Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
d4218747bea013e2b287194269d08c24_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4218747bea013e2b287194269d08c24_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d4218747bea013e2b287194269d08c24_JaffaCakes118.html
-
Size
31KB
-
MD5
d4218747bea013e2b287194269d08c24
-
SHA1
a5da65821fb076f07904991930021775337e0556
-
SHA256
d27a5666de26ae31abe3d015fa17f205b78f0ade7dfdf314b676ef473d622b94
-
SHA512
e23599539553208f7931b588f1e786dbcfaf3c42979db146a294e1ed7285727157844062425d2d6ad33ac99b0cbe5d8522dc470d6ff1bde9551a99a52d8a7551
-
SSDEEP
768:ACk3GDG7GaGNGQG8GtfyMXHaqHhEb+0+ixURlCrn0Rl1yHh6eXGbYuDHFXWnvIOu:ALP
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9016a36dd801db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ce174f84ce36cf496fd310d6d10f65d3a0630fe1a31cc5cd4bb6bfa3ef32bc19000000000e8000000002000020000000b6bf2f5a7d9fcd24393d9b59298401f3aeb81d070336914024653ccb21cd035720000000830840484d381d941219ba7883c2b0c7ed64044281542cdd5c672487ca02e9c640000000c9a1e971ba8ebc539a5fd2c4b70a235ffffde233cfa51031542de642ca6a6c96770a461ae21d9b7283cb09a6ab12053950b2584947fda688d6ffce7a9d13888c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000086e62933f9fe6074ddf9dd621a634cd40a47880fbbb30e1ce07cfc7228c94d3000000000e8000000002000020000000bffa0058d50d73f43c70288089e6e8ad6776dd6e518914988200238038672f4c90000000b0f90d1ceadbb74e9f110ed4b755d7d7b6c33c8ff69fe08469fe4b04f7fb5abf6ced2d8ce5a2491fc42aa52e6be85ef2f47c35281c1d528c787b4622bf0455c4ed7ca9c5f1dfddeee9733e458bc7fd10f35100250c40dd68fe580e21407c2faa6f1c54dbf10dae65cf9ea98d370d6287bea11e6952456490ed92fa196ae986b078b56056685becbc65c624601f43e1d7400000009d1c94b5b673323010017e081a7e23a2f510ad29b6706718985eee944a90c3e250a73b38845587b72067106ffe48f99e165d65cb56c3bce1edc83bf4df3777d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98410F61-6DCB-11EF-B956-4E0B11BE40FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431952536" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2784 2372 iexplore.exe 29 PID 2372 wrote to memory of 2784 2372 iexplore.exe 29 PID 2372 wrote to memory of 2784 2372 iexplore.exe 29 PID 2372 wrote to memory of 2784 2372 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d4218747bea013e2b287194269d08c24_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574d3acc4edb6d3b04dad3ff6f603da76
SHA14b512ffa0092319fb032eef8e018b001652a9b54
SHA256c6440c2ef74d1f0a39d109329632d872663ef3e0426848ae9870d6ee589754cd
SHA5128abc3022369e3bb7481e4d17afc9c35901549f19a200c83459911dc8f4bf044ebf71027ab50645a62db808ffcf9799929685661f915fe2efee39e89787c53ae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d68502f621221eeac14fa5d40c3f9238
SHA14dce8c3bd70374420e326c50d186000a0f9f6f6a
SHA256e76910a671f2dd23baf3e3d1e520304800341e1ff1c094d1ec678f1fe65e5375
SHA512582bb55c78570ba373f766defecbc1595ce0b009d3794ffda352b712fd6ecf7e8b6237ddb403dcb2cc2c5008230febc30932091599d479eeb3eed2ecd763546a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574599b1d84b45920cb1d0a7ad1796525
SHA1c3b84d39088cfd3ed4630aa5cf91783a48e92a50
SHA256b54dbae7b551c96ff84ca1b240b5587239a108cd037f06c57db3ab087e1bbed4
SHA512706d8e92d7cc4d1f984b9caddcc2218db0662b2df8938a35f50fe96af52f917bc48a140be0efd6ed6152117f1c667e71ab95704f97c7329613368f3289f498a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaf6ab2cf3ef24580ba57a181239db7a
SHA10ffd03a10965c0e08f35e251ba98da0e592827bb
SHA256a42d4cc6e26e6fdb7e64dc26a889588f8c08c95ca4a069c292262aba678e2a89
SHA51285f5e28dadbab6fc8c6b2f3e671670f10da8a97b552afbec6580c41078c66569cbced432d20ab41aa671551e7fa4fc753cddf0cf3d2433c19ed28727ec096808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541a9ae2ce436b3cbac77e80baaa635de
SHA1be83735447b5b29e5ec226b84f11a30170f401f5
SHA25686dcb308a67512752fcec73722d96e219dda6ed568a9e1e1b19a70134446be06
