Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
d2102a7768004446ed2a8ec3938f3e78_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d2102a7768004446ed2a8ec3938f3e78_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d2102a7768004446ed2a8ec3938f3e78_JaffaCakes118.html
-
Size
67KB
-
MD5
d2102a7768004446ed2a8ec3938f3e78
-
SHA1
479feae551799cde965f4d2807527fec0a9d9c96
-
SHA256
8fedcad165414bf47f2ef7a5db3daaec419e7fb3f6f770a20c995050d89a354c
-
SHA512
dcb445407f84f5bf39bee84fa7f944ee167f83d3705f03c3e477293f83c3413251bbc7607c4cb43e55ccf1f0f38aad01f0bab085ec76776e0adc2621a8cc2031
-
SSDEEP
768:JiPgcMiR3sI2PDDnX0g6sgjGoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8s/k:JVuTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000884d4c066c81e8a503f8e3eac4ab0eb1eb6c7602d40af77cce7aa769a9cc5120000000000e80000000020000200000004ff463907de0c95058de365998d041cd7ce261388334720d3fbe1fe39d1fc47d90000000b13b04f93b6d317b88cae216323c32fd574b35d2b2de3ac9a7622a249cd4d877dc22085a16eca9a236be151654c7133129523b6e269bcb799a66c59354b01c41053e2dfefd7746068426f1e1204f61b7b2851868916c1cd34cac4af122f3a8806e43fb97c1ca04ed48af877153c099190f1b0ded5508511a1fab8507c8ef46f830ed24faf52ed2b7a2e3d9eed19406ab400000003bdc63a016b053ec0620f35b0171dda1891ae9f5f95d875943019950dc9a57f33c91e51fb88c22f038f2545a7db17b87462357bad2c6887e18fe1c671070ada5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c55bd32b01db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431878409" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000086475c8ee88558df0195fe26ac40896d3701015caf33d9a58b8da9683d85b8a5000000000e80000000020000200000002f86c690b8d895cde3171924b986bb8490406ab652ea668cd0d36ec8e35d6f57200000005ec3ed6b63ad2a113b39b83189af5df74a7105ed95f3bc71d2d8f2f0114eceb44000000017e3fae13d89a7b8331c7c431d9314988ce2cddff12f251d56b6d8e4d7e3302ecfc05c26c5af629d21b0b9ff0d686b1afc061b341834934ed3e7f490f4b31da2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD9DA421-6D1E-11EF-AAD0-E29800E22076} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2276 iexplore.exe 2276 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2684 2276 iexplore.exe 30 PID 2276 wrote to memory of 2684 2276 iexplore.exe 30 PID 2276 wrote to memory of 2684 2276 iexplore.exe 30 PID 2276 wrote to memory of 2684 2276 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2102a7768004446ed2a8ec3938f3e78_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57385468424895112e0bbf3d61c179315
SHA18e2aca64f3bfd0a22dd8971e9d17bb61acdf008b
SHA256cbcf03f4adf61f80afdde1b476526d10b792fecbeea170d2692c3067f54161fa
SHA51291a95467eef917b55eada0fb12fa3298d180fae606f396ee1f7ffd619c13b6e2803bc58766279eef3f55173cc2b327c7770af6ac8504b8cfdde6aed38320ae26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554846e25294d5ecd027af877613b7d2d
SHA1e3b52a8506bfdada31b47d8f50f1e401f75f4381
SHA25629ee9db03d7f0785f7d81f24a59459728fbf27bf3e94db484c7553f670954c79
SHA512fca5ec4eba38ed4427c2f727def3ec0c7c56523a92dbe96cefe54cbcb9cf8fd07584b01bd5a88b5c8d222712ccfc212ca25f1405ca76bf6c06622c0b8ef4cf3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d2f9f272fbd61b2b1fcf6d163c30704
SHA1b17fd91256a81d481053d3beb7411f6159c94df6
SHA256d5e592e09d8b683cf829acfc2c6f10c971e13d7cb19d1c4b3d39114cafde0109
SHA512a2f58df60fd81d6d2ce0b7e65bd993339673889f58d7132247da24f451f7749c5c0ad8e7143c1f4c0ca5a5fc808ed6f2b76b791434f005669ca8b82b76fd2a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c9c1cc7c35552292c63876593ee8c12
SHA1616a7d3e67d8ab4fd8c4e9fe2e7c36718a2321ea
SHA256af4df1244029183de66fadb7aee78302553eb73bcd0187cc978574a9a46efdfa
SHA512aecd27a08fd394883bda79528966901d3bca4bd7cf566c05fb3b895804243e2bd9a6224685e1bc04bdc231b4339c66250b5613cd5b42ac5be501eef5631e5944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c67a00137e4a5bc25d439d8edf7737c
SHA1a21156806fd9f1980e205c63a600db0043a76ec9
SHA256f6024f84613d592c03358bfa41ad9f5c77fcd6a45929e6953802736b58bebb12
SHA512b6c4b12b8f80970c9f1906a8b25d7a2e80554c990dc8bb9e29cbcc462e4b5a8bd86e545225b71a1bec8f40f0442884d38995de3c00f75aa76f3e306803302ab5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52327d07dcce78dd9f7b2c6b526c415b3
SHA17a81db9278d350e7d8570ffc0f9bf9956cc82ebd
SHA256a31966bafd23227e672cfa90ba64777c205fcb997b15420db998936d2648c863
