Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
d59f51acf59f0289e487d506cbf1bd01_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d59f51acf59f0289e487d506cbf1bd01_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d59f51acf59f0289e487d506cbf1bd01_JaffaCakes118.html
-
Size
177KB
-
MD5
d59f51acf59f0289e487d506cbf1bd01
-
SHA1
a6091696fceaa85f8dcd36b7890f4d08161bd204
-
SHA256
b9163dbc004585993d8333dbfead8a912839d0920809141e12bc6adacd5d4475
-
SHA512
19bdbf07a37c790963cc6d3240023a37793dc74a56f3ab6a8edc41a798d5a63af194e2af69da7159f7b936ca307157f7550bab0ce81593c4e4e5f27aa95e8b53
-
SSDEEP
3072:SKSpyfkMY+BES09JXAnyrZalI+YB56QGt0+aF:SKSMsMYod+X3oI+YB56ft4
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB91E5F1-6E5F-11EF-A817-DAEE53C76889} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432016267" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 836 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 836 IEXPLORE.EXE 836 IEXPLORE.EXE 836 IEXPLORE.EXE 836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 836 2972 iexplore.exe 29 PID 2972 wrote to memory of 836 2972 iexplore.exe 29 PID 2972 wrote to memory of 836 2972 iexplore.exe 29 PID 2972 wrote to memory of 836 2972 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d59f51acf59f0289e487d506cbf1bd01_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD57e751fc888c909d1557e98f32fc6d620
SHA18077f2a2c2e681d4d8a93e9576d17edb841051f2
SHA2569dfc7049fce08e3747912e0b51752c66a2a15c8098baf243a42483854b837d57
SHA51239f563c819381f2bc49573de617b9b0e9f9ef33b92cf792ca33b29848437ff36985932d55249f31343168e9d1a3ac42928b1a0bed4a0f94590b611800ac48263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ee7155d9df66afe143f2deac400c6d4
SHA198212ab35a1b9ded91bd8781b3208f0fd89a10cb
SHA2561d8b5e0045556c8a0c90321a488727b7dcb9361163f870b8fc8b7dcd6bab8dae
SHA5129794e3a5853b8e8c977b52f3a88f849b806e7bb834cf032d74b317d9e3bee66eda178128dab581dd91d61e1453e7767b540b493d1bdf0728cb5847005b50b118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5620830aa2ca2e8d5e7c47bdf42851dfc
SHA1c9327d3712af6c30e6de0bd0d2adf6b874c6cc9c
SHA256aa4324c48e42a9d06831467b73b64812c1496998b9a4831b437f5afb552d9433
SHA512774bc3baad335e8d836a17701f444d2b09d0b3e8960307b3efdc87a3696358b66600bc816408fa1686fee66adf5fb9dbc19d7674efec6120c370c561dea7f0a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54208d7514122274d938340affa1c205b
SHA113287200fd10c03ac4606f328fb9c79eef9ac2f3
SHA256152edace79d92b9e3ab049a4f7e1d076c53f6170496a7ba3c78232ee87e12aca
SHA51238531b44e4602d20e9714e10870df5c57780058342e842e7e107c83f514ca26499f2173d648f17654da7be6faad18fb15a2a379c4a022988f7e5a215ea0047f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542f70fed129f22a10d7979213e1ebea7
SHA19405bfcc3728990bd4dc7a1e408b949bf081c965
SHA25639b92e574b30b3f941b3dacab6daf7416ca5df0695c629c87ec246912677b7dd
SHA5129578a47276694d86f4736d61f50048d04acf92ee1bb6d7c28ef11e5e01ac2ad2e150f2539c3b2e5059c63dd9267f0ae87b4658a1964e8690be6a51f0b3891c55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508da8c160630159dc683c04681f96144
SHA109e8d25dee97900dbb844b435e551125db7f9a3e
SHA2566bc3bf769bfd5262d5254a1214e56a0598a2d0a661bca54dd44066c75f58b5d5
SHA512eff1892c36337360b01fdeefac42d8bf8c25716fe68766ac44b26f6cda93942a8f73daf8eefb4387dba51f75251f7b00bda14d6a54edd06b28ea69d42e819844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533fc4ad132a19c1e16346ed0a880fd53
SHA1beb5499fbbb8580ff705579129703c0a8ab6c02f
SHA256d2796a4597842ec5252ddc5a67953affc0034e7333355fa6ed1c2f3515833f4e
SHA5125b571264b75da456b38d0218e6d31f20dbbe735a5b9d8bd0cb1992cb6ea81e7ccedcd9a47029695d9f01444c5758d794e1cfba6b6d36eacb85fd146846aadba4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f902e993aac769f9a93b9ebdd8b119b8
SHA1d56dc189dc8c0ef04c9040a26065fbcc6ff53790
SHA256e1b306da397a96435b74eb6fcfbcae4749a330716138ec8d5ff76309ea9b8b07
SHA512919f576a268461fd691f249e23faad5287d953598d4d8acc81a3f705f9375325c9362e0ee357b3857b461991ac7a1b621a228cd676ce9d0d60af0731adfef1b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c81cf0cfa2df4fda9c857d2d9c56d22
SHA19256bd463de505a4d520d89d44a49701cd6c1ba2
SHA2563aed3f173889988bf3b5907a656a72bd294fb36707cbd7bd18331189f7d35374
SHA5126975b7824fb6013d96346351afbdc4d56bd63a947d66545e7b9844826a85a94839de0e5f9844e27c9b4bb7345bf31bdc67e8bf820a64be61f8203b31ebbe59ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59becd60f0a33687e68977e5b9642daf1
SHA10affe9059baf7b39b2552b97210cb4e91f053aa5
SHA256d41ab50d0c7c79abfc489635646d1152124970d5f129807d585bb1f21f205d36
SHA512ddc48ea0b28cb1d7e2cf6c1a2fb92a9d8585be48e4c6419a49bb9d6d863e9fa6cb13697d129c3bb78f11ff4a1bcbd3bd98567722fe4e208f5685cd1dec947105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1a9b6e8df728ed972bd06cb6bfae20c
SHA1bdea67a53a0b3305b13b80d2796c2f4c0652aaa7
SHA256be9c8e0a10fae0d7e8b137dd01d5c02b7886f1efed753a164164c56352cf5b23
SHA512b1634d1fa87608e08e1b6f1eedb4228d28b7af6f9c27ba020390dae6196acf49e74ca820497c6fd734e7b656c91531ad0fc6068cd5a79f8513e003d94c681a54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f187509ec2c20634a58b77a929e99fcf
SHA1ae2116eff5c8cbc47dcd43c34ea2abc25e4681da
SHA25619b98de9af0996bcd39aa88fcf71542b986935bc2764ecd7bec677cf6cb53fb1
SHA512dbf4bc4108a3d65c87e37511b6007d960dabb82a88e7602a3fb9643abfeb48c65f1e9e96ca05e67383ef5709ca6386034545b6633a70a3d2e6ba87949bbf7f03
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b