Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
79s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
d14882d1a8af5c77ebb549a0186dd90d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d14882d1a8af5c77ebb549a0186dd90d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d14882d1a8af5c77ebb549a0186dd90d_JaffaCakes118.html
-
Size
42KB
-
MD5
d14882d1a8af5c77ebb549a0186dd90d
-
SHA1
bc8942517b42b6eb295b585c72f2a658cd15bcc2
-
SHA256
a172208347f5029a5a13002444b440636247eadb790563fb65f491aec5e99630
-
SHA512
e2c41e5d3951d3bfb481c4072d4367114054529bd1e7c1aaff93ebaaae502f7902cd34c25c5fd05a687870b868085da69a005babe57e17296f5c68fdf578e546
-
SSDEEP
768:VoYxcixkBnHFOHS7VTrhbrp5oodQ14abAydLyHp1ZfrRJehiwHOkNI1YLFf9:VowFxSUsVxQ/RVkDV67ujSf9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76B8EC31-6CE2-11EF-968D-EE9D5ADBD8E3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000031e5332b6fd043fe6e749acf95cad9f01368bcc9f0acdc1666219110920324f5000000000e8000000002000020000000b59c322b4c63cfcf579b65738f38a1d4e5cc09db1af8e6e16e877ccd291619859000000077ea3e7d637fbb1225c88ca9269022c7387698536e28b2c879693bf018f4da999c0242fdf80fd5e239417aaaeab7f602045d2bba1508658f64d187bd7a7205e5732a812d58a4d33bf942d6350ca69ac78a48f9359c7dc890d16263ba8f4d20205c32b81bc1e508e75b76f4ce255e898a93f14049786b7a091cb595b332fc79cc9c89dcc29a17d1018a493242236c543c40000000da74c09a0ad706b434ebc12adc4e62ec388febc532b00169d40d85fd9634240a2d31d4ca62859a3d88aac7ff8ee9a339b9fab56da3e6a042d3f6d7c88e76eabb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000002dfb174548537098f074d5623cc06df263203b837caba84f1e4160064d1eb59000000000e80000000020000200000005ef918018ef7a835e6e1cfcbda8bb0f0b15e2b4b58b2dad30592b1e2accfcfa32000000082f1c7ad96b19c1e445cf7b58089ebade3bdfd95bbacbb3e0966caad9586622840000000eb03c3107b9797faad08987bf3cb974cbea7825929475b5225d07407538a7aa4fec02ca88a7c3f428b5e6946a4d7f51b3605e584ae3440f052a1fd0ceb63a4b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431852417" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402a905bef00db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1040 iexplore.exe 1040 iexplore.exe 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1040 wrote to memory of 2576 1040 iexplore.exe 30 PID 1040 wrote to memory of 2576 1040 iexplore.exe 30 PID 1040 wrote to memory of 2576 1040 iexplore.exe 30 PID 1040 wrote to memory of 2576 1040 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d14882d1a8af5c77ebb549a0186dd90d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0c4442a166b4baee67b714e66147b9
SHA188287d79f50e215412c0d3921467a416637e0447
SHA2563433f7c7e4e0f7faedadde221fa36466d7412313c3b9019e8379662e3a6b0b26
SHA5129c35dc0b2479287c5fc0d24100ef9e403b479833d32bbca40631730c280f8f816e7237e2e0e1cf1573e32d20ab40dc138f9bfd31750107ae1fa2dd0ab06802f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c839ed6e597ce3f3ce6d9674d72ca67
SHA17ab061e7531b46093090adb5296097818351d6cc
SHA256d98a2fdc207ce934a727ef922b314ed791f6ad9239a9fe6c31c09068321b668d
SHA51274b87f56d48ce157bf51ae41a96ddeba32045c7248b52e0683fd5fad48b92ca92365ab5eb7e00b28b4679baa328f974061901e612d2866e9897ec7d6ef42d34d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55217ea2771701aea064036d8111064ad
SHA17bfd52f55b42841e1999280b927c64f1d0b4de81
