Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html
-
Size
20KB
-
MD5
da42e4a54ad04940b8a1435b48be5b01
-
SHA1
8d6007f72d9467b3d800a524d076c9bf4ac6a47a
-
SHA256
8c8a14aa67ec6bca40a744a76c3818efa4b500eb709afbdc8d40ba343da6cb89
-
SHA512
b32ce421524e9c8f637a3dbe5b471a276007ea445ffa743a2035096658872cb4eb9f3fd25ce89462c489362409e14ae95540a0d9849f6c3913c212f9e94db597
-
SSDEEP
384:Q2p1O2vzjLMTpNX9COCunWuwQKiKkRK4McQ35LyGuN6hii0apWW8u88Cp:71Ogz/+jX9COCneldDwLySihxRp
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000092e22ed40b98219de367dfbcaa37e6dc2324c657cea83774c220ccd51dec6a24000000000e80000000020000200000004ceade6b4b57cbf0d41f9285026699f784face411287951ff4fccafe7fe7999a9000000086eff0e719fd2dd86f6d393f7d5a886a7bbdfc7c417cb7f5d7a848c8c0fd7ec551e06c8e6262a5f6c3f37fb101049a84bfde4e3aa949e5138383d8aa1d2f07eee8521b48bc101340f48521815fe07ebfc23258e11b6844ab3b9d2b667caebdf691e85af1e6aba82f22bf64fbb1c276fc455d9fb5d324d8be948e57cf6282093af146db868e539f24e8b519f50f6ea53b4000000005bc24de1fd05c7f85d3d45eb4e28be61f6f8ef0f0b2c771dfb7d587ba59efb51413b39b03a7afd8f752bb15e79c9e069848d0e77019582797108428f5c66784 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f515eb3e04db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432216478" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20FFE661-7032-11EF-B956-4E0B11BE40FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ad34879907833a1ac5bac4f2adcea65451d18a8010450287445a9447df33cbd4000000000e800000000200002000000026174aa1daff46a669a126a17122d3508825553d47c7a6bf117c40deff8f37d72000000092d6bee367c11b56a8c68ee6e7982cee17d921b111e586eb39281f3d4980320340000000b3b003c7dc8eddbffc7eb487aaced3b5112fc49af20069cae0e03120b897d5b0d1fa074a7720c27d26503261b6a4b2095871511e37c66b27f7d16b5579a85229 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2952 iexplore.exe 2952 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2820 2952 iexplore.exe 29 PID 2952 wrote to memory of 2820 2952 iexplore.exe 29 PID 2952 wrote to memory of 2820 2952 iexplore.exe 29 PID 2952 wrote to memory of 2820 2952 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570dd108b442fe4d9d43c4c62ba0ffe10
SHA151bd3ef43270d6b9b62d8fb16e7c936e22481a63
SHA256087c7483b05ca27e14e0610e249da49013e7f5c126422072c8f5c77e65f33014
SHA5124ded0eb0d38fafdbd0ae2b7c7e9b1bd8016cc559db274a013373db92badf35a7409351042262f04eb013094c7470611ff986a55deae72dcd11608602616d579c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589ebeb80ae15fa858528e172121d1604
SHA1acfceaa26beb09bcfb573eb243714a697cc76e36
SHA256513991304407763aa6450bee24d773611a837f6a207c2a4601667c0ff42c8932
SHA512119c086cb1e1aa63a2c0dfc26ae093633576618c7f31b89abd824b2a732c33b2db50d5b72850fd071b6142d99666bb9de63ccb19f1d30362103bee9e15df5a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc28dcc7dbe6fadeaa9409d910dc883d
SHA1fe964c490700e4da216c7f6010c47b6185e92e85
SHA256b2aacdc2b360684e840d60f3ff1f88ec094dc869a1ac996dbef9d815eb2f72fe
SHA5129f1e1142973cad13562735fb9061cd4756ff33d2477cb0111fcfea7866cbc8afb51efb759e239b8eb269a637dca97638cb566eabaac808b0641a5253fc0a45f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af86af22b713238df3adfa4b054bb887
SHA1897b7659e0235e19a5f84f8c7a42cd8fbd29923b
SHA256f48b4fc88ac35a7a54dfcc0c65bb26ddd354334797dfd9aedf2a3aab642e3667
SHA512290ef48020bffc22558223dc5240b7439d9a6f5b5b09c453fb5435e9649fc85129603da2acf53e6b4b2db3315b3618bf50feaac19734bb79a5d92dbf45d1a35c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d70076b29bc12cd4ff5469fafe4d188
SHA1aa6f2f038ff707404d1a0ea061aff2d2ae8ce9f1
SHA2567fbd6152a8dc80b5a8a13b10b0a4fd4328e4544e8ae2c441bea5e7658ae798c9
SHA512b0a44c7bcce35730204486997212995d294319d7e8d30d38903155f4f9cd273c39e8d43005b9c55d448d908bbdc19bc4076214d9aa0115a7e54320dc5e653c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f87d7b200d68703efec89a300943ee17
SHA17c375b0b2c80d1834347307327ddb8652f3ab9c9
SHA256283a1c00a52035b81b9266f4c08d094d23a240c21e32239be26718813d2e64c4
SHA5124ced547b05008f802748ac7929bbeaeb5c566e04d556cc40d42c789a830d83169a9e8ee7964acf44f3142d17d56945bdabc3bfd394f7d73ba2150b5cecfa2369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbf2d8e4247f37c1180a09ef9c1df134
