Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html
-
Size
10KB
-
MD5
d5d8eae16240f3e906a794d91bb839dd
-
SHA1
16643d1e733d80eac87e4c5b4c739f76d883453e
-
SHA256
9418d72900a3d9b94ed6fe175e9cfd1d12264ae6944f74e8e6e419abfbcaae49
-
SHA512
3a139368e09ca71a2f487fefc795ad5d6dc84893525e11d2f70e208d93170142266542d438898336ec89a3f9be688d90669996ebbe303a6361ce3efd76515de3
-
SSDEEP
96:PG9o3EH4uvgGkp7iBACNNQjRSpdKFU96wrBzBA54Y0RM6nNtHpPDzSid/WWtzC9o:Pd9pWrbGUciBA5jONtViVwz83h/TU
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C576E81-6E7B-11EF-BD50-D686196AC2C0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0049e1e18702db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000053f646e62ec9cf51a27af8fa0f4c067d10d14ba13f07ecdd4788ed9c7ddf8d00000000000e8000000002000020000000a683f6a136b39732601399bbccd427f61b6d8ce4d1d2dfa83ab464052e75995190000000b82e3ce296b36d34ce4c1d6490d686fd48b0080638c83563d86e3bb9f8da996538d27049194d632924c3093f1e85649bb19fb82b8c6566ea6d9f1c873e242508a4abd82d1ac48bebff14f0ed7fe6fccf4e0149b35eceda4c8ecc938a354335914010676a106e7a5d2a650b7e1d028b91f7467f3d9847411098169b3fc4de0c9563efb25ef3defcff20bd39625ac3422940000000d10b0e3c91d4f7ca71b6fb82218548b9a84e60dc4f3e54890fb0c766be961390a2e6d24a14e97735ffd53df92955ab4be1ba3a5df297df62e83ecf16ed977c1f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000064aefe9bac050fcc77c2562daa44c893274d3048c2809b7a01565f63e080fcb3000000000e8000000002000020000000e40b18068472bcfb7af002ab27a9707edb144246e86a2049d830c0b02469612a20000000d81d5aa0a7c2fed56397bf58a52a7b8372d779b8edc13ea585fed0012070cb9740000000c9e63bbc03a7f0f214b11cae99e9abe235911f989eabb4393c1aa7ac52655c5128bea98bbe24a5be69c4aaebaa091038fe5d3eb98f38fd00bc4f39e7ffba8a4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432027894" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2752 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2752 iexplore.exe 2752 iexplore.exe 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2420 2752 iexplore.exe 30 PID 2752 wrote to memory of 2420 2752 iexplore.exe 30 PID 2752 wrote to memory of 2420 2752 iexplore.exe 30 PID 2752 wrote to memory of 2420 2752 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561e1abcd04f2225abe88ca6fb84149b8
SHA193eea6afd31356a669594bcfa7524cd7f0baf571
SHA2561789a4879ab54e81783193f18a66cbeca905aa66e7709742de0750439d35da0b
SHA5127d493ec1eee0f8fc7ac1ffe4d2ea8166890266f2b440abccfa1a0c8f9f5fcb730f6f08cf77d6ae881558301d68c4618861bfda582fada659d76cbed2f1785b35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5768d0810030dfc5d42d2e94ff7174263
SHA1da09c59df161b573b566c1218a0c393b35d66f48
SHA256a071ecd56f14e5809b29e07d288799a2b2fa10c5f79fd4025cf759667b017366
SHA512e651140fcbc4644f06cc746f419c6c6a37fcbe6f7bcc9336412bc63915639fc2066582c0da2ba4e95225fcf2b2dc7f2f7ca847441145f1155999fe57f77a6177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e00961c2ed6a1d19e463c6b889e93bfd
SHA1a6c2b707be9c2c11794e3d65098fb9be1c86fbe4
SHA256c156c99c7738ca908a7f354703511b6d335e6be63a0e95af9f7bacd9503c9747
SHA512b7a904e21cc024d602a78242f4507564a0b069701c19aeec9d140020228a018feb844332bb89781a08ed471e624bd32284cec54d20253c843dd893981908eb9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d01551e786a7b20f665a5af47380dde1
SHA157ef82a3e49ce348eb0d14c6c1ba93e7c98b9611
SHA256285bf14b04656061080ce49cf85200b57a0cdb1d6d8b4a5afe635454e44b2ea8
SHA51254cc87d4ea21c6d07b88d72281020578bdcc5dfe5f25176f7763adea15f46437c4d66a5935f13a697154d9509278151481f48725b025b41bc6f716ab85167fb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54f59c936802236456a82af4d03adca
SHA1c03801b92882dd754822bb0f63bdd9099ebf6e2b
SHA2569f93548b62bea1f3b8ddce4d396fe5a51e65f7ccbd8615bc4f2a09cbae639e31
SHA51225f6422a7db77aa80a09b7706e8d2670503c3cd6cc05f4eccc76fcd0aa0c7d5aa6450dd30b0d960d076afe922168543e1918835cbce210b904ad5813c34a07f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6ad9252d74f4604a923b9d84523ab8b
SHA1dd01a8e3b832caa8ce65aa57f3867b6a037887a2
SHA2562d131672719e900f8004870db6334ac3e92e8ef14c53196c2e656f5a782f3444
