Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
dabde779834c0f744ec38e28d3078e25_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dabde779834c0f744ec38e28d3078e25_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dabde779834c0f744ec38e28d3078e25_JaffaCakes118.html
-
Size
310KB
-
MD5
dabde779834c0f744ec38e28d3078e25
-
SHA1
16bf4fc200b8e295760d6eed313f87b2499798d9
-
SHA256
ff7e432a72082037881200ba98482a2e9d14a1bb26ecde82e7ec35a2fed5d843
-
SHA512
13b5dc9ffd140d4dae1adcca87d77206f24c879b163e59c19278368a0173183ba88cb145988ab35d07b5aa5335dd820fea751412791c1cfe840473005f1edbf6
-
SSDEEP
3072:O5W4+39GLrzfbqoXQhFnSzrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:VNMXz9VxLY7iAVLTBQJl/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432233395" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81304FD1-7059-11EF-8650-76B5B9884319} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3068 iexplore.exe 3068 iexplore.exe 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2008 3068 iexplore.exe 30 PID 3068 wrote to memory of 2008 3068 iexplore.exe 30 PID 3068 wrote to memory of 2008 3068 iexplore.exe 30 PID 3068 wrote to memory of 2008 3068 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dabde779834c0f744ec38e28d3078e25_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD585cfc4f82263c8c7c5fe10cfd4d4124f
SHA1caec2029e3b24e8f771ba679b7ddbcc8fb2af453
SHA2564d5ce3fd474d83e08ccb4e557ef191fd2f137c5fcb2b2419ea168463937adfae
SHA512309bd86c8fcd74524f74d1a63339b4e8d9eb82a5928b79346f358f9d1e8606c7213f3293b53b5db23bbf67c442c84de4b18b5284604b3f1260f1623e6310cb4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584266330a26c8503a1a04d3d1ba7fa7e
SHA1fe38654c75258e315526d65080a382addc7507f4
SHA256d07d90420ebddb5afe87dcaf2e4d102ce8e255d120c2b84974482d4de543a93f
SHA5124eaa44af99cec299dfb6cffab159b2adf57655648cf430481fc9c3b486a0966dd7679a1a3674865acf86d6a06bf1955e9ed16e9b71dca9ae11df3a067bf05c4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc8f3b5e45dd7c42f1edc9cd34509407
SHA1bf0a4bfc765635b290aa97d9a05fb9444eb3a84e
SHA25689e6db3bf66c1770172ab834169b4a81a560248777141c27bd8973fede4b52f7
SHA512407a57a06240186ffaaf213183e1803274a0bd49db54cf10510e41b14696560f7216c07fd778d9b8daa714345429cc460fac2476004ef74bc78b7cbbdfd38320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5574843337872b5f58744f445832d256a
SHA1b57b5ee3b7680180c9e57d5646833e2261c675b0
SHA256266fdded166fb899c85b3caae4f0bd0bab626555d16803fd2b343ecae089342b
SHA51278248d387f6005d4b201fee5b7792f0e02f8353f30960cb644ca829fcc3795c7e98ca72ee3a4e1859b9d04ed72a8282b5d7483f72e980d7971dd195425118c82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e8f3f623e80b4f62d2dcd5bc5a0acd0
SHA1b6d1a55f76d90c7d776dfb1504aaa815f8d6a40b
SHA2561e5ed443a7057e0ec40a955caf4bdffca5d680254ad22ec1c01c102777a08360
SHA512991ff99b7728fcfc663b0eed9db07f70e1a5310284793855b3c5c1a8e1c6f8dad50500d693ceec0ec254d39bb7d494397670b0f7367c789d9972547910badbf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556d1cea37ebf27c4e0feca510fd3ba22
SHA1ff52db46dfc1466b52c083dd8b5ef5b8e7913b45
SHA25637306a3bf7bf875cf803882581ece0aaf29c1a59e2796620d27c682837c56d86
SHA512afa8a44b55d2edc90353d3b7262376136700a0ce64371f42d3a7cd78b8385ff87c593d4871db7113a77d842696d654d7a8819e0f08ccaad778b033de509ee070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f4507aed21feb146d6397b1d5bdd76f2
SHA1f811c2f33299eab7a61c16c026dde82d547785fe
SHA256809379c9818f2ff893a01f989c6c6dce70ebe0f9a98856092b4e12d226853de3
SHA5129a1657273098fc74588afffd47d01fc7bdaa0e16459bff5dfc855af467aa89aa4c5408542c94024f3b151c72fc6e0709412b8e3302f11e1d974a512ccba8ea62
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b