SHA512cdbea462a9ef09da42bc144463a259e7448f9a20fb7d834be608c420c46737ccd6f788ecf5b26e6c897c1a44f93e9746cc50528b07d6b8958583bf7433dd685e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570575361241cd5509b6231633e495181
SHA11f8f55955b193b9c21e07a295e615542269ed71f
SHA25614524cbe0b1c01f75a690707b83ad8f8ee56b4f5d36543fb5f39984446224eb5
SHA512ffe33bb7e0c4962f0695220e4418634dc2435b6f3c7d977f7d9afe401abdafbcf1440ed6af5e3806eca1bc74ccdd9433cf2f4002f76352947791c3cba27966b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c667b8b1b528306c03db7fe08236cd23
SHA167ff72a7558bb3b51a0e0d8f059d166d58bf2f18
SHA2562f60c5d4e5acb552ca9a2d19533d7dade869acde34ae180a5a457ebc2336130b
SHA512bdb8df3603f4db83b79f3d18cb298d33a03af2352f04cebe6988dc9d04afbe49f2207e3088f4f1851aed8943f4a2e23ef76e5c982652bf28aa31a6aff4f25c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd0a933efbc5591c14128f29159782b1
SHA19ba481df5f05f4b3aaa155c705d7e3504844e88c
SHA256f2d1a1417191e7bece8d519a834a015feeff041536105d378f873cf8e50fa706
SHA5122bc16d4689ed9d15df9cfbb2f98f30ec39652cd01ffaa809e2c121942188e15743419743aeac32f00f39f911077efdd88b046b7dd39c63a7c5dc280561826edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5291fc27aaeaba12c57303fa5e9745c65
SHA1bf813726019cbe84da8d6e6a9efea05d125442e8
SHA25616b96632fdd9aab5cb099bafac8823765aea590a9ddd997dc780e080327e66b9
SHA512c4b56536ba3679121f73f64fc8c974bdb2498cb1261b30818c66232c50fe25c1c8a3ed6677d84337cc30e0c947e4051ab75f82b901186b3f23564658f68d7598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544f69f0688abda48cc3b481d11bca0da
SHA1c971708234d12cf9829870ba10af76348c15bc9f
SHA256556837aa84184cfaa0b6bebb301696cdb5de4ec5390e84e1b933e0957ed48f3a
SHA5128733794d0cb0057cd0df50ca95e6c459f6fbcf1ef6950fbb7a52cda72bcfbbe28220de267ec99d5840a2ecb63889700fdd4d395b114533d809aaaebec39e66d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a727c1ebc120bb7fc10b4a37acd35dce
SHA1133fdf8797f4e4edd77d50e4f6e7ded183aa2e6f
SHA256739b2fcdd03fc1d4ee65c966eed57ec0e6bb31cdc68365ec521358174cc03c43
SHA512c6e44f6db9b613f9abb411b8e968809a2e7c4ab4d0c13e0d35e933702ab1398dbe7c32a56583277fb29792c4c0ce4db702b05cc1874e92fcad8537c2ab2ff11e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5497f82a0c2e2c7fb33e3cc3bfa36ef4f
SHA116d8f95eb9263f5d2cbd14d95e30a79537afae3a
SHA2567660bc4166aa15e2f1048188149fca6019a105a72fc70ef397b96add2f61a689
SHA512fd1c3b90992f45b2e2efa2e924add5c6d3e8959c96f2e14ff7c0ae83505524927ad62f7f68ee4a0bf9141cbd325cb5cc4b05b12fa4433c23f4cb74fca6af9337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b18ecb966ff16fa7366aadfe1c1129fe
SHA1790f612fd20a56442339d120076fe778c78a5f73
SHA2561ce4f1bcfe19ea2e89e918c0990714023e86ce96a144a27f2a8d5702add6b91d
SHA512b02ecc109d2ae73a71215a66ca6b9b336d73d34dbb7cacaf1ffe0541f50105ff82988365c23dbdcdc1ac9000d633e9fdb1d044f066f38deae7a96bccee937cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5931477dc6272718392f35ae34d903e30
SHA1b8ef417352752220bb1483fd4c8706e42fd6aaf3
SHA2565cf53aa054fae2ca26001b3c5ccf8ad9a7b879af0da5d35b3ceb43a9f1227e12
SHA5125e5e6a4bb770f319b09ad5d77e6cc2de468013898d2334346514119216398d3ef69cec4dc40939484b371dd7436bdc74f16705f326dacdb452a15bbfef4e9722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e893343f4b867681c1d9a3aeb870474
SHA165dc3265c638fa19f139f98b1fc53b6099a6ea63
SHA256e0af65269efc980db15bdd97bca144f40ae67e37a9d530852463f3568b44d1a1
SHA51226bcde71d133e8a181113c5fda34ea4f88f0581435453a7a74e0fc9a93a788ceebc4c23918716ed8fc10eb83ea4cac9e2e77812a45905051ab942e9a9a380fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6f9af3cf66a0f332078b8ba2cbcd7f9
SHA194c2063cca51000d252b6c6570e2df2e4fc6bc1d
SHA2565b505d55b9e48bd178a2b69a2f02879fcea87dcc5d64291f512211453f12ccee
SHA5122ed9aed408495826c2eeeb6bd5b6087b19d26b686ada91dfc5097417c7fad698e26c90be077eb510defdd6d6b11e8422d6f1ad3bb4cf1aef39bfdb8fcb4cb311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e060f9105c35e4b319db91b5181e743
SHA1fb5999dceac80f7a796be1458b015d2cacc0ac88
SHA2567dad57ed57e19353e66d5605f77ebde155044819f821d046001569e64c4ae3ca
SHA5124142aeb0906109f1cbff61bcd91ea6a2727ec34c9010abc128840cc93ca58e676cda9ffb3f1755ed9e3b7fa811d53f5a3a6e309866e2d17d780cd2e729565841
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b