Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
d163e78e89569cc4164bf0ae17d49feb_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d163e78e89569cc4164bf0ae17d49feb_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d163e78e89569cc4164bf0ae17d49feb_JaffaCakes118.html
-
Size
110KB
-
MD5
d163e78e89569cc4164bf0ae17d49feb
-
SHA1
33a580856d662b2a3529c50cd13a6b8ab5476c67
-
SHA256
68e751adc084bd1f01863efae71273dbef20296bf861be49bb97cfd19d89dc9c
-
SHA512
a6db7dee7c7e34ff6c4c91d346982fb2399673180c2746fe8388cc058fc3764bd3f97db245f301be61b2f0378f4d707cbf5889e4bef43c63b2ed5f55c32dc14e
-
SSDEEP
1536:nn1ICXR/HOUBMPM7SheInewr5tpI8exUv01a2FttKZjOxwfC3eNHBnJH/2Nhox39:nn1ICB7O5eLdep
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4200 2344 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9A01791-6CEA-11EF-98DB-E29800E22076} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431855983" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2344 2100 iexplore.exe 30 PID 2100 wrote to memory of 2344 2100 iexplore.exe 30 PID 2100 wrote to memory of 2344 2100 iexplore.exe 30 PID 2100 wrote to memory of 2344 2100 iexplore.exe 30 PID 2344 wrote to memory of 4200 2344 IEXPLORE.EXE 33 PID 2344 wrote to memory of 4200 2344 IEXPLORE.EXE 33 PID 2344 wrote to memory of 4200 2344 IEXPLORE.EXE 33 PID 2344 wrote to memory of 4200 2344 IEXPLORE.EXE 33
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d163e78e89569cc4164bf0ae17d49feb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 70283⤵
- Program crash
PID:4200
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_09E5FD68127B2EBD22C529250B8D2273
Filesize471B
MD5e400427ce8f210a9c3a85444aa57c72d
SHA19fb62bc3ee3254f0a6e2257b21c9c70dcc5ce239
SHA2564332f5d8cb2cd04bcf054a3edf102ecb98653dc08601c4d867d663e9bb258c25
SHA512ede559e81231e3e1f68ac03e6962218bf4a9020d3ee548c1b8fe9d1bd772a5025b8bf0a161eccecc6b4f5db20c3b27826000a8f21a987e0404bd69b62ce96558
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD56c65c227732deda0f0f67007f0870c4b
SHA1e26811c4f1426e28b57652e012c96d63228a6b14
SHA256506d83ac0a47ab0feb15ffedd6caa5f2ac076165469a714b5fb505af66aa538e
SHA5123c0905316c0b5852865642a3d69198bda877434698a19ab2f0a22bcc1d9dd07c87b4ee104942e3a6d30e761352544e20a7156cd781760e5b65b12abd5ea819e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD56707cbc147a62dbffaad4b291e00da1c
SHA11a4168b38ad3b8fbb490fc475d4ce343e42ed6d6
SHA25670996cd9d37920488f7eaca4d73d2dd71e53a10e2824d93ac4e2940788626844
SHA512305b486e8fd2c7aac00856aa063dc1f903e7b08078813bb1a7b39cad4243aca97edc76bdbadefc03403d3656f01412c747bae21d4fd0080523712df077964ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD5ef603f80219b8a54d02c58d6e2b6d70e
SHA135279caffe2fbdadae924ae8945f5176480b44e0
SHA25679d75c78776e521f09d3ef94f5e03fd6e24dbc7c59474d649e851987e187a3cb
SHA512d28c8ee922d9bc260f87a0ebadee7c7f376ba30ac914b821899c96b22717e92341712a276b2f3b009e7e3c83a075f2c607f38ae8ed2a85af70cd663b951292bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3b8197b47dd683f36de1427715726c1
SHA1a7bf066fc28d56b0ba061455a7a7a978e74180df
SHA256e55103389a8b465f6a8174053ce6015cec04f0d3c1151b154e1046a18c4a2569
SHA5124563cffae66ba5d985037d443e7ab554513512b977255c6ab1dfe5e96125dfef184860e08c8cade0a5cbfedff2d1a08fb55874a56d270af512128c2d670de82f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56213ec84cd61682bb1f88fa8ff35f04c
SHA12bb431b5ebb5e7c20222a9ad8cc1606b8ebcf250
SHA2563aa4351a405ed59048dae92d5d78a1f077eed2971ee86a5414a77e6b35986631
SHA512818dc202905daa8ed4d76ee2f7821667ad66847816256e8d60e8830b7839898280e7c94dbdae784a8f6fa0d001448d0b7af899ad7c7fee4ecf2c52277a687307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5438ff2fa89f39454fad53c7a63f52e5c
SHA1ec3c70404c3009939f61453e4f7a3aa6f9f2e89a
SHA2560c234e28fea401263074e480c748656e90de861dac65776ac839df357acbc597
SHA512772929f2962892aa7b690522ea9459a7320196332eec225d6e464c3f05be07b93b119ce41dbed10d778acbd7f1957037b139439fa286c4186d4517ba0340bbeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f129427bd20f44ec88a281d318a82005
