Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
db2f002c1e4c3134052d0fe3f63f2903_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db2f002c1e4c3134052d0fe3f63f2903_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
db2f002c1e4c3134052d0fe3f63f2903_JaffaCakes118.html
-
Size
53KB
-
MD5
db2f002c1e4c3134052d0fe3f63f2903
-
SHA1
bd4cdbb53dd78d8cdf98ea7dbc08bcd6d5987a1a
-
SHA256
178edf1a4771dc1b265399518629f72e6664fb6cf8fc3d633f5369b3b666011b
-
SHA512
07824c2925567838066b64941982714314c070b133a664506619901a44c361302b8b2b61589d8d7db260fd46f4253a5f2bf91a27e4435e4c4e1e92394e639e56
-
SSDEEP
768:GgOriWNcaSoagG5m7ZNeFLvDvhARQCBeDkDwSIBT2SiS:x/7m76zOFIBH
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000665ba534f570669c9758173b2530988ee194e8c943513dc0172a40001e33236d000000000e8000000002000020000000d8cbcbf41df983d720578dc2fb62625442ba9a4117de35ac40444777ad89b03520000000b9191df41252ece47583fedfa324c990be166ff6900cf649dbdc33a29b61fdb3400000008c2839824de886ed1b2333130c3a2ebc74b5e80c5c7f5109de22bf317a1af90d5990fc28eee20ae7f883bdb31025606918dce5e70a12e3cc39fc9250001cf6a2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94986BF1-707E-11EF-B57C-E61828AB23DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432249313" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0cdaa6c8b04db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000019ce9f0ef666c16e33cf9789ca6b4bdba6b791717b33bbdd4e4e7e13db20034b000000000e800000000200002000000050a45dd52cb8347c2da4745df47ed2e809155cab4ef788be5ae936c736ae29fa9000000096713e698bb213114ac36ab6365232437e72d05449f6afb8d27bb2c4c1aa37710025475cbf4a8154ab83fdb411e3925e929ef2869971573d0326724dc878a28c89432123682acaf718f91f2cd226304ac126b4cca2ad80ac5cb88373115c2697d88b38859c1632013f41816f2b528df72db9354d24ed35f2583d0cca5423e7acdb9acf27a0cce9aa8469cc34c73c720b400000007206586b6012d54f1f5887a6ddc474448f4f7171462934791a4b726d83006f016f309b513eccc51988664267843671f817a017699d6261a969cf159ae8be3525 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2532 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2532 iexplore.exe 2532 iexplore.exe 1992 IEXPLORE.EXE 1992 IEXPLORE.EXE 1992 IEXPLORE.EXE 1992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1992 2532 iexplore.exe 30 PID 2532 wrote to memory of 1992 2532 iexplore.exe 30 PID 2532 wrote to memory of 1992 2532 iexplore.exe 30 PID 2532 wrote to memory of 1992 2532 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db2f002c1e4c3134052d0fe3f63f2903_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e6dea5960edf2a104f6faa6decea498
SHA1b487a05a939c9828e89204c004ce35ca5ad042b9
SHA2565d7336b265aa87a227a68e46c2bec5de038390a08f96a996067936d2e2ac8559
SHA512f98ab99bcde8528ec8aa360ccbb27de193ee47b0878d9483f8eafd1ec8710d995fa134381498914b73ab5e3efa5ca4c8c77c9cc3dbfd1777ba7c1b1495be6ab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da029e97fc595c278e6b560a0e6f7b6e
SHA17e84bacf6f6e2afd9e124df7cd02ed4d10cdd331
SHA2567d3ecf59061fcf23d90a27012e5e67f55b0ab5fe742eadf8121eb70de347ed5f
SHA51294dd3de4c77228b1496006f2587adadfe6f0b17e67c98292e76de9a0ec323a737b8c105bfa48012b3fa700af571dd75e568647112314b060c08a37512159eef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cddc979019038a7bedf3f88f4e35dc9
SHA111c12494f5adc4ee67440047533986cf36e24748
SHA2560f7b2165a3396ecfdb147e4e1344f390d931b8e07ed6319d85407ae86aad9e29
SHA512f436dfab42f645ff2f1ac7bea764897b3f1d8a05ca148077908251ae43d7862b79b269a78988a2e02ad04367cfe98cfd1af42851589747a6c9d2d5b2c70e3023
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571d320472f63d58be5551f980d009320
SHA1d57ef669ad4119d1cbc21f5a0eb62b21eaefae48
SHA256f03e75113eed5202f67f7bc34358c62e1f1fa045db152223894c2aa2d42d65e3
SHA51298c5c4512078aed2c1a30c5f2c4080396f48af37258829a730df2647865d151ec5ac19bbbeda37c5bde555b093a139964b948307e0020906f3bca88f1d3cb83f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4c5bc58a99ade059dcb70f1b1a9fa73
SHA1c38aaf4b89be0dea78d0286fb634fbd63e643bcd
SHA2565fe9c598e87b9ea507484aff0680f28f8153bf276987e132860b374be6424e75
SHA51277b6f87779aa3ae7a0c6e3b4dcfe16189ea43dc06b98af97057eb1fcd959cde99d1f187b88515774825d101cfc1f7b4fe3bfe135134659fe8e2e6a4cce247ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe9a8dc19148c1578678aca9ccaceabf
SHA18f183cd303ea03cff3253adcd10673ef94f157b3
SHA256687d6e6f858809f4ec6db1df5b1d04856432b9a09b2ceddb72baf3c79ce361ce
SHA512055e430d05b07e1c23c778e9425e9b8af7b424531e1671bcb9398f3178f19022b542f20ec15fdc93776b264e982ef7b6eb153add41eeae26a519ff212309212c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560234d506c14dc123d0b8676503f5c53
SHA1b4a84ac77375ac5f83adb3b9451158ed15a4f884
SHA256427116393b40ad5d500ca522c90070a6bb35baf4530cf2069b65378e5b5ae476
SHA512b38d2caf37275443555f2d27129c7cbe8911de72e1f60273283fe1ea451ff23b689a2f69cd6dbeff9ebf7ac82c7a2296cc28d865727a5eacbe30fd3b6482ecaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac700c56080f1418b4f29dd36b4b5356
SHA192aed798eb0b091da0dda8a663b45be29031e545
SHA2561c6bdc47c4a2448f3654129150a5ea65c34afdbb12408b2ab8bf8e69d2ba1c53
SHA51226606fb531e059a26e7946ddc89379144d8819c2a3aa4ba3650a9aac2ea68fbcdbf714fa06680dd3fc55051e4f4c386bb0afb0ca901542a3711a49e1150d8aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d72e8a71a65044f9bbb7359cbef11100
SHA159b8abe266cd7ff2349ad52bcfb572041321fcf8
SHA2562863a03a47b9b0b8e9f439477f0a6ab3de68a61124f8ec81dece3dd1f9c80741
SHA5126bbf103929582e938ec8a234e494931c0d1a7c7d973ad74feee32fd21e725b83c622a88bcae2ff36000a7ffbaf62e65ce914e58feeb07507f1654849fd88782f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5733181938321659950ad500fca375cd7
SHA1de4f45a761e2c6fb145d7bbd541fec8d44a660b6
SHA256ec1a66b7c75e93573b349cf42dd74bf38f3f53aa9b17ef6985f8d2f21479c3ae
SHA51254ee2aa7882d3dc220ff19f7c80482e1665ec2ae0e78b9031243ecd861032013d9cc5e310b74f6ede114da2be83035f9cdc95444008a7de6f3fac40f4e537238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6a31b84ba85ecdcd3248c2cc6b4864b
SHA17a400c7d8b535a5766a6097afe2298df85cc5537
SHA256c36547b8d82ab17ada4a0178b31da68163cd91b370bbba65b665bde8d2d17091
SHA51264d78425e363b6f710015487e78f67e8af12c4f409d8879c04290c43be8bf9e0d275800d5c5414074b4b8711bf88e97e69579342910bf86f9d4251faba7fecb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5897ddae32a69e66922bb932e104f1505
SHA12e1fd0e4e327f89f73a99e0435c53f665e40952e
SHA25683e6857586ada156b627c010f27530e3474db8d06952f5a3e8afa401e1d31969
SHA5121143a6d654a67e400f803ae5b4ce1a9013511651e9c270859a4adaa5d2f598ddf3ac15ce6337425aacfdc7baaa23cab92b9d00bd7a01bc8338f30fe501346b96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8241ab121a7e0b6fa0ee6bba616624d
SHA1ec7eab14e89099e97488f7d2f26e646971e9f3cb
SHA25631263dc2d7b4ccec5d408d2d97abdb5629178b29f6856002d3a86da7ea9f3b7e
SHA5120f6f397f6441401f4da7105d357766e2cf20a7e4d9db6f6584a59a807883f0e536eeb10d8a8ec88ba8ff55b3f32e9adf202bfd73c8044fc22111c7e23408a62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5250e053cd96f6c894c76790786b12196
SHA10a292e3c61c4dadae414b030e930e830f00e1406
SHA256d2cbb0a3ac9cddaafc2f03b64a052a1438f3be0e1fa4dba72e4bbb9ad8ae55a7
SHA512436e2dbe71861a7b1759ed6d14bc61a2dd75c7c6c88aa7e40b9ac7ba67207a3e39a9aa395ba6af71edcb0459c00b11a1db02e19273a9ef4a57c2dc28bc37b4fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbf55b17babf2cc5b4be4b2c4a11b65c
SHA1fbdb8d1f0d5def6ac855e6c792b3b4803f330ba8
SHA256306758c6d9180aa6a2c3e4b20e04a106d428f30a5d598d52331b5c391e0dcfce
SHA5127dfc4e684bb2882ae717ead6017e291556fb6b84da0b5e741e588954efec8da5519560885d6b36b415c0ef2e1f71573b506661d26666a18d607a5d417dd1c0e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f439dcebb58353e188e3265db0c7bc19
SHA1e7c35435e95274b60beb0815726c2daf0eca70da
SHA256bed6c4e73c6074d2ece36e9e4af8097dfa6f44df41d8662595e829b0546bdf34
SHA5121aa4c92ca59a876d937306ca13040515e5fd7091c90e81490118b9cf0c3beef6d4768cbcaf8078f0be8d9c0a556a93e988b82f68791dca884be6e2e89181eaa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bc0d22691421092ba85cf27a6b78378
SHA1adc6a31bd0eadd5dac473d0ced4a26543b5dbc34
SHA256b76728d834f5e6a1b34e68e1df7162b276fe29f04234db88024d29e7c54b5ab5
SHA512295ba3a21d7b4cb454f7c3b6a5865b2bc3905b5ab9a87157350688502e3f9be5251d011755cebb81b793d39ac217da4853fa2bf10e6c7b97774b61d6092176bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592010a469e5d3a27bb5b0c0e5d64b5ec
SHA17c032d12a8fa4e14b3ec35686b1497a6e28d10d2
SHA2565156cc723cb6bc1ccba4cee090d4d238e38bbead285dcd587644bbe3ecc8927d
SHA5128d7791634140fd39ba7fe846bf5a89b3e30affe998fa9ef3fc2302697c353c3f237c10c7ed9bae0f64d10600cbaef7d8bcb1dcd1abc4f4d37d9f59a3038ccdf1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b