SHA1fff1cd77a6b2a73d1b1a456aee5ea5aac65a1444
SHA256bc608aff223da1d286b8272b8fbd873f28f4f69b37ea5c85d170fcdd7c5760a8
SHA512456a10eed2b6c1ef87550a6163298aa44d2dc2377e36b7c2a0b095e2be302b7878364f02f652592c3a07209b53070956d6eb22b7853edd3d9c1506168286de32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef682414bc652051d4268611186c2dd5
SHA1a1a8db4874a4e6af080831fd90460e9b05a0c901
SHA256e3660466f8ff96816e206fea3dc5eabc29f15ddaf9c7ba8f296d7eeb39ba0e5f
SHA5120046c36d40946cde317f965719f216c70cc80644121f053af22e99f15155ec0ec7168d9c69d2a964ef80a2a9ca29ac0b583f2e9d97a618fe0718ad85b702355e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a8813ec37c51c3040733a24b67de064
SHA1be6628d94b59c30ab7bed556d321e70a07532fea
SHA25651380b0ab913d899936da0c57edf3300e79c0f71908e2d1d56909f4fcfbb94ed
SHA512d7c304c9ca45a1b809dc3293531eb80f67f1c374d33774bd9435089c1557ff7c9aa1e7d6b0c6f9e5ea9fcfa5c939a95c377ffd2eafcd38cf56bac4af513e256b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fa33fd880bf06299da7b1b225877f08
SHA17a5a25d63c903b9e24b9d59598b9efc55969023d
SHA256a04dc7658929e2dc68b28ee947064975146a03b967603aca2a29eb61cbcfef28
SHA512d8e1e94fd9542b25b963416dd90d414a3cef7b7e2955a65677ffb0013140cc5d577509a470cf88b8341fdf0907f4b8076956e69355a21bd530af70a8c3e9bd52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59252318b65c6daaa1bf00966ceadaa2f
SHA1c4850577c64c14a2ecd713c883707f0fd3179bdb
SHA2563ff2a1538c5ef44f560a916ff68517177484973d9ed91ca9cbc9a80a34fc3be5
SHA5123205989c3fa88ca75c5fd1dea48d8c65f7591df0297ee2345ef34f9808bf58d0dafb3efe9638b8b78389a5cdd1cde6f112407886d621174276c70854dd2aa6d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5374c8460f77d0daf4107601740817a68
SHA1e94092e27f23ea80a26432dfc407cce9617abc11
SHA256ddfc28bb45c96b684de2917ad624f970633c33532e91101a08fd3eac0212b89a
SHA5129d60ee0e3fcb546842241ed59a0e502c0bfb6a6639ac05c9c32e4e9f3dd172398d2947ec0c97ca8896dd85d52521479c727868ac258a3837e65eea165d99e79c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b2dee454ee51e2b3ead8805c8fa7c8d
SHA1c2b39c9b32761e5a544c68fb1796eea503bacd49
SHA25678103a09cff358d8921b71a33e3699ff00c6276f9745e7a0be405ae5c59f9603
SHA512c17c7bd0ed295a6a28713e767151d3cf9f97d267ff67ae1c2e25c55428543a1206baeb5095b012160aed7f7c96c5c128ecb5ab95ee115f6ddeca94c7b0ee9ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5906e364295f1232999a28475644fe96c
SHA19e52e5fa97a0a56ae9fecbb47666b276868ed336
SHA256049c5f197616de35daf14bbd2881c6935e28d79e556939a6176bee0e45cd1dc6
SHA5125d4e99d5ed6a14adf575f6242b857baed9148655a24cfb7ec889a9bc3d1528e8979f8b439fe9e96c4ac1d1d51ba2c202bfbdc087f6ccd5347799633ece8eb966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584d6a5b951e8303e35f183332dd79eab
SHA1ff916d53871f4eaa21e3d869d2d8ffcb5b9fd7de
SHA25698c69857039087ce757d10f00b343798657e31c30e6d71b6fc2eea0188befc72
SHA5128cf318d833aad700db79078e1b57337083c5c77ccea5846d8d1e38109fccc0d2ef7bbd15c343f529a0337af265668a555321d3dc79561041ccd8d109e4c576ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6a4092515766ba0fb63a68ff7ac10ae
SHA122310aa120b19d9ea0f550de9956fc68dae08e4f
SHA2560bcf2af5559de387129408c260a49446c685491cfa776c2417b71a2a3f6d5462
SHA512f7272f926f1673b9894d8c1f1c6726c0f571a79c6aabe82e0f81f6fad9a6e4fb2234dbd4d117ca20d619ec900ea930c8dc9da1e7d636389aaa98502afd8b017a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb3281a46c6279398ff1adc1dcd56182
SHA16db6027da8e89b2682e96cd3314e73e91e945636
SHA256c3b41b5f6a87bd05c5b659007cc99707806456e089368fca91f9feab807faa6c
SHA5127c8db64cc3a7cc786f2b9eedd21f3841b912ce53fb5e0b8877249e5cde902dc6cdde5628db5476b307192c5e1ccabcfc4be21947821fa1eb8bed4aacca4da2a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f9f143dc9ecee31e44cde95f2e1afaa
SHA129f8d78973cac5c70d605b026e151fcc0e96a8f3
SHA256cb570f72d211924d1a3bd55dd2faf7e7e590d47d890b9261ceb55085a28c89c8
SHA512b8bd04951def303ad857a176bad81d1686454c14681dee42a008fc8601b73221f65b37b93bb6ed718fe57d8ddab3bc84d63b0228eb9d663ad9e61b8a24981346
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b