Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
d6db9f8f91e13e3f4c0f3d4ddcb98c41_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6db9f8f91e13e3f4c0f3d4ddcb98c41_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d6db9f8f91e13e3f4c0f3d4ddcb98c41_JaffaCakes118.html
-
Size
4KB
-
MD5
d6db9f8f91e13e3f4c0f3d4ddcb98c41
-
SHA1
a62347ea6ca513333060eb740f2ad4ec4711ddaf
-
SHA256
88e16f1aeb78a6d4a5ba72b56d4593ade216ff5663e4f064f59626e169a945e3
-
SHA512
71fa661254a56b3a7506276033987c083878d677436f72572c33af989b0fe81f2c59d9379ded4bf367b8d444730cfe1b52d15285853d947e7d74553b5773eb68
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ohyd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a0c451e455fa538e8888bbb7042aa96f85ce7888f58e20b61921ef6ceb85ae81000000000e8000000002000020000000eb11f9639cf208f3210cdd57603f56586a246d1f6b47ec39c86a7384c3c100772000000043cfda7bb0ef2a568f874c05d5b3985140f90184e3c273bde2e175caac7278b340000000616b1fbe17c82b1151d9c571943a197ab1d2e3b798ab589a8dea5f1e8424b4cc5c7d39dad79674d6d4006cbb27c673c2287a47daf745e57b5fb65a324ea4ad89 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9EA2921-6ED7-11EF-9F10-C28ADB222BBA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c56cbee402db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000006a3d314f043b999e5f6e7393a5172c3b21aa14a86009a3db546dcdc58294f3ae000000000e8000000002000020000000b3ddd2ebb0974550a18d0b6834fa8a3a6a903835df5fc3f22bbcd66fe146473090000000bbcc12c90d6543c9bda244d284bb047329fa69d00fc5983a574f8cdcb73bec34cc917ae5ef59104311525e3b99dd62276fdd9de8db493820eaf7ad8c50d4e99a27c3ac9f0dca201accf9b9efbd46922527048e8750cf736ac91602a1876546379d1aae1ded2e29c0bc4454da40e885764f9b283f3ee07dd5cb3267c99a60446df5fb77f2ae48d80245427f03f261eac540000000b666356da861443e4c73c0e797a57114a964d74ad527bc76a507f539c53ea37c79519636af9bcf8b6d91a0713a40c52ace5371697845e52d778ccc8fb6440d6b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432067777" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1032 iexplore.exe 1032 iexplore.exe 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1032 wrote to memory of 2052 1032 iexplore.exe 28 PID 1032 wrote to memory of 2052 1032 iexplore.exe 28 PID 1032 wrote to memory of 2052 1032 iexplore.exe 28 PID 1032 wrote to memory of 2052 1032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6db9f8f91e13e3f4c0f3d4ddcb98c41_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b37e4295356b1481059b055139594fa7
SHA1383c88eb75aca182b01f0acb5d30ea5f02f786d1
SHA2569e9ece302554a59085ae59a63967892cde0997b790fc72ebd952b3539ea3cfea
SHA5123e1853b2ab57f8d286272b2619189e7922d45c4b4ccfd9b895ec171dcad89117daa3857ae614ca9da4a29a79f3c920a469ca9e2f328d70cb850c5ba7625f4619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52da508adfd3e84ecfc0c19428796ca4c
SHA155289d80ac5429b7a3ae679ad0f9242be3cae056
SHA256003379ed26ae6e02697c24cbb7fd27ea62aa4e5fa7718284dfa7b9b38a7be7fe
SHA51239d9cac16e9679f4a5f647f9c8fc5da5e92a1f39f9bc74c023b67bae50f57fbdee3a6f2a3bf4848f6eba24bed01b0aa41e5cff77d731c3360cd0161ef564d17b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eeba41c78379e54807c1cb928749d73e
SHA1ad7fd8a3af9d364e3a5608f5270bde40fb496491
SHA256efe77d1e580292b7014308f39299e6a3419cf395ef54373e39cb7db76a284b1c
SHA51256529e1b62264db653856231785f90370c284465c64b8e4182333445b2014a7df31e5203d68e7c8e9e69bbf9ca7326949cf73ca77594071f2ab8cd3e21868a61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52610c85c2715522a93ce2bbdb9c5c2ec
SHA1bf81536123f2c98592b180bf5d6a7732242a67df
SHA256ccb2fea8b686a490b5adf4c679bc8e5b08972efbeff180c0c10e7c0b3a163100
SHA51251586562a3062daa9d0bbde07fb005942c244b3352ea26d284c09e14397ad28d3c1e85232aebef6b39e89c8863fb6400becdf27a4f3697edefa04d5bf023d865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522aa21c06d0ef8ea6bfddae493ba24b5
SHA1e49fa6a49295c9c447409cd7367b078231bad5d8
SHA25635ea7d1d72fa5eb4a5a5b0f581718a1b505af6203acbc7bb4780ad24f851d07a
SHA512d060787069b35ef1fd782f2c2c2163cbbeff8add10666a6f2311cb345292218b7f24462f8c1d631070b591a6ee614de037a1fd0dd578c188e20469a29bf95d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571dc49782e255dc64b498670786bd60e
SHA12a30b004f3de02cbd4eb9d28d86f2bbcf3a2ddcf
SHA25621e4195271c05da49d44cf425773dc0252d33816d4a290f2ca0c202a73c82375
SHA512469716ffae65af48f198cd00639360854ec32a73c041245c49e47e55ffb2d544390997f3f7264a2a06d8866513c0ee4b0935b2d678bc15a44ed2c8c789c4c4fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c492d22d078563243d51cb72c141b172
SHA1bfeaa0427b7da9db93697cee74e46af6e19b441e
SHA2569dc8652794fb82cd664ede2e072cb501fa681b516705a404a54360c98c23b114
SHA512edcaca82537366200e9d4f985cca6f606370361752709361d0975849227b6761772a71c9e7e3bc622af9055a4a1fff5767028bc64ca3c6d5dfc25170e659e6f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a74eafed8e5790b72f328ab51d050be
SHA1e68f16b5f2fcf5b10db93e7909ac49c168d8d37f
SHA256fa196110bb5e614dba45768e4cd3f9af8a54714437dfb8d9d5368ca22e046d02
SHA512c5528427ea9683cd0cc6b6bbd60fa857b0ba4c942afc3610f675b422d69bf9dd7f56850864261069f260334bc9aecd96062b04b2b895b5b94a4f8791b2a34f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5066718e6d0b1a5600432966c4698f967
SHA1038a60e4cdbdcb7a8ac94319200df21b469357f6
SHA256ed1af4d475f266741080853bf6795a9c505ba30ad2f9c4895e5588256229a90a
SHA512eea3f832630fd82a657a1c903445e48d5ee4ac00f64cfee33ea58d4293b1a86e91dd26e68a4bd3972c135f30e378547b6004f9285250a10e5354e3ba5214d251
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae4aed89c4aa87a52061718508860d17
SHA1e49d2e7fa375becacdfe8260e7487ffc0b06cf7c
SHA256ed5dfd5258981adf3cee5d125219af8e6f81ad02001c9604aaff396f4b2ca6fa
SHA5124ab07eafae23dcd84497876e2efe1a6e4c684b7487c5bf411a7f606684f5fd20799ec036019acab6207478cd37727388ba67066137b328f87062de882ec270ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596a01d4cb806e8376ca83eb8f03a551a
SHA16979d2ed971c078a95c126daceddd1e6c97b02bc
SHA25678484466e737db02858fdb2ca37dfaa871a821ecacce1b1841478437cc6fb495
SHA5121d023eeb3704e63e32e25fe6264e6814c5cf7a180549337b2100995a5183f45d72ccf4a9d6587a170e892e9fbb35abe1fbb3cdbb30773d04d71f450aa43357e3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b