SHA51256555527ce55d06d15ca35a8ed339a6efc53640cb71047fd05f0ea8f96780e0fd14f05db8c946bf29b58bbf40fbe90d19d22a11477c9bf51d8f711754b67a91b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566449b3ff144c71b7818a284dc9bcf69
SHA15f71587e5b36f2089b2fb9cd4aa1e0229f612c73
SHA256a1f9917eaf45a8d17ff24af530d0bb796df005d2fff38dc06e1e4d0dd81e45ab
SHA512f432643fd1f2902153ac4229b2bd7db2f31e096a55a4bf6413fc6fa1c30af46a2d7567cd539677a4e2998d8de42af710b11b42e2f908652d1c4c299e3858c8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528b73918b71f5f812f514249f70145a5
SHA127edb90d250d1917951a93e650b18e2f43d5b0a9
SHA256d8276119f8d0b2e6d2b99b0a12fbb24cb2992f0545bea0c8a8714d6611da2c71
SHA51211970b70d44d27eb0da4618d376d869557b277e57d8182f9bbfb281d65045a1231d9bfb56c200cb1e6b455898baa945c3889705813366b562fd136bde5d209d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5664768dbf1e4c97d75f54df32cbb126c
SHA1ec685338c63e07c93335482bdac19214e4cbe90b
SHA2567865b33b5748f4c5d685a3baea80b367bd99aef2f76aeed972c37481e34957cd
SHA512737c3cae16efe6a78f423f6a596210ce1b4e3353383419cfe87d9261b10e926591e2de3582e0d2b767672afb74dec02f77c57f8c80f5d5d66515ea635901be52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a49110f6f608caf2bfd13e3458eb442e
SHA1723064cdba86ee3dd223c375182b50ab5beae63b
SHA25610863194283e58535da2c6f580182fd6dd53ddd4b788e7dede7d9115952eb956
SHA512dfa6e0a12f539641c06747336684a80e1cadff9d840ea33f0017b3d5064fd6dbed5a1d31c0b38da02e5ce97b47c6507febc652ee425fa11022a521ad4992f25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dbc55438ab3637bc2cb4b460ad0e96b
SHA1e8e2e488e392b7d9a4d7e707209697e0bf20c28c
SHA25620a1492b46f00db859860b2da6a61932d5a1ffce07967db60b1f36a2c6118816
SHA51239e9d3b006635e0d2bad88f60afe08a9543e248862e2868b9771293cfc2d4d83303ce0f38e651c5455c97eaf42505c99ff164ac7e215a695742cb729d153757f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd115b93cc360b6d7d22670d4c389a52
SHA1d5788f0f820a1e4419706fbd94f3b59c542fcfe5
SHA256d97b7dfd35443228980c95568f103fe080a46c2ba1ba261c738381c2f01eedc6
SHA5122c7f1e0ac4f1e4c550d12aa4d9a0fcf2bdd3994ea996ade9e1a1d5576afcc1ffcc92eacb130697211590fc1307426e66d5f9796b0097748510a467f139f7e297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c9df2083e6e956bb78cd2af3582c5f1
SHA1a2eee9e5f5f7f9767ded75de501949fae2cda9a6
SHA256c74e1592a511a5f8340f87c85c4e313a216ec82a87645d6d361df795c585577c
SHA512dd61eae5ad773c4547713499601ecab1bb0ff455cf82ac27bbcc28d8cd3618356049e1f33f196c40ba7620d77e7e06e7d3ee275523c34c65f3cba5fc4cf312e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582a3d0a8e9995de32cda602bf5c27be1
SHA15db0062aaf0ec7881d1cd3a7a93109f11f7b8520
SHA256a663698c2f8bd07f3cb941b46d7e5b0ea7f105583913c52a5a835e6b4c2e7462
SHA5125e88767c1264f119b8da04d288dd77723a9710a04d94585f44ec131650a9e432412dd65a58ee3a1e3c1f6b0f2b76373796b5622f7563f5853e10616e6681cb56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efd56f11c17a1c10bf1fe9bc2c33f3ad
SHA19404db7a15b6938303e03f2f88ad53395162b32b
SHA25642af908d52495e3bb240c5b077ff276099656285fa61de49aa3f0674a12500e3
SHA51212b04a1616f06c4f2a97939e1c5e9ab7cf1d5feb46390dea539a88dadc7e0d906b4dca0a7adac51703730d8274f2c9dd30c107dcb974fb32059b679ce17a44cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbe8d3ba16b3135b52f197e3b7934a7c
SHA14fcf2b58b574fd3f40b664e3ee460b918676993d
SHA25697159bfde742461c6c151e82d6a82627b0f9d953fa35d4220a30fb4a6609647c
SHA5124e27bfa0b868b35eb9394a43f837812a66feb67313e7a1724ed59e85ab4d8f6136a244a4817b5d33b545b54053d61cb9ecf539b2f33f1578bef7ef3a5c95e3a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59af5c974f581e4faf8dc8d130dd22703
SHA17a4cf08327c876c404fcffebe281f92819e27b83
SHA256b7d1fca3ee600635e99162087c5056c30b24353443fe4bb1714610a78283b2d5
SHA51274f3806f4f9bf2ba9f1817e3f1aed257883dd8935feed5e1180a7e55395dfdb3bcd6c373a4ebb2d31e338d9821a04597ff3a723da5f1357a962375903314669b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a35194e438805aa0f8b4fa782e096ea
SHA148fc51075cd18ad2beaf37976d333532414a0c1c
SHA256aaae78d9fe724161737f8b32818a0ec9e78ba279b60615764a490ca3866eabc1
SHA5124c1ca7b83af371a5bc087aadd7d915592c045a33a80b81bd4d6d8cc2532790b941b8b5c446d9850f6e2f03d709a50c5bc78ca1b39dc7d0e16333ea15a58fcd07
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b