SHA51213de657a0737da141849e3d1a432900a9dc622598b50bbf4f2933e277e0a1f49bb7d66c1525eff0d12f1cab245dad67f6b518fe83f031395ad2f0237cf5e6391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b4b5d0e6ff6d561ba487a94a2189985
SHA1d9e276536f4eac0341f89671722ff0de5d7cda94
SHA25687614e8dab7cfe51d37d9af65fb624bb2daeb82bd03ce39a5102b7b9c5b2c970
SHA5126f02675a222d718e6877e9b7fe5fda00db9b948ed306bf318bb7b87b2fad9802dce43a5388d94060d441ae551a0d4244250c68b786b23dd3fb2d8c7f89428022
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a29b539df543d1cd671f1c339fcc9054
SHA100f4eef4c900ce947af674dd0de319f0fe359ba2
SHA256995a7161d9ea3bd13e1612dc49cad3eb64df41de6d50684cbe3ff6971aec6ce0
SHA512f1f1a3bb58b3a8d26ff9a3fee001d7269427ae1c6d1e18d4d2117429b404a566d42350e3fdab5dc7941b9a4386e33ca8b80e701105cba68cade4d8ca15b103e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508bb9b3daa158298b9a2ed129dbc32a4
SHA1c57c61d2b1278e317acff67dbb9b0e1bd8fd7122
SHA2565ec74e2040399b5181b4709547e7ae7434f64b4ad89478e29f61f08136610e1b
SHA512b299757352d26dba7dbac7fccfbf50f16d8aabb85e61900e75691ac04b5e1e784831e0525416a9d6a4b64119576cb3b0f5277a2942d6ea2739fa66fd3c41a357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dafd63f9a1d1f5f95d07b3dc94ed926
SHA1352bf3ba32e74a65ce5c76e1fe7f6874972c945a
SHA256a09b5c4181c061f7d653bd9f25dd2279d1d581c4acb0a4f3b40480daebdc8d1f
SHA5125879995a8f99cff6710759a9595c5064a20b5dc2c764294af0a8eedaf72a932b606f95b352618d56f5e571e358bab309c649456540df003e1a6ed51e603d5f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59329fafb69edf49920a81853bc9652b7
SHA1f448367f2bc6b18ac4d4ca20104b825e7b50f00c
SHA2563815e2c7c214505b074141a1e88b9b241ebaba296ad9e81fc4bfed61f9bce94e
SHA5126a661192368dd8b9cf1f6ce8f8a6e69f7bf93377f7ecf3535750198747cc73de0a2d00339d3fa0df298e9f2d58f1ad75916ebe873ea2546aba333f7eac5af927
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582fe823a475083df12aedcb70aa81911
SHA18009091d7540b5a5a9e2f0dbf097bb1847622809
SHA25621bb3e0c77c09ac336df4d8ee9d0f242974225c9f94772971adb6b8a2f9e10f7
SHA51226915af55b346da233d930da59689195fd85fb844a65b0ed9c2dfe089c9f9a6d4277a493d181d7e778813f1c012e3985f979d81b451f77414d5c77251f6b4704
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a6164f56f67421d3b38f66facdf0c0e
SHA181f861389ae6326e893fa1ab12bd56c6029dd0ee
SHA2566cf4ac3579ffdf227c8705a4a696ec9203ea078c72eafa5c12fa50a36f07d2a3
SHA512023d561aa28a18bac3f94b598e0649e07524ce0737a65baf72fdabf034e3d2b6d6945b5f65d2c7ba915d0402cf26ed7e1842f3323fa147e0f35c10c16c7d3198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a323644c558e48b551509a0e708dcab
SHA12166c9c167b392ee10140b35f678ba20b03eda28
SHA256f13532bc608c8ee865c7f80e2d3e0a08abc1f4be6489a3255fe50d144a391db5
SHA512ff6cd503444b78f9920573280178b5db49bae60ea4a39a2c4e751845776cb74dbaee0954d43f0af6853bef1b5bf2458f247779022d5a1b8900b2f8323a5a9483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511cee8aa968df53a5bfcf27e1f970464
SHA11bd5ea728e54476aaf9f652e85037878374f7bf3
SHA256755c56a856dcfe0696f793b7f112440b8aa9d7c9571740db0456c9dcab304172
SHA5122a99a7168e479f4bdc8e3fed5e123faa3591db5840a5fa8ccb30032dc815c7f3daca11c0f1bf64f5ba588ffd1155e1ba9834228356f93e83bb2cda860433ed13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eba85143be7eee76863f637f45f3123d
SHA1336cbed76dcc8d2de915ab0369e54f60de95d516
SHA25627365b25b32ff9bc94d5b8182ceace4217416a851488e0e62e89c7aa0ccedb04
SHA512bb05c9e70c7e059f7cd7c384587ca747998a641080bd6f5e86b7685e5fd7c37a113bd1fe86143e0aa88e2d5adc29f078f05cd10b92fa2366cdb4766acd97c62c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558cbc569967f39e9597e31ba13a2d088
SHA155c6ba6e055e702c6b33d92f0f9806be28292cac
SHA256ac810aee83f8beac8ab7e8a953d47fe46cff28f2fbd9f4ad11b2dc224637bce0
SHA512a2dcc3dc9d3f349a22b16ec377c422002ff7612ee4d7d8e4c584f2e8c6d0d520d7d887eaac9561f68a4a325efe02d9ca561f31d3c8844baadd256af111c2244e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b