Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
dfb925dc17bb3af60191419867c5811a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dfb925dc17bb3af60191419867c5811a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dfb925dc17bb3af60191419867c5811a_JaffaCakes118.html
-
Size
68KB
-
MD5
dfb925dc17bb3af60191419867c5811a
-
SHA1
be1242fb39e911befc5df4629d3be3b99abe9467
-
SHA256
0f6a862c2b6a8eba4349c3c4d12ddc1f6755076b5336c761529a4a3fd8b4695c
-
SHA512
6319002990c32b21d1bff0027555d777076fcc307a0b8cf1931ed9a946d2ee3af3c87da8069540dea0ae4d7a7a2bd20d551c2e3cba171c23b9e03d6cfbf97f79
-
SSDEEP
768:JipgcMiR3sI2PDDnX0g6iPx9wwtRoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JzLzwwtmTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63CB1991-7269-11EF-8202-7A9F8CACAEA3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000006c618a4ccd60961873a3577ae8d5c00ff812b4df29941d220aea7e12119cd47f000000000e800000000200002000000092b6af3f72486a5a65097a532c3a35f73cbb0250f6ec100a161dad4428544f3220000000e994a64a86ac7527411c6bdb7ab61bca429142cedee8a1e708d5692f54d6ae4940000000ee076fb3c7e5b548d0cf3e962910e998539fd4bb5c125cb55b0b7275cfb55056b57232fe9f82733bffd21b49f332b4e7ec1bb8eb1cb252db2e16bc917359f524 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000007171427178ae33f90688a12024410c62db6b9157e97c6069a03ca149e876bb8000000000e8000000002000020000000ac407c87db523c6e42b9b33691b816f870b221e022758b90cc8c44dc79de7586900000008bd9e9b3b6aee7aab0c74b8801c8cc3345c26e35a76de333b1627af86c0446d218e69ded5ca28b2333bfcc08a1c1da1a00fe98a3eb0fee9719853e87fd5b39f2002fa930e1e49610d113472ec12a9c4490783d7b7fff57830f433a3b3f6a52ae846efb8741c0ddd4e956144fb5a25c5a41d4cb99ace0f101fe0ea18a2273421897c6401aa11421314f09c82bb6a00df740000000871cc59437d18639cf6368c1a377bf4cf0abe0735af602d78bc23b1aa91f543b73bf324f820bd3a884ec594b9e7095ddeb9f38e1e2f0e3731b95bf365158374d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fa223a7606db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432460112" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2544 2120 iexplore.exe 31 PID 2120 wrote to memory of 2544 2120 iexplore.exe 31 PID 2120 wrote to memory of 2544 2120 iexplore.exe 31 PID 2120 wrote to memory of 2544 2120 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfb925dc17bb3af60191419867c5811a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551c87fb65caf650ad7a6bf441ee4c320
SHA16197de3fb4fd35172009bcb29cd3cd247d801509
SHA2563abe1b05167e3bf44ca9fb78a3a66b649277482a1548e70276f1bd0f0595441d
SHA512424e2036ff102fe8fb6d1976301781d1da51ee4c44543e2f9309d8eb4c4d12f425cb969b83fc14df981dce8dd7470ffbeaa81b39e02607900bd382efb664a304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecae0ac2e167d9196fa7dbd77e48785f
SHA1f57366cee1edafbc8288a5294b4e87f818930eff
SHA256a7b470070d3e16f53970e0e09a2d4b46f4ab5fe4a32388d3c5eb7f88e8bece3c
SHA512c6503cb314f5c6c80ad572fc778ac754282de9efa422dee414126dbb416e387da7bb469b23066b259149cb27dfb21458c2beec57429695f0dd509937bee5d069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f44adcf66933bfe18df38860a6a09e13
SHA14109206ebcbec1f77bc6189574fd3c7c06331bc1
SHA2568c2671d5bdcd91ed785d17eb6550ed3bba5f7d272d855b6fa711fab01c57aeb7
SHA5129ca657779ec21a5969f03fe3e1695dfc64e92133517b14d887a99cd668361ba48545c1c3f24f6eef5ba46b90272848b502e86b95d6e6616bcff5eb3b6dbbb549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9cb85e31f6f00edab581b9e80da88ec
SHA16d78e1f8883c973d31c724c148faf3a99f78ccd9
SHA2561d45bf96477b874902816d3549ce0892fc19c80eb4880d36c23f0d7ca9251204
SHA5129b865fd43f84cd9c81bd2d90787617a185f8cc353986bd424c17f42292acbb4a5a000ca85dbe11a0ebd29da220a27b4e872b9cf7487847c5c65fe10dbb7124ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b94d7bea061d69aab0de8e8ca5e2210
SHA1734aacff487a9e293f64b1bc6b551b8a7b0f6ab6
SHA2561b3a081107a0e442ca15fd3552e8ec983a81f183a5cd7747a4a2e648c9c68dec
SHA51257e7803f18e2a8733cb5f2b7103567e978b83ce6ddfcfdd3e1da1510d5bf64677336ab1b6b9fa5a5cb5ec688ce08008c1dfd7aa27e55b87984cb8baa9427a479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f478656a63930cedaa0b1db595317a3e
SHA1a18a6cf61b040d0232a92cd42ea8139311e0c502
SHA256cbbdd6788a1199277fc3d8c78276e423507dd77a60901ea4c7ade68ae691c6a7
SHA512eed13cb5d1d194e22b582b472478027fd82feab6c590e6dfcb612f554e74384ed7fa14a81a51b13ed6052cf9892c423de635835277a057e17a42428ed7272570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c0ec97a0485f6fd4ca4e06b188f31bf
SHA17d45c7a25471bf5b53653de6d3a00923c5deb12e
SHA2561b54fd20893baf123f1690fd993ec9e44bd3fcbf69de343db02d5efd58a2f701
SHA512f12c66c9cd52e57959ee979281d8d58700f05565fd8a47659bf7a9b4b5338aa4ea08b84e91298c32de98ee383c35aafd49d08caa922797288e9f6fc67a576625
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5407449a4b91e44de23911b5de208dc0e
SHA18e473008d51da5e84246705a1e49873f67ff8807
SHA256ad8ae0ee7c4495712a1931e3d9ad29815511f5ca616b2983ec88a9de942cbb11
SHA5125211eec7e1897149feb1c814723780d787d6cceeb63f7ace0e99719783d52902c02246cf34b4719249fd163ac169a188b2d895d5de057b21ac6d647bb889f153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eb2cd4f5248c2baa94a9dae7051ba27
SHA1e1902659ba4d91cc13b2ecdacfdd8149fb5cab8c
SHA256b30f2bf7b81caf1d62f91463c745b63c52d71a9d3622162e3ad9724dcfacd974
SHA5123e0260367e8746413794d405dcadc5fdede5928938aa812d7c1668d45acf07419414b797207cddadec39f0d8d5bae62937e59d1c03ce40beab0a561dd31cfe52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfa30b5be27fed6230b386a0f8cd113e
SHA1a983896d625c2c61a320ce7d4a613fbb820c6137
SHA256cab8945310ab4e8664b1306f04f50ac6234f364dbe21109ae3540b1ff93e3c1e
SHA512637d8777a940dea1567e7a9abc591e37db6582d99ef042cdc9f9c0047261efae83f7d864f47c3e0610ac16486967340d919cd15b7106d28d99ed384839337fd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a3328d463eda84ae0875b8a53ad68f0
SHA1954cae77b72f1325202bbc01f3ceeab8186199d0
SHA2566558ec9a8b662fdd37bc2013b19b3e4a5acbbe9a58324658923f50de7791b6e3
SHA512af62976c2cf96fe9dbb464899271b623d54a884da5304aafe2fcc9067fd56b8fd79bfb76f223010049b3db3e7fcdfdea843e2a15500be19ee41b8b28949965e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539058f21097dac7dcfa4117d82602170
SHA110637feae160b65fc4fe908f6a787897d887eaa9
SHA2561d2912312f69e983468344e996025c707498d050524b0f352e8aa1474bd40883
SHA512e5f44a4031996b51fe4f82420e0a9352d0aff9c8cd0aa41a36b322d039a7c2779b87399d85a2ed4b194217f9357504874d00b3a310c43d705167101469d1657b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56436c5910e7a0ab5c46c7ae28ac8cb36
SHA1f017704980c6cd55f50440038f5722a106480587
SHA25623cad5037ec66b150cea192aea0e116d2589d5183a570cc6996ffa4f7278ead2
SHA51224e920164c60f4f0a4eb9cd8d9cec35dfb93529d22c6932add3d934514790847f90218c818bfaa6f4337d6b2410ee893e306598954888c1cd974dcae14e49ba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57560f7b19d5e07125ef846ddc543e330
SHA12d525e7ef6704ed51a76a1e48a5e1702c5f9e78c
SHA256aa956e990de7761d82acd70cd8d7d9ce2f24d1f987e9e8ff29dfc6e891a1a38d
SHA512a9a10b3fc689a86d1ac0bc49bb6f72b32c63ce9b2a8dfbc0fc64d6bc37c215a7ece3ec99f4ffbf451d48f365a544e971c26c5b9d6eec3ee4efbb333fbbc0baf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566fc73c224ddc69e4bef0312c6279d60
SHA1f563bf06e77c41e7c5af9ab98c53f957610487d1
SHA2561ee5b5003c983272f7b675f255a66a9f9d8d48a6b31d4224a809b4bbb505ef31
SHA512679b07671fc3e05d5802ea7b1d4a3391cfc81371f31fe377d3a89ea8e8fbe9d1ec1628226fbb433abd08ad1ce85d3ba4e14a9fbf614a9667ab939e5b8ac12de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0b0a0fbc3c0151bf9a00149f503a00f
SHA15ccb08f2aa1c53dc9197032a53d4f23bcee6ba5a
SHA2563375da9e87b813014805f3857309cb7c7c4d0dcaea3dad49c797a63e015e3499
SHA512e746766df90f635d24600b7bef62c481fc27fbe0b5f35680c8c18584bf086cfa6313b499b1cad7e08de298dc45fc1e13c663c7ebdf07f524946a8f0f6af3ef6a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b