Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
e069d613eaedea71cf1f71e02b1a949a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e069d613eaedea71cf1f71e02b1a949a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e069d613eaedea71cf1f71e02b1a949a_JaffaCakes118.html
-
Size
19KB
-
MD5
e069d613eaedea71cf1f71e02b1a949a
-
SHA1
c5dc80d3c6244a3625863025d8055ccffb882ac8
-
SHA256
59dc122d73317e0b9ff0c9d01eb83105953ec0ac702c746f8fce2cac9284d009
-
SHA512
782dfd64821fc4da49aabd80891e87705f4ce2d698a51df64eeb8f0aabe0074fa746da5a2584d44a14cd33b40b9ded33747c1665c080cefbe2644217450f2399
-
SSDEEP
384:4+QfPFd9QZBC7mOdM4QtKfpC5IgSnbmFe7Acrm6SbLAPd:Zcd9QZBC7mOdM4ppC5I9nC4/Pd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FD855D1-72A8-11EF-B9F2-E62D5E492327} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432487271" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000adf082442cc20fda795b0177c93dc606fd9f497f0e710d9dc88d47443941c74d000000000e80000000020000200000004a1d89f8cd453adbfa163c080f0ac66f68f845e64356f73b39c537c4ae691c9590000000107e8c3b1b592d2079eb107a06e33d3a40a959f90a6a61d38193225846330e58d27b0795ec7176fcb96ca783b1f47be16b5e3fa306f3e2dfa968b228143850d17be890624f1ff3059075656e7ee0b863d5aa979e410a07056914bd858b7d849d2b1111e3e308fc0358634a036decf82d903e296198d7168e2913577d75602990526fe992f3a593287eab43ca9c8ab69e40000000e1f6c40d52d60d50cd38357e2d6c6de6324a81efa6993c0b48d55fcc50ea34dbbde127ed5958c3390059df52b5341bbad9d6b3ef1fd3665a984e99f99812ed3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000063e090d0ddf89108e6e94ddb5aa370e1ce20066c0f8be3809ba411c31b4bdf61000000000e8000000002000020000000a91b15e7d8a569dd4c8ab946a05f98540764cc1f2f0c36b35f4b1657ba2938d5200000008b92ed71ad1d200d406acf7c6ae03deb8a3f80cb5664062eb8f51449ce9da7614000000054b5adfef666002f249cf482a30ab9d71549010bb18d214cd0209432ab0a3a53c3b9c0eac8a54aff9e88da491bebf644bf0a6eab2c5406c0ba8b0a31d6ae42f1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201bc976b506db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1076 iexplore.exe 1076 iexplore.exe 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2428 1076 iexplore.exe 30 PID 1076 wrote to memory of 2428 1076 iexplore.exe 30 PID 1076 wrote to memory of 2428 1076 iexplore.exe 30 PID 1076 wrote to memory of 2428 1076 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e069d613eaedea71cf1f71e02b1a949a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535f33a334ac7a245a3f05572d40ba84e
SHA172f7e5d6b323ee57c72623d65562928198ecf992
SHA25603c52cc0287db6a5c06cb26a86787df334cd877ccc745c761d8d7adfcb4e4ab5
SHA51237d9eef33985915a4da4ed403e5bc261e968c971d6cc419690a4c2d030679b50293c6d24bb2c86feba59007d0c5443bf2ba82e114b2b1c6807305ff85bc0a796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5572cc5f325c99bