Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
db6044216b52d69f7bab19339bf6729b_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db6044216b52d69f7bab19339bf6729b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
db6044216b52d69f7bab19339bf6729b_JaffaCakes118.html
-
Size
4KB
-
MD5
db6044216b52d69f7bab19339bf6729b
-
SHA1
c2db7b2d91c0b68043683c9c0660f87bacdafe49
-
SHA256
b9713aee84650a8c9e93a5c4ead6d438d9f55c4e0321e7ad0d06c5bb251f0645
-
SHA512
796c0febecaa49a8d7e925b23b4238e14281db78122f8ab895379d18263bf0ab1abde7ad490245d4aeef9dcb923b369d30e9ccef57a6e16d3c205121f0bb162e
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oLKd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432257411" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000007482c72efac6c0d717996d2a01f6c74c8acd2310b6da9d44aa76ad326f70ae5000000000e80000000020000200000004a36391d591d65ce82b0d158ee6d30f53d3063ca6bb0188f8f2cb332ff2b5871200000007c4d86168cd7552e85b61cf2de26ea82a6428b6eaa2499a376575c01cddff79a40000000e56c0f6004714cb59cb5ee032d37e7a598c95e5855561ab4d2f1075a9c6527a1c271a7a55b54cb59add767dca95c5c3d637f0e9db919d54e4d58ba5bab0a0651 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{709860D1-7091-11EF-B60D-EAF82BEC9AF0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703621459e04db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000004d086eabece058c96e9a16dc15c5d00302d9317347e7f6805284c5e00f297a93000000000e800000000200002000000046f586d3f1ad19456f536fed09b2cb4df7f94462b959ac8584741752c9e3eff990000000bec971c3178b1f2545d00177464695ff063f6dd5ac0f2380ba1384fb3704769b4fcf758132aca0e6c914b71f3891957b857784717927cc8945bca6ecd168adab6595ad5dc1b80c69f365858dff6ee26746391173b6da69323b0d584ed650160a10048c676eac834265f21d29936fb6722cedd6d9c3e3f0599874b655596b43e49885335f285c9aa6955a4c501f69f09f40000000063b935eaa2f5fe9721f756023e7d69fa531ec9842885f9d62d5588d105e60588995e9edaf6b6bb1e5d3f3ac7851c7c15a41515bae4feef5bdff8c3a0191a24f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2404 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2404 iexplore.exe 2404 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2368 2404 iexplore.exe 30 PID 2404 wrote to memory of 2368 2404 iexplore.exe 30 PID 2404 wrote to memory of 2368 2404 iexplore.exe 30 PID 2404 wrote to memory of 2368 2404 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db6044216b52d69f7bab19339bf6729b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5547b83f6ebc6c588b7c8faa4d23f2590
SHA1395ace2260c822afbc7cf820154e39ad451f33ec
SHA256a5cddf859556f01b62196f08b3bf3abbb766f67bbdc9d046d8a12205abef123c
SHA512cdedc7f16c8d9b3f0e106859eab9c01c8c7635a0d38240be7f2b5060a66478f4ad6efb83afd6a0d12dd2d78e1f7332ba07e4d7391685ffcd64369f491fc0d1c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53866256e1d47e75f39c1b07048c2f4f7
SHA13c955b57faefd079d793a6f2e62a373679e5566b
SHA256952e2b45b8b82fb225ae778ba95c82c1928e17668475dfa6e40d326986fcd2b1
SHA512d1a0ec7bd99ebf41c5c6aefd7c40f0ebf33c461e020dca69212b267e739406fd174fef51976091663a294f30444221259915dfc1aff98af0b9384e62574994de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510345bf4dcf82a6f724f420d7df689fa
SHA100302245990514e7cefc76375050eea52d5739cf
SHA256e1da4f5cb1ef73ae4010c3a003720c9555c861fd1db209d7ab936ab259040fb1
SHA5126c8f2d9216320fb013ea84da33b966587d22135d581dc4a590f9c2645850e8bcb75917fac488ada6e41dffec268d1154895e5cc0823b8af36d57e906674f3b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cd09c97831844dc484b62b50fd45492
SHA15d742f74e4c828ae5820d6cf504641428b2ad413
SHA256bb61d22f31e7c914eb9eb2fd0963259ba3ac743f3620c7ae4e2e4036b74d6bad
