Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
d682d695487de126481f8a21482389ee_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d682d695487de126481f8a21482389ee_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d682d695487de126481f8a21482389ee_JaffaCakes118.html
-
Size
140KB
-
MD5
d682d695487de126481f8a21482389ee
-
SHA1
45f551daa06a169137fec025eda00541cf806c95
-
SHA256
b08bfa2a2c8cdf24982c2981db0adc7675df8786b1b30361e36d8f6f7864cec3
-
SHA512
13e85d01e22fbc7d63cd3acc4dc8740c0c2f6d0645163ef5cdaec17f54fee6fd0b5b43313095b530a5e86d72569c44a292728a9e0e6091e496a1dc0a06c5adb4
-
SSDEEP
1536:S4lt9DrBFF38xlpy/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:S4lLvtyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004551146c0512a5c3cc86c5d07b5ff5cf50809ee4fb706d929d8698e5acf1a6e3000000000e80000000020000200000005055b82793e2d3d2ba9092c98f2b9d8389076e1d1329ffacd1bd2d7613677a409000000044bb89cde385b9829ad0033ad9de1703edf549cf39ac0e679a5363bb3c3100fff766e3bbcf846c044d8ece77e38f5a88f8d25369bcae7489dbf2f13489d4db85c7e83018cb339948b6d4f1e3f5c1399d25e061820f4ccc0106ca2957e12b1a6243d3eb20d443b04ebbe1e0d79d8c9b7ffdc960905c4e9b2b93a079d66a6e7368608450ee422f467e79ba5b8dd05661b5400000007818b598189c9b9d9d3df73783cf5cd2203aa4807435b497a5c81b6feaea75d1b13332c2d5b6d8ecd347e980abaa71df13170c713218d87d6ed43c6642a727af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432054212" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007a7c450c0aadc7144207ecbf88d61416841c9783d245c33eea97e5ff5f09d9d5000000000e8000000002000020000000109ef122a9495af208a96eb989595dc8b46e1c902127dd21348f1b789713a617200000003c7481255a72957bcd10355f3766093f981c40dab151194378b0bbe02401744a40000000d8d5f15c77d84d1ca6261f66b28beb77055cfcd7846c5f9a73c79911a7e56cea188aa36436a4e0e838ebee6f58e194f64647e4764c711baac9d0f6e15d9146d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5193F6C1-6EB8-11EF-91DA-667598992E52} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e006e566c502db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1296 iexplore.exe 1296 iexplore.exe 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1296 wrote to memory of 1928 1296 iexplore.exe 30 PID 1296 wrote to memory of 1928 1296 iexplore.exe 30 PID 1296 wrote to memory of 1928 1296 iexplore.exe 30 PID 1296 wrote to memory of 1928 1296 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d682d695487de126481f8a21482389ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587234253ac63498b86f9f9b8f9594770
SHA1552191f9810b65f0bcc56bea1302e875f329b721
SHA2561e81a5c803f3d8f9ec8701bc20f910c924f66cd63fc32ca52460638f724a985a
SHA5121faf821fcc08b314c0e8b9b11a77e96eaffe981e91b8acccac402e0f39c50557d2c1b6d6249ed4e4dc2e0f76c1fcc177da67a7da17bc79c59d342178c3249161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d23096334044c33084da5e7d6df12dd4
SHA1b65040c46f5e207152dcb42717d4ad72b4520b75
SHA256cbd5c44b69e8040852bd33112f3eefd0cab2b19d470c7274be763fc854ed42ab
SHA512b0ad0ae84ffc4e23cd99e746805aa8bef617b5a4b32b6a2077eed16869a92fcbc80d884404648dae33c506dbc2ee3f69dd2a3d436ac53343223e9c284241a3c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b672da770f72794cfe59cd5032bf14db
SHA1f691127fa75c138555951be84cb00fae5a09d426
SHA256c5299b41e0ac3b79a6eaba00c349068535b4eb0969cf51b4e90b112a49094a40
