Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
e04c592ccdd6c155018380211b7ebc70_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e04c592ccdd6c155018380211b7ebc70_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e04c592ccdd6c155018380211b7ebc70_JaffaCakes118.html
-
Size
68KB
-
MD5
e04c592ccdd6c155018380211b7ebc70
-
SHA1
173de88fc35f85c8baf9c2c2e05305de8def9531
-
SHA256
0936abedcc488ed71ddcb425de291b8bed01de0870774eb05f92797efaa0f522
-
SHA512
19232f4e77730ffb4b99eefb7ccb42f7b180c54e9b15c8eb75d100b8bd2dc8beb576a8d43177ede83cba32b87214c528ca5f011bf41657955f13553bc48a1174
-
SSDEEP
768:JihigcMiR3sI2PDDnX0g6xnW9Mfp77oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:Jele0Mfp70TcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E74EE7D1-729E-11EF-B439-523A95B0E536} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70207dbdab06db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432483114" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000512ec0b8933cf2bf76639afd315447a46fef244613352fa9fa5655302791808f000000000e80000000020000200000005ea4b4f627f47b5b503a24d01ec21ab48be1a2f4fbe5250429203f10ca732cc5900000001be09dff53628d81028d084d71ab4d46f5e9e53337c9dfa70bdf95402dc3495b11398791fa0d4420beb4865d7e12c4b649b36d5cdcc6ec275355eb0fb4218441efc098dcd54a5c5ee2afe5bde2fc6aca6c65ccaedc36d2c57abc18c29cf1e096cc485fca25427516d3c29120260ef749b28720518801d023eda18edfdf1ae19ca43bb00acdf8f5987b36ab98519cda37400000001b720511815cec06b34e050386bfe1e2f4a77b26ec9c9d5cb982e56ec04b0c493a6390d76b2f32a9b06c848b6fb71b720548ca97d8064a128643fd2458b951be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000004b41fbd57a80a1b233b8898066031d203c0decdf93633b2b0ccaefa2a573521d000000000e80000000020000200000007bdd5c24c0518e745a3803508c1514ec4a32b0521d864a28b9d24dc1f62a1fc120000000f66f408604f999d982edc7c7f26d7fc8c9a03a6f11140a6418a4560bf77eef8a40000000e25c6684c353dfadbd0d22ef6a6754b6f3fedf2ea667317dbc62d9595ab7b365f01b4ecc8eb8d1296f9a2dd1cc2d083410d4bef1cf9eb0e9bb75d2844bc7e8d2 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1076 iexplore.exe 1076 iexplore.exe 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1624 1076 iexplore.exe 30 PID 1076 wrote to memory of 1624 1076 iexplore.exe 30 PID 1076 wrote to memory of 1624 1076 iexplore.exe 30 PID 1076 wrote to memory of 1624 1076 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e04c592ccdd6c155018380211b7ebc70_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517ca3a26fc46241d02e78b3df1e3385b
SHA1646a74bcc0256a8519c9c5aeae786b52edd180cd
SHA2563c703923f668b2c08e022319b341a1eeb58005b1bfbaf8f8b68cd27dde0a235e
SHA51230cb2b768587be8f35abfd77dc894bc204b325216ef62187d39091dfcdf56c05aa8818ee69f1339deb2beb06bdb038d8040a1176976851417c2103de7754b03f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b4decfe11a422a975bc4c76f151aab3
SHA132fd81ec08f97ecd049d265bddb871b72f1d74c1
SHA256eec833f2bd7e86bf7a0889660fb9f303ce936137a6f580b00e69f7ab3f01d145
SHA512abe3b657d0c0515f426fe1ab15bfa6aaf30640896c8ca78584bff28b138ba8edb35e4753b057c2ad4c7ba8d7ea32d628f10056eed55fbf8f554e01cf2fd5e246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bc5fa2d528f6cc9f2eb9c020a350482
SHA102477833e0d69288ef83353fef03fcdebf7ab603
SHA256ab183bece03db840bdfa5f56d596036aa9f91a4218b75d8c72c143683124fbd3
SHA51252261e1b6d5487df7fd80cb8069c585470fd690b3e5e2399877b1e0be53ee39f89cd378549a253227b613fe5428dcda4cf47efe6041ea0ba47d2bf6ed53c2fcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52450fee6c08ba954247795fb245cd3cf