SHA1a12d31eebcfd66eb034aac04df3d2626ac204c6f
SHA2560f0d96fcf87695c2a6ac57e10d9d15df2722a8f5edc6976a685d4fb43878fa93
SHA512ddcc9848afde60f67a921569d5a7726677dd8bddb4f3530bd1d590c20b2ded431619af56edf0d6db4f7474def5442250a7c039e41e40ef27951d6bf764941c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a12db74c1747230fbe8e4ca87c2fa9e2
SHA1be085ccccf7ea61dcb5195f8330f3108ffe8c013
SHA2564a24118ced233604dd47b69831a5b46b4c2c30f220519d3b5efdaa66a7f7185c
SHA512d408e4b68bfbe7e5d02666c62180e6655f6cf601ef98afe1c20faaeb425627332a26287b53c25e27c569fb4dc59303e0542ec55c2b6a4effb854889c2a336e2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c39398cc04d79e19965abb9ef30ce0e
SHA1140825804448b3d6c441f8c7d7f28b4ebd86aaf0
SHA25634f0f7995b43769b00f0ce3b5c297cc764ffae4c258beef85dfe3daa70ef42e6
SHA51297a2bdfc432396b0cf6e03c66e8b66687f813ef237240d89df962fdf9f97eec263d6fe6157549b168f3798806ff3a1aca4d6fd768e71c271ef59a89c9f392aeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5442fb68c0ad8c0a328db50642302cfee
SHA1f9e893f91bd9e7fd0988020f5a85695136f11238
SHA2562a1c184fce7a3520015083b7313210bc3ad7cbfa7290c85c13be9c90fc9845d5
SHA5126f0d6e0596ca1b726c47dd06e34490e7a86ec0aa3632760937efbc9cde648ff084deccfd7e1a8d6bf8788974b626b1653ea42b8c145049ef850f1ee2f2c91aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f2c3c0e9a35f619f3d28b791394b688
SHA13cdfc10369ffab1654008d5f4f6ebbfba9766421
SHA2567d1e7f6cf2099970430d922ba051e996c3bb5241277c6c70aa3bbfd1d1633d0e
SHA51257291953fb7d016c1a23cb64ff63eeae1e73560afee94ba7d77a8de439a5c10482e707801f8a94e99df01c14dcfe55e7aa5252204d4058d5b9f92ff535812206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500c06bb6d93d7f1daee791a9e32e4817
SHA1eeb8232b688f7f010cf8a65b28d3e7b4d9d172d3
SHA256ffe770178bb8fcfec93b6b591d0a253a30bcd54e2322d2ff92a8ba852d4cb1ad
SHA51211e7b860347f9aac72b314b9ae3c4ce61c302f0494c9f7bd64078f9867c69d472d01cf151a2ce108a49f3155113dcf7028e0349ecb53ce27092a2e2b1fa0ead0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51257cd59b1d5e75cf20ec117af203fb2
SHA12d26e9cce7d4e42af90b3bbb5621179937720a52
SHA256c2d7f427c1c7dfca68f730d0b38a3eb6dba17059a60629070467f2c8e999090b
SHA512e6b47f0b3bde592df929fb79252dd19948330fac8bf8c450eeb307b8521f3eceaba134943b264c73bbf453b9d8d6ed22b12e882b6e860d652ae37d02a7971a8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddcc7cf257ec7f48318026a6fad21b62
SHA1f974d3a68a9f587ba04e934745131cb383a8bb47
SHA256dd4dcc2e151bcec932e7d26951ecd80fa4b920cd3715d92c39d46147e28fc534
SHA512e7488e71d2369c4104593cddd38c474df090cccafa3169d72c5009abe8474836c9f961f401fba6bd6b092249bbca0fa81492fc479360d3ec45d0448407bb0eb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD51bcb1cef4d72210121107321d6802d9f
SHA1f03e6bfd0e1e9f17f725122b94c0faa5823781e7
SHA2560a590dcc0deaabb4d794629a454dbd9ef25956cce2850b2817d3447d9a423a79
SHA512a54d72dc02b973c179a3a0aad9dfd9aed0fbd21b2765f4fa03a878e0a12ae3f57f426b5635485da30ae7c266030b9b4ada6512eb9f8b5a39a067d0ed0798e66b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD5e8668c6f2c5d25832c88cb5300e80a8c
SHA1edf9f5f049013bc305ef0eb41c1625e61930db36
SHA2567f4ad75b9dd1d7451e37b074cec7fe600cb16599ecb0e522d52da947ec595fda
SHA5122849f3e735da9533ebf145349b8ccc1a101f1f772821bc2a31716a1295c16569e435372b277fb63f80892250de640d96624b5bafc16f481bcc459738cc94f199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58c077468cb88291b86507b588fa15d5b
SHA160e8af239584af4adee53e233990816b1b8db6c8
SHA256f83ea4d8d15722edc300158158636776e6a0335aeed662eae6cb09bfee1e88dd
SHA51213939ac8ae7d116e754de5b8f5918e9f9393a62796d2ec4eade3f001f45a8132685747109c61daebe5d1dc12a2d3c0942e58234d13cba334b15c7c4ae8938c8c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\e-202020[1].js
Filesize7KB
MD512df00d326d9d7ca84ba60c0eca1f7db
SHA1bc2af6354bdbe334c94b8a33d26357c5c3156925
SHA2565badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855
SHA5129b4e38e6b3bd0ad3a494e62c56cf1c59e52272fb77d86d7a46a1f873078ff154cda9bcfd8a5983ea1c980f3d92cdd597a9728a03658e13951f773a2299f96429
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b