SHA5125195e529d0dd8c2fe4675ecbc2183dd2ed31d7b0cd71d1d82e368c707c08dfb20b5abb5af3e05a4c75b235aecee0cbea18af112d1ea3917861b906f65b3c4815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560fe69c624b0c36979e85931fb52e8ae
SHA1097614b70b05e07180e8b19f726e895348f681fe
SHA256a4775a42bfb98213d58c58cc0ba154362edf8d450c3364ac547a5680be00aed4
SHA5122d6d688c37fad3b61005c8d2545a9a48e5031a6e24cf1d90fbc98fbaac024dd2ed18cf19ee95896f4fd21b447d9e89b86f46897d5989a7c14b21fcfaa1b2ef94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ecdf7e77dbab5ed1cb367b826b18dbb
SHA1f7407f52d0f2f76053bb3e7f508cae3e3db3381d
SHA256de3fc4bec816c80633bb6767c5df6d307e99ce87d9afd8797ab9170d23974dc8
SHA51235403d6c5b37d9a4a00c4a4706814c9f3e18ba52f0c5ae07fe02bdf2a3a2b0d51e3ce5b8e4be2ea0661d8049c6b9a662cdea35adba1bbdffd0e61403f4587620
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528cee4367199a75803533f6fb5b5ecbd
SHA166c96c11a45ef6da726a82db978b40d5b3b25626
SHA256d0ddc937d8fbcc13d7ec8ebc6f228d2937dc7b0fd733d41c9fac9edd01025823
SHA51269c0f7e63ec0881f2244c23bf98819efa75da4693d7092f60bc09ce9f29120d229aace6760248256b38d1b00cdc0e1572c69a677f62bb26da3139e7023c06415
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2bc0b90dfe17eb76cc545abcca88ab6
SHA17da6aa877cfb1b6712ab086a28dd4677fb2f57d9
SHA256d8384381b1daf84ba05d1231bfa218970fc51a587f099ee3b147e5bf4ac31d46
SHA512633e8adc0953219c2d548a825bdaa020a4766e950df0e03ed3c9c70c0a70e937a1d617466d6a2720148bdd312d057a03a15cb4b85a6cdb24b05c218f54f3bf10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5520c8d9eff03a03b1bafec6830ad763c
SHA19f6cc56171fcf73203b214ccbfd110b3d130df6a
SHA25658d6a5d0aaac9287c5d020e67d9e1d805e1dafe463bda1cf7fe144b819078494
SHA5129b7d6af1b73d5abfaf643da2e09313f00bdc993db24dd18a5a5980093af4bb0c247dc2f344d1a902142241f999f1a21838157b8452835b7b9c339ca953a7c458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f73d1ef8e84bea614d90b16b3de0d010
SHA1e8b08898f4ac32ae8526fe8e018cedb49d9f1989
SHA256406033238bd33a796d031d163997329afc770c535f421a6ad5c121f564c1cbcc
SHA512b86ad8cedc068f6b880bacc7b81bb88f7b5662e6ed85db55932e51c60159a85b67dd064fafbd19df721c83dc74edd01796f4acfb2998889163dbb59d47a545dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c326515160855df94f2e7a9011fbdff
SHA1a673ad096a29dfb5e9b6a92af7e9a9c357743685
SHA25606737520eed35fe65e61303e13032283f3d9b5bae7e34d6af2274a6041dd7ebe
SHA51205609a75c59e9156c3b7d3c8279caf66748fd36611b6d49c68e83f03b89fe27a773b0b8edffc85387ff925d022ab62dcc95f3a4a87af5d3c0308e4028f1e4d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b235ad2438ac1e7f7d2a8a1bc4c7bce
SHA18e5caabdee6da6215429a8016e80595255abf84f
SHA25671724b26231565f530a7edc12d98d320f31be8247aa07968e64d45dd999d169d
SHA512c1f882711afe03f0c3cf7aafd228dcfdd74bb1d47e980599ac9df4fa91d3c223797e78daefa0edd40d926fe465c8ca263597223b2bfb7c28e48cf394b7804bce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bb1f768ec116c0dfa0631e4f37ee1b2
SHA155d119038968029786429c5d2237f87051c04a2a
SHA25619e8d80c6193dabb1c1a7d2475784da72e53854478b8f8f5fdc1e5a2e6e83131
SHA5120d4a8f865fa34d3aafe07eeaaa2c1925807bfd74604a00569928b94fcf6413f161722af40a3bdacdacd5a4f1a3c4376d673e2943bbdfbe76e32c2ed8d3835a43
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\ads[1].htm
Filesize114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b