SHA1fa3623ec5ecf496945705170a26be62773c15960
SHA25618c7990ef727cc512e246bd44cee63c2f113a70399abfb09f8d93ef121165677
SHA512607427749fb57757b4e6e719a56d46a00a5b4fd393238e154051f30cbdb9ec81f56d8d371aaebfb9ff216804f0beada67b68e5bb193a9705ae2130891edb5702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520d704f7361d5b5f814903ae80f1c3c1
SHA154868b3a46640cd9550d27601c6181ea291652ff
SHA25672ddacf1f5cd6e689a025da76a0bdb6f4d166aa2f501897c4be8e25edf404ab9
SHA512568fae860222130f8dded01357cd7eb9e80149a5641d5505e5e5eba5ad801ddc346762d00f04ceae2a19154409be6f3190d0a895f1e09395272df64f2906e194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550bb2eb2ed9dcbeb46c58de21a783b4f
SHA153ddc2c32ce3000c3de12d0784533655897129b9
SHA256461e6a1f62c9876a78583d1a6bd190ecd5ba23659667b076fe34de0bb1c25b10
SHA51249fd1c4c114fe48b795101fd862689f8ea6d327c9b3150e2654f7493285b7d489b245136b36995c817d45fecca21285a20aa9d2ab9df9b0d87964d2189de8fd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4404769a1ea5fcab109f32e36d7c008
SHA1763d0e818017f5ecb356b6c9bd4cfaf41b1e38ae
SHA256af01d7ded23c195739d3caaf6bbd5e5504249de4545b5e56512d04f90c12114d
SHA51252e2c464dc255ced850040b251bd708fe36309a03da6db1173e2ea68571a2f80c1f3c9fb83c715e7df3afc30922332f7d4c4d0d5c7fcd2334d4efbee2ec09f83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9dfa4f2a0d9213a1f47fe5875d2c9df
SHA1fece4afa5519a65692f538543504f54b65b67588
SHA2568a0c911dcf3603b966f3dcfe02e8f4fa4760b96ab2eaf609c79c78b94d646479
SHA512d7cea0998b4e407ac014b56c441902fc43264628719cfedc9b404857dc3a23529c4cc55bf953216f1b065d226869c634ea8afe795f07ea08849046c5c952092e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e14db34408335026756d538d78499a9
SHA16a7151b11eb6f6ddc44059222b261a821bd646bf
SHA2561041d57ca5cfc83353f4e1d8aa80ea51d7bdc864a95d178e6cc0a82563a92e26
SHA512717fb4f564a14da428b1480312f82c886669a69e5d43e527262ea2fcdc7f866d9f0346418a2c5138d01d0afec21f798089a0091ad0f56b3239dbdd33ad77d881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4743f842d096a783a161b3b23d9ad05
SHA1a5a04cb00baf4528f0e1e807af1e50d6c0b0ab0c
SHA2568d4881f27154e06c16eb18ed5b0cd19422035930587bfab0a31b726b9f14cae2
SHA5129e08bbf790132d19e447d244a7d8f68c5818368f33be6a85292af41bd107c48e9486496f944e795021008ef65c95055def2e9e2712593d1be05bf80f01c7c763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d47bd2b3500c16374fc0ff4b55fff12b
SHA159aa5c2731d4c4aa18d581ef5af62b5be88ba953
SHA25630a8dd18f8399acf87e4b97ac587f158eb3614eb4e9c0df97abab7c387f55184
SHA5124c1d94413f97f639fa0cb93179b5bd3d038f22dd7544224e4eb2c41a00d5b6adf737c2d38845063c40b30ee57c112e0636da17fd5442b91c8e9a3aad0f41df11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536a208ca49c5679da68575e513177349
SHA17dd1dca143273ea7175f078fcfe475e7382cb7f0
SHA2569148b75457c7bca41dc33dd468ae00ac1f7e6b7df3497ecd2c2a022d5da7e404
SHA5120261d086565b3ed1fb85f18e48357e4d3914e2e8fbe56bf7e8bd8cea3cd3c37446ca25e6ef29d779f6224bfacd6cb57699d1ac2121a750ef27c1539c29b18e61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be7110d3ddb42acd77157204279fb7db
SHA122d8156c08fcd294f6e135105f2c9f504954a71c
SHA256ca021e3f898c512267218ada36acd683aecb24fa52d6f7f38d33824775db1cff
SHA512e9eecf7f4e00701d1e85d79173a5bcb88eff7b0d2a4f5345ae01eff39c05ab3897e2fd19f2365f99c13d0611ce25fcb8b5546721b3c83f8fd7565453e4f43d02
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b