SHA5122d7eafbee58c8e6c6b28784884c9fae98bdd8126b07cead68d959f2498d40b5b9ea60958deacc7408378ad95509ab4d72e3f341bd4e3ba15d7360a0cecd3cda8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c2324766aa9d6bfcdcd6aefc11ce2dc
SHA1fca24f7928805dad534e2c73db4ea6836a2bd035
SHA2563e8437bebeae7d6a294de75aba038e9533cba25f49c3d147e36ff1ef43d7aee3
SHA512d2225eda0371e8d162cfccf12420e12961e13c8ce3117c30320f0c335ec84ba1f98ec3d0d8ed9cf886a70166f57f46b7087febe7347046824db4d796506c2ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feb7634aa71ba47e503fe1f929bf5cb6
SHA16f04b28522187081f4dfdcceab718a891393a338
SHA256b08535d33c5261867ecbc72a5238da1064c1f863fa0c8469b74d7cf83773300d
SHA512a8abf242fa6e519327f7842b88ef2dc0853d628b35481676803bc21ae43fc5b5ef3ac599ca37b3f8b1e7375eb0306cd6a9963735b991fc008d0a75cbf561ee87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546b4ffd7ebdcdfd38c427c8025dd3c54
SHA1623ce32142714a30641bc813fa180211b05451eb
SHA2560ea2dd8244ac6b5b7b5cd97918ae0283d21cfc8629d636115c8f95ce1b9ee5fa
SHA5120ac9e7b8461e56e6ad3d83637aeba5a976890c08ba214b9a95280fbb3e6740589eae82f077957a6cfcacd61a23b7c276abeb581c27298d70aa7bbd3aac03599d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edf80fdf117a05503b351357b9566803
SHA179110a67665ae0c786baff62282541c1e82d5d22
SHA256acf0d22edc4777f81ccfe1b62e430103384b84833d1addb69bc817cbc1e53ab8
SHA5124a4c4c8cf3665d1063b9158342c58fcb0b7d9f6dda34bd382680a2e0928a1c76186cf4b296b7151e54683643d95ca9126ee71bfac014e710bac60cfd43441073
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584f1c6d79e5a3244a4f6aaaee377bced
SHA1a070d8b7079b8147afda164e3a99a1bf9ba489a0
SHA256b01ab0d0ffbc0081ffc51346d82a4488c74ba93e7d27b68d8630a9e5bac84874
SHA5123faf855105c61d44ed221bf17805a48e48457e3820b9fb698b43715a7145189becabde66e0cb74261ee965bfb26eb4d4fb1b6be17b3ba2b1675a398e304140d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f6491c1a947ae18dceab1dfba9f9d32
SHA17f89248b34f3c14de9ff466b54f67ffb66b1e1f1
SHA25653796b10d145a8c4d2121c5e128a31839d3e58b5b88cd0887f52f0e289d41b62
SHA5124973b976358655ff8be0816c7469caf31a7c8155277c39634be3507d7b869455fd1d0a2569f2ef806954c03225ab6ef54214c1137821005000ee700fb33e78dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500e95451ca1248d62166b5524e65476b
SHA1747c9da86ada7f5cd642459bf2f9ba4229ae9121
SHA25683d48d8a865e0ebb3319ab052a19a8aefa78998aa6547d9fbbf4ac65ebe01fb2
SHA512b889775e4bb9501c9db1ee92402a1f18e40753278255dfb4d8b1483014858d1dfce952c857809cf868961ff1f409f6fa11793eecfa61ca88c171de82cde8f31b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506473bd8d7e4f04cc0e162464951c78a
SHA1e65c3469d0f78f40fa0eaa866c260a90ce25efd0
SHA256ae559b46dc70acedc6af3b7dc4e8c67eb81cfc1877c22a031911d8a88349c201
SHA51219856a21a23e75f721fe288c3c921ad97b5f8280a0b7e0f45b7e6d9784bb1cfadd782a6fe8651db769febdb80548c6bfe1c95e071c38b02342a755404071129f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddcc83d168136e7480bf178a5b992c93
SHA1d4843d9e5d32a3beaac83e66a658d079feb581dc
SHA2564f67e00e31d5ac9e36d0b79a91c401a7c5e152435a5c1ffa63458bf24de0d0b5
SHA512b457253988e723fd0858883bea5bfbb1f7aeaa62d5872c4c400e909c893811cacfbb31e753f32c94828bb4fb0aaf291fad604dc7514294e542dc0d2e64fda32c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7d46a1d7cfa1e39b97f76dff148cd72
SHA16670a86a80bd5f396ba32539d3681dcb8e495393
SHA25609b30d52722c21bb881320d859e165c024f4ac3c1db18c517c8e6ac0c93152f2
SHA5124eab8354cea2beffd88b4503b99b318ac64884bfed20ca87eae4144941f253879ceae9bcca90921f77e6a16f7164b1ff9dd567f1c309f0f93e6844b9a9db6282
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b