Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
d14bf397e2674eb2d8079fcbb43e2bdc_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d14bf397e2674eb2d8079fcbb43e2bdc_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d14bf397e2674eb2d8079fcbb43e2bdc_JaffaCakes118.html
-
Size
10KB
-
MD5
d14bf397e2674eb2d8079fcbb43e2bdc
-
SHA1
7cbf7c5dafd5b49cfb899c75134d0fd995ac6fbe
-
SHA256
397e69c272aa40f162a555567a40b0e26463f9dcc751772ac2fb00c7d54df29c
-
SHA512
8bd859f595ec4225b066153c5443ea306fe7c651118c7fe47dff65d46d36e50c42002a11694ed558cb1be00da1121f12046c202e87f5d91f35b60aceee0ba95a
-
SSDEEP
192:5w4lIoaNNHofBMD7MKmmm7mmmw5Zp93G0X+MD+kp+HB//PnNwWww2hA9mmmNMmm2:C4lI5NHSwmmm7mmmM+u29mmmNMmmmP
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000009e5d905daf9ce6b085fbeb499f0524619791b125b1eb941da3b545598e7b6010000000000e8000000002000020000000f438f9f9f8cf985eb3268e85fc37e78d0c30e7494aadc6c1a2fa388c1431cace900000009284169ab00881f09974f87addcf5aa785f662995d6b64e2ade2a0a448eccfb48cadcfe37149a49638c30bfb0c8e1e9f1c56fcf75c46e98f5eae8ace98166c10e49cdf71923bce87e87756b9a5ae2810ef6fad1196df99007757e80e2658b40443530cb443599bd6bdcd90d604840d9b9085e19279213818e7a798e0b955e7dad4962be7ef345d6697d58345c00b3edf40000000df94c49df72ce25a41151b44f7fb21a45ab4a47447b2bd4bdc48c2c2e06c8f1966c95fcb2da3cc29c56559444d9f70bac9c3cdfb96780a207107ddc18ca3438f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71B4C0F1-6CE3-11EF-8EB4-4E0B11BE40FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431852841" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000bd173a3cf9c7e1024925f7373714b707a6ce525e5922e799a417d7d446ddc6e3000000000e8000000002000020000000c8558515bb0daefcac5a40ccf51f2e3c4999273417e5c146dca2cb4cda8b349b2000000042d7da299a2036b8fb61cd5b7cc99278b665bb8efdeaf7ead4332a4a0759a8de400000000ef04948dfbac3b5facb0df03f0e6143a5d260bf46dd9a38d887d16f18cd156b948004fa5f8897ebeb9a06075005d8b68b234909769b3a34b4412a449bf9117d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200c6546f000db01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2804 2156 iexplore.exe 30 PID 2156 wrote to memory of 2804 2156 iexplore.exe 30 PID 2156 wrote to memory of 2804 2156 iexplore.exe 30 PID 2156 wrote to memory of 2804 2156 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d14bf397e2674eb2d8079fcbb43e2bdc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5823fbc2b04b41f64581a80b799a7323f
SHA12dbd33d500de495a062f1294a551fb68494376a4
SHA2566646692adcd9be03a83a5595244f17c4ee597b8cebd1a9c7db7acfe14a468eb1
SHA512047fdb42d543cfa575b747632b3989e03c85688fca41cb3b9dbcc9ca75cb678cdbf4fef9098dbf3860168c5d7aa04ba40845c462e2c234739e1291ac6bfe0a80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523b967bf5a0f1baab448dedf7a8e0a44
SHA1000049484852b23380c6212401acd87b5fb54c1a
SHA25657b5b28f60ccaa57f6750b9a9670126b80242eb94ea10505eb0d9ae4e044d9e8
SHA5120edf10f14796e893fd3215da16ddf837ae3f81d673a68f63bf6f34930f043c2f6b9aaff868123320725d1e38b0fdd98f3ea6643a8d528c1c1cdb39640f135547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd091c1355ddb6e8b66243dcd5417295
SHA1f90aaee7468d314ccc5cc771f12b3afbd826cd1f
SHA256d2e2282dc9923497f44dfe5326ff8b2bcbde8a0247d80d8094136bcd76103b58
SHA51226d5bc64d03c60ba92381f0bfa44db1a4e4a56e6cf21c77e42e647a56024a7d81ca5dd4a6875861f19cdcc5440e286d64262b9e06603ba3d38d27c46b41ca0a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dae4d754f1887a6e06b9b7e70d2c3b5
SHA1025f88e7d48f867e45109e89803883a3555796cf
SHA256cc0882fc6944d186053e89012fa74ee17b4718c256ef03e6e77920d560c43788
SHA512ca4b2de02858281ccd7b6e27ecc5b3f3771e338a3f1d851d868e2e6a37c5cff6df20b3b0cc1ea93c2777a5a90115421ebf78e3e59cdf72d5dd18d72b101c8f08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546359669acf50d8aab6e654d794c3709
SHA1a3dfee6155ea7019a496a35812d7732841f987a1
SHA256ffdcd4df19992dde072883c49ebb20a4a1e347efc70bb618135f046bd10b1443
SHA512aa91460abdab01c3dc4c8b93d12e9c19176a54cac9af4b8005df5f8af85f77c60c3ef89750032b0bc5d97a7e0c2296c8f370229c08d367316adbadac4d0423ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0d08a63a5efd890e4fd73b1dbe0f61e
SHA15f25ffac30e104cb9944fdd7452374bc2118d5ef
SHA256ada30328cb1eca530d217db7ae8b101eea432561d91d894b3044af8c532dbfd8
SHA512cc7491ccb85e657bad42bc17ece8fedba5c08597271b12dc420d81d36d1189ff1fa731a0b50ceefe4e38b66b29899e881d4780a84fa352c492619706251ffc72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500ef4c08ec3c7643e666535da42068d3
SHA1812179732ea7ade623e715a0936eb369b8457392
SHA256d288c6173aa21831b9c30a46d56841bb491782e6041e3bde1e13f9531d66b17f
SHA51229367ac1d24dacc054d2b6b6d08b425937fd7e201ec165b105131496657ef0e7030326d09e58454c1eabe551153e1cb2ed3205fa8c05de19a1145a9402d83b8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59961e88128a158fc7227b7bd163c9c8c
SHA1703b56102177fde7396f8abda87fa0ccb57a4174
SHA256d3726b0b91f15b0a4f6731ee4dfae431a2189bea2681970079f535234e0a93c9
SHA5129e546be10daf768d0351fcd77ee6c427538ac6058a406ad8c21244f5d64373353cd4db7be0b7c56e337e879cbf217572f2e4098e976a4af7d2c7f920e022edd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e90c418c860cdab7f143321ffc36402b
SHA166da91291fd826aac1edb3be564cf83d17c1f56d
SHA256e8a3d3c089347297dce7e1b2cc12adc4d9c5bfbbf47b53265140c4cf2810ff01
SHA5123afa03f70e72ab06488185dfd32b1c14628e60e3339f9dae3a1784c6758512ed924f9d88a004d644ce5afa1d16d16a3a297637ccc2acc6d3d396e9c037573df6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b