Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
-
Size
46KB
-
MD5
d2e2a1dacfd8688c31ebd561f544b063
-
SHA1
2a2d7ba42da0658c1d3f05ca95beb4b84c2dba4f
-
SHA256
5f7ad4d5b26c939065f39d4fcdea457860de7fe8a4c0a0a6290824431cbb55d2
-
SHA512
7923e2cb3f97b690bd32ac19180b33861d84cde9021f08f14567e82771f9a807277328dcbba4b51c591ce725b3146380c1d76148d7b6f31a3360686eb6d9375a
-
SSDEEP
768:PYruvWWl+WFGWXAIaAC1Nnh914eIaedgeP+4tReD2qHLlZ5z0i5ljeOK1fa7Yt9c:GuvWWlSWQIaAkNnhb4eIaedgePqv5ljZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000004c3c690a8820515c99d2fd5b9b82c90e1d8c51943e3ee6589f5318eccf4d7c62000000000e80000000020000200000001646270481adbe147c76b1e0f29c281ff807da6150d46d3af1af8dd2d488b7be90000000fcb69b96ab8d6c2b35d969e2526de8015c9954d1aed1472555ba91778918b65116ce2c985f2bb9218061575e4e22fa31b5a8a28ba4f891a6e3fd3ff0e2818f1513306c4d27e8e02d4b2662e686b8b88f9a1077831947dd199a2f8851c07e264cf63d7551154f5969c8b04aa42796b45bd010185aa1cce88463e325e117c69601662ce3837fa0d34295e5d21ae4d07a1b400000005429e3b75b2ec09d539206a3917ddfc55db3752c3284ad6a9b8c4393cc2bafbead73e0e0883979ba25705fcbe2e24425fc07fc2ee0790930957ce8b8e59baddf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6030631a6e01db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000286f491cb07ca866af84e70aed5df6b7801808dc21c0f68b3a711629677fbd0b000000000e8000000002000020000000b6c9dfbc37cba87cf0b5bb7885a5eb3a4b1c9c90645833174e963aa5b0ad9a9120000000d71fdc1cfe2a348375d294033e7cc004f280baf82027d47c876972ae8d686d4e40000000076d7af303864ac073d85211195d3bc679a268a78ffa45f300b1d56086852459db5b050341d55424ff5a62b476737688cdbf68a55f008981e3e656088dcbc5b5 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B249051-6D61-11EF-B1BD-EAF82BEC9AF0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431906863" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1788 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1788 iexplore.exe 1788 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2492 1788 iexplore.exe 30 PID 1788 wrote to memory of 2492 1788 iexplore.exe 30 PID 1788 wrote to memory of 2492 1788 iexplore.exe 30 PID 1788 wrote to memory of 2492 1788 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef89a4eaac675087ff320713c2f99874
SHA11a858c214e29e427476a8921fb619ce52adb47b8
SHA256945434d6dccad99ec788016b46e93b84a3d1b248485ef3853a57c1f4e40698d5
SHA5123c619ec4cc6198ec3125b495cea8413f5fcfef533d7f33fd0b57fc551eb5a5f69e3b2c2e13428f6923659a6e38875568d470701b242611cf310c9aaac2bbf718
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5add3b196957c2027208416233d705ec2
SHA1c1d1e0cf383abb4a47d306c463ee0284ab39a375
SHA25612d7a8a6673e1bb9b5ec081af15f2c9817ef3d04096d2d12cdf3d99442b6c7b2
SHA5125a980f587fa408e56ea01be25297e58ac0cc4cfdd16df8ec7b284b51c5f7c5c5014561bb76e4434b6985a395c9a18239bbff3ba4ba7adf152e5d31e411a92d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d8b2730bbd6fc9feda600af02981374
SHA154a4519443b509a665095fe728b35be62f1aa950
SHA256d0f7f0ab2e928d143ea787879d294fd5904c4f220b59641f0037c373b4c58852