SHA256f5fb040d7bbaed2693cb715a27a3a976e5f87327686ef6f1d37ee87b49eb6184
SHA5126745c82a0bb2192257d062f66835763706d069e75b847909d592371f51c4526fa32a8a2408a008e2dcfa8c7db5f761bed77baac0ea4e07a770f90bc57687cad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc94d2b3ca985faa4c820111ab8df565
SHA1ef36e1a38240d2e3fdd59d7ce1a4d7a41741d2cb
SHA2567b22e313f78f0a1b503b3f38903b5e3495758da69b86243792e934d9ecc17d5e
SHA51256a6dab5c6ff16ef29c3df5c470348a964955ca45c94c6ac86f59cc3fb7f97cd68d5a04c978fc22772f1c04dacef04c0e589105052a3207554c501bcff8ab29e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56755e50884d7c8f7e412a95b8736092c
SHA128ef61273d95b6c1e09c9fcfe0dd13be27f92601
SHA2563952a98ab9d472c854ef001a03bd03e378890d69560a55b52d244bf97dd209f7
SHA512bbfd987dd8d856060ea3f3d85aa27d0c8682841a4ffdfc2ed06f12ba3f21d6e786880c482984dbe9def72946ecb62202e176722a6e8a0dd871d2548041855057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8cc3b0b3265d00f8ae6d0f65d187d4d
SHA19133488e61b8401300437340613d455c4fa33a8a
SHA2569413945e0d14b5a26435d31552bbd23acd0f9892136dc2a47a4f0cb372bd9219
SHA512722beb930374c1a9c83965f743c40cd701c9e2429ac327d700b880652300cd9c3898879bdf5754a4267b0c8b8bc468d2474931d6136fc6a25b7c22d72e49dbe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546f041761d60e18b446dd6b3b88d7146
SHA189917ab0b8f0c528616c12d1f4c2b23fa95b4a92
SHA256fadee8df4b172e42e5bb26bf135342bd72a6087f0bbb3d0312dbb447fcb85d16
SHA512e2406a69190c7c35fa0927193349a2e6917981438733c8059ee412c15e55b6aad09f63327a26157c30a1ed6f45df3d899bc97bdb57506ccb4e2c6490ddf39da9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f931c4738186736f71eb9ce52861606
SHA1964a577519c173781f66bb995b28d3fcd68530a6
SHA2560679b1d261e8d1f327655dad8934cc83afcb05657eb02493f4a847b99eff4aa8
SHA5120a220b68669cc8ce8ac7d1d8956de4c1ad6abd94720ea20396a0a11894ff57c4410b86a8b748ee5a2b4377b9fa254b1f23ecac5e3b2a93262b74c609137b393d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5652ae7ca7a846af8d597fe1a3240aec1
SHA1ce277eb987d6fee09bd02376fb07c6b68d065ab6
SHA256894299397687a1a0b4aed12faf256d785331229cb95a00091ad955a363571774
SHA512c68e669c49787abe68542a80626b7fa7ae0b8f28c9588912b3dafcfe219441530c10fc720406d29652db60d30ea1c3c91a8bc02a1ff934cc5d5423f1fc6a8d17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ceda3d9b6e85140be2d21569a19658a2
SHA1ce7a6675217fd87b501935c4d07c4df1db9a0a02
SHA25694086fc75ce2ad84df659fdf14804fab526f26bb994aa798ddff31bd2e4df1fc
SHA512a03ff853e3418e55497c9348c77f7fafb1934dde247aa508f00efe41708a6f0eb5309a3053ba4e4bc5697fe7977e7f2668a7df2a734106634c6310d428015a38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5743dbba8124572613d4abc619cc95e78
SHA1e71c6f625d21eb084566bf41349688479b99441e
SHA2561c6f2cc8dbaac0820e992460c0db79399078c88e4a4559beac673c411d64bb77
SHA512257b8f37266af734f8735a17be82ca8fdcef0aa2ea60070a4b3003abdd08f765149331b22494c014b7b232ce997a07506ef48e9986423968fd80eb453516128d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552ad7d291f15988934c5dd7f63936eb4
SHA10976d17635856bbbbb056aa5ed77a1f35dbcb708
SHA256205c0ed19ceac4a960dd74c64f3c21f3ae19a99055ee14f3e919ca04652ff56a
SHA512e6aff7efd0652aff7ba6d8633054ae57a5f80f236e2ed5cd4bf1264ba9bdbd820aaf03e212a31f6e3047b09fd69bca99928053c602540e8ba692864c0af7a457
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b