Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 21:20
Static task
static1
Behavioral task
behavioral1
Sample
d71c4b7fb31830e6bf915434641c1ba5_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d71c4b7fb31830e6bf915434641c1ba5_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d71c4b7fb31830e6bf915434641c1ba5_JaffaCakes118.html
-
Size
1KB
-
MD5
d71c4b7fb31830e6bf915434641c1ba5
-
SHA1
71fe791c0ac7f8abb4a58cfa5d0c8969e619ebc0
-
SHA256
2d085e65943c3fc56f2613d1bac70c6d4429eda7e2ce97c15f22d383f709b4e4
-
SHA512
26cda06126ec91c80237ae994f6f4ef6d5958239d2153a3e2743467165037fdb3c1247032060df231d8c1252bfcd508664fe1c51f7e6c94e235cdb55d6349724
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c1419f4195a0122808f6863e040a50852483f76f6af90da4de9bd3fdcaf8a9cc000000000e8000000002000020000000d1cb39c217e86b95d2a104b5e28e5495d9a16ee703c787796debf70c95d0913220000000e046bfd0a8925464f282e16e3e2cf49a3b1339e6a00806c528e6e5d12715d35b4000000055e3f9ee588b9311294fae3f5210211a72f75c420b7c1b7c44daeb80dc3f62c4a2e1f009c29db474d18db97579689f76a44ec232bf3240846d44c711e15e9a84 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49A68431-6EF1-11EF-8B76-DA2B18D38280} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a36a20fe02db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432078686" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000351f4926f93797b14870bc95873da7b72914672b935ac67dc8e8428a6a281e47000000000e8000000002000020000000904940064df3b829465dc471ec6b427fd1efea3226feb81588b4757efe480b0090000000c6e857a9e8de77d034d0909391cee277e737c3917c5634ab14a02896ea85d884e2cd49054f83aff6bd53e6d6e532d19903cdf02927f124ce7a4c9b7cc98d925352fd1d8e464e335b419960d13dd64590fc3f20269371d2c65a18e2e6e320a5eefba0fbfb25760aade04ee180392a3731bc7912894b5188fe492815ee26719a2d3a0560297b1871a7610d7ee7a034c3d240000000c1dd8766a72b0ccaab324737cbbbb55db7e13ff1771443e69393d1ab14e85b65a84d600e5a37a9417c4a48ffd8a0fde84c9a748414d531b8cb23b4156f00e44e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2488 1700 iexplore.exe 30 PID 1700 wrote to memory of 2488 1700 iexplore.exe 30 PID 1700 wrote to memory of 2488 1700 iexplore.exe 30 PID 1700 wrote to memory of 2488 1700 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d71c4b7fb31830e6bf915434641c1ba5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5ef0951142c509601e24841d90ed46e0c
SHA1c148745e4f8f9172344b50e5e4fbfcea77d9938b
SHA256417a825810a3c733cecbccc9f23766fdc9f635a963e5baa64f5491ffa66acb62
SHA512ea76a95a5408d0252804de38350908332f54b3a35d66bc83eacbb8bddef37369e546fa59a4b68b773aa9d227565f6ea90756f1c8a3122a30226d0afc573d0bd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddfe54176cec9275e0d12df519c691c6
SHA109eedd0b8540570c62b11df0f9f617c98ba11769
SHA256d40b17eaca6c3b75e2ea36d4dcd6da1388d76636000dd7653af5be7d99a7f289
SHA51234615f3b9adbb4bf34067ceedbf8b10c9ba6ee0deab2ee993d2741541e265342f29c35e8ee18307594b237fe07a464377cae6b065a188d281a1ae7610dd53411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e55c8b77a201b82f6a3c59e12fcb94e3