SHA51260b84ba338289cdc2851de49268ed6ef475be189095626e1fdc99f4e0fd55162b679cf98dda883e895b815420a8b8b5d2b066a5159e07c6eadf06a51a060d294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb7c6275a451724a17251f950cf1e426
SHA10710fb83d15ad1671f5cd896d4ed92723c45b0a1
SHA256f24a478b4591a80b839f6084ddd3b19e11bcc0898183ac86faa8ff30ee6b2331
SHA512060dffae79979ac1e8541a883c4b7ea478674243d47051054a8520a7db63b0a7665d78fce17f191fa64486368482b7ce9d6fe0b89dbf50b1e681d1c939eadf65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4d3ded8545d8b189533522c6118ed3d
SHA19eb26dd9a6a9a51709fb748ec06fef826b0880e9
SHA256ffe228bd81667952529e390b6fdb180a860130be63db86aba3579e886fa693c5
SHA512f755bb5c6ce46a8f418983926fff9e5090d1828350a01273921aa03797d409991ea2d8affeda4e6fc415d39c1d7c961ac6de82c57f69e166a8c4f1ce878087c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d3df90e8bdc6051954777a6f8639bef
SHA18eb0965f3a3b42897e18fd6475498b98fcaabf7a
SHA2565569ccf95006e92aef73c0800d99417c4077215845847abe83d67a4fec613e61
SHA5128527a8998a543a6928f62f1d7d6a8086cadf1bc6b7a8c806c4d91407795765b83954d0cd44c627f858a66f2db86a6a10607cf3c531b0173bd19fe2daf621c5ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e10cb971d7cdb7e7d2a82b068cee0c8a
SHA15df19baa2850cae4e6c4cb4a14cd5a9fd11077e8
SHA256af5948d073770c15e79fc5d4406efa832574a537f0be608ff66d8a05658eb736
SHA5124a7b5313c2361a16a3ad1fea6c18957b973b84073355ced2c80e0197ff5b55dd27e3eaa2cbde5b36cde0e68b569b8fe129929e2d4ea8a95f0b133c5c901d2961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50229160b95048f3162441526d643f7ed
SHA15506f3d4b628901eaaec308c643ac4316a64386a
SHA256fe008541bf449e3f7bc68a8413fee9f8dd027e8a825dfc409d7413af417a526b
SHA512722d31a3ec0eb47f4e202a997a14d2ae7d8af19978d0036ee99a53f5b914fd0ba2b8cd1e49ad4650075a39aa35f82d8e48a2d95c975881a992885a585bda8136
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c081349e0a3c276936d8fbf7cb3a9f9
SHA1aa0c011b7cd51b64a7ce2270a0273a69706fd6e3
SHA2562a1b6ce489fef827c7d251eb4a21d60a74bd35e0b033a6b03fb38447c385db31
SHA512b17b61f0ca93a5b742df99eaca9ac9ad5962dba9c6d6aaa7d62d5045049deab55e714c075eef9f8d5136faffc028710a76502fb0bd7ef80b1af4f417f3371b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a38d538a6e608452ec26f2b9b6051dc1
SHA114f5c162ac578d5a71ebc38f75ba6422407b24b6
SHA2566a736f3d81059e9e985b9e5e739881732f8317dab97d465343fecd74d510b598
SHA5129bd95bea87465caa471494dcdff28e0e58b4083d9b0f1be20677c9fa6af3167daaf6c2567e1987c278173978db20580af36439afbdf0a83fab4799ac0d3cf163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deacd2480a0d280e7cc9f07f67910769
SHA159cae93358c9d74f5ed1dceb028438e89bb7d7f4
SHA256f3063db4f51b06a56daebc4ea376dd1d03710fd320851d43d5141e4b3757fc44
SHA512d2a0efba5d406440a9038591a07829ca8202651a5ad3d7e430212f36b946a0222d25e512ca33883ecd0c2f1166f6206fdf77f20e151a405e13753b17d4fda4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58faf7bcac2bc1e5871b945deda2c9ed9
SHA12df6dd65e8c5364f914fa528cf32f5fedd45e829
SHA256a2d8d03c195312ee48a2481dbe806fa9d5bd2cfb883c7d8f1f1bbbcd631c4b1b
SHA51281eaed8f7ae4408b873bf0e4afbae1eddcd7a5fc0f0e08ee7eafec1e278052b30de6de4b0825bd5779e3da5913961ca437386e58c24eed18e4770eb771dcaeea
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b