHA2560a7f4826fe64893508fdb8089a30eb6925b417084bd6a06c70974bdee523594e
SHA5120a7bb098010495f45261079906ca15c01757df214ee115ad2224cb7f082e413b6f935cd6bc1aa9f6099ed6e79088554461fe743a50b0bf8debdf9877d317f957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a2909f2775573e17208fe75b286246f
SHA1c243fc398c0c1625caf86dfa08b638c38a2623fb
SHA2562bfe4527775e4dd10d85e5d36e4df975f18d3d68cf9075f3dead155e162c567a
SHA512614c6f5be26109db7313769bfee793d909a8a9c94ca492819c9badcea32aee505e05ac0395e9cd57be7b72f8a0e8c68060b4c3e4551f8c519e82918cb11d0219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17e2c7aededa7f89bfa3082a39f5e18
SHA13f2c6ef081f7314c570d780088c374d34dcba06b
SHA2566a767c8f63ecb231d63ba1a8f1012875210f617c72654d390ee736c713182140
SHA5121d59d16869b3f9b687d6813fd432c1634ddd05c765bd48cb72dc148f5b838e29c8cd1b1f6406c959a59359a56013047d3bcf620bcb8b2fe05155ef6d179e005a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518a7e455a5b488b467b825a8c92a6c8f
SHA10f95c31ee925f174226de660af3ade7fe82faa2a
SHA2562c4c0186f684e91d0a56d280a6485e700367aea723261a080b1c43b5878883e9
SHA512175e4bf1fbf5b3f1e975bad9e3c2ee180978139c8489af2407a09fa004292ea71e91ee2c83744b4468564d5da8f391cea025e9288e2f9f6791e4bc669faaf2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aeeafdd7debf12837e00cffce4ac2d41
SHA1ea3c12e7edcffb48043c3d47229dc557644759c0
SHA256e2b5bbceacf7e75c4201b8158a4d13e21f8db293d9f5bc668884f785fd3cff90
SHA512e3e9ee68fbf9700e5c2444234befeb9159a574d1661489729366dd60556bc0c759b6e54d9ddadc1cf7f0b169986ff3ea3d1a3c2801ed13d91741fc256c63cffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502dd2aef12da7a485a457b274f42a168
SHA1592c7301e6b72227a9e1bb1bd70c2fd6b2a33afa
SHA2568130ebb3db125aa4c5049798bf9938553f04eb6a3086744e86a5a094373bd4e0
SHA512f68e2d41024b6851bca7884834f947f96bb6d44ad7911394d7ea5a61c396160a32734f83266042d048612ce63fa63069f0ec70e98359f3d9fed07eb0be23faff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5096aa58efc168384235dee92205515f6
SHA14bd87fb32b26735ed6c28f56b42ff60edc459bf4
SHA2568412b79cc460d6c2efdf5505184bceadd679521f299a1b7a6cbcb49fbeaafa1b
SHA51203f33b64e792d76412a6d1564e4ed539cab02789ca40d83ac4d201d60471a6f04ee8aa7136e82634394f972ef0ebbe26b8aaeb38ab31dd9b5ab4780228e25411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b56791ce74d90e2c548201c4237743b5
SHA1ee5fbc6ce5957e69062527ec5b4c30006fb0e274
SHA2560d0610f9ebfce88ba3c64298d48a0980e411a5546daf1aee35d5a3d17dc85b41
SHA512e6ddefdfe83dc2efe75ca9262ba17362ee5a619733bf6a742f20b86723abf79be9ee093192ba6b9bcce6ac3fd194d92874e180b991a17efcf359ec4412ecec08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546b557a6d05c580de51355989374b777
SHA10c9ec7254df450271efec8eb14a7ccb44311f084
SHA25667e35feab4b0fed7661c0869688f80f74becc7b7a8d727564e9d8ea5a67379a3
SHA512acc4837507f1e357a5df183e0a097babe2577539795b3cb2d20e44a7f79138d4479a41ab753887f645d26d2e325faeb3d91c3d17e917015c2d32bdc3613a1510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573c02dc554672a3bb679ebd7065c5aa0
SHA1ba8730cb170453deb42103720abe32f884dd307f
SHA2569931893266b9fbcb23219cfcca2fee68b1b9537a25adb36a0902d609e94c7185
SHA512eb6526097b5b51119c9c08fee1d69dd8f426fcc8717a0b833c5c50ff276cc1dcc2c3e7d3ab8d9d582d3060b8035b53efacab98102669c524645f473da38cd764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa7ef0f2bb1dd5dca03ebdace6f7500d
SHA118462d681dd5aa7195f1cffeb575d7e57777ae39
SHA25699a807aac57f56f8bcc5adf1308bf080372791048c6cb7fb8524c7e451af60fc
SHA51238e870f8a61fa86755c1c777f47616f2d7f5233fe0eae606fa754374bb7b62d4e456acf9b5c3afbda94b39ea7d8e1e9bd5a977ac990c2743bd25d778e4727b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de72742557a75e6429f140748c7fe17f
SHA1e7a6030433dc95f47351ccf7fdfc43f47c6e1128
SHA25664db15fccfc275e7f9f4ff78672ec2bd69f7503535151f0f5bfb79c26b24f437
SHA5129371f8e0f7e45e5e810a90048b91caad67bbe10c89933f763abda3ea32848b50f1ef6d97d73e1213811b0c2c8fc2b81b823db73e21d9186d63a7c15605669f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e980fabde8b4da4246b225c0feb33522
SHA1d0e4a4fdacba73562c92a361bdbf4c86e4fdb7b8
SHA2561f4fae415f6c9275cf34e5707043e24ddad9dc9277ffd73156c0ceb71e08043d
SHA51292d8f66e2d8b938f2140ac913168ece4243f80885c052eb7492abdf7b70c40f2237812d133631e9190703b5b89f271e04aad781a755802990adb6d96f9859093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa7a3b7d1e3938385b486bfa74837231
SHA1b477f38513a856ee07f392147a552e74b5bdde50
SHA2564acc52f4bd61f2d14ce2eeb9e45712c59d330367490ecaf81a4f78bd92b1fb36
SHA512c136e2c95cdcb29859c11458f748256a8c72d724026ad2bf8024a617d5cfc62ab74205f4662847a618a8067da1ce18add3cfc8a2e2f4d0a3489e42b1a9659f9c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b