SHA10efbc045c03a9397e9bc849539aed10f7eeac6f8
SHA256c670e0a537b3a9a1d28bf928a10d0c2863403d74e79c1ef9f98990038e319a8b
SHA512a668a1c158bbada2a59332c33697690932d13946f9e0e98221979db55f00fd775a61d14504fa281ec27ac06c7a59110764887399ecf234f0ecb3632c5433aaae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a8b333adf7962187d2d42e5047c6a17
SHA11e2c0edac081250e60200ef3cedd5004e7365982
SHA2561c94b1678183d03cf913a849afbd48664db007f3f679f942fe796a3777cdbed8
SHA5129d144c043f8f199610a6ba6f36b866dff5f7257aebdae63bee61b69711f5185d760382233819891f6b57f82a2ec4a919edb8351baec47730674ca44502615235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edabbfb7282f3425a33376f335ac39a6
SHA17f20d78a22b65a4210d119872a5d7e03d5ca8b0f
SHA256159b21b8249db3e0b38e3035963477d85b86e86660c985e904762f7e4aad8458
SHA51222524a888b05a658a6a8df7225a971bfc8b2059bd2be8371368414165671f3a5fe15baef303b81c8a95ebcd3fb0ab5cd80ff7271d598f226061ca0fced62ddde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c33ebf5f666ad65b992f227a61251580
SHA12674e36e7643124df690ff1ae97007f593a9cf05
SHA2569bb43ad72dcb7aa8a433f8dcb6a47786f596c87982d708192c1e96c844b64501
SHA512728607969d0cb11c3b65dedd7e2c88443b8291a41f55b1058402a3dc990bce41571403a2fd0c7a9fb3f9f5ac58d75696806b4afc8bfe9f101ae4d43fa2d8827e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5959d38b0d05cf4f74d45ed735842d39b
SHA1754ae607fff9020ed353840b6c9d88aa5e69487d
SHA2564bacf805ff954937dbe4b0125093421d3ed6158a30858518a08bec17b898f8a5
SHA5127a21336eb393141edd1cfc9a17ec63a05536de946f81b603ff5f3bafb85a5f7975b2ba3b7de14a9d07559e7d227421f4850a4cc139dafd0b348560b06992cb5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54deb025f9ccf042492a1e42be364eaa8
SHA1d3b5c35c0d5a89b2d3792fbbe2ae4432f2969f47
SHA256090b7d5d7e640ea92567229101c3dd92dc9c866853bfb130a2ffe86e3313b9f6
SHA512cc9b157de91eac3e9a46fb04a8473ad613f15f95db4f2a526ae8c98620d9d7817f72b62e806f5da8c7116d50f0846f79cf1d01b81151e3a03a0ea6f812e5d7bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562ee3140a172a07c0db8cfa5a9ac86ad
SHA13ad2080348cb12c06a63df60de30bdff439fd07f
SHA256daba67c07868725cea717e17852adeee392538a15e9a37c024f94bfc6d0c6546
SHA51220a7f1bbcad9f02e1b8ceed69d53292940a6bac4470486cfa072bd28412a3eb2fa1c5c5570a04bda254c701db6bcdd0da69da8ac6ad7f0752d4935bf2dadd6a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590e8fda2c2c7dec0782c9466495cdef3
SHA1d132e8944a4d49859b7643e8e96ce823c7f78c40
SHA25640fabf9ffe1e193d497e490de24c813f080274c2c7495d1804d56e326ae24e85
SHA51263f6c69579d7b8b82763599ac21364d7a560b12b791fd7c6e475b9785d00ac233b1052b82875c64974db1b6e7652db967e79a42e546098d282e253f4802b2c29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5cd40c99a2a0d918e9f09a7c5c2638d6a
SHA11f804b35fd124db3c283b93bb4f375e0872dfbe0
SHA2562c7a81ea7a9a5b8ac1e3f74e123a2bfff975e4ca2969c2875db65cc1924b881b
SHA512c344256f27b35d1109db90d49cb603f28c6648615f800d86b5ee5644000ba88ee6d911f945d9385fbd5b9206198fc5b8d90b800cf7771cac5f5d84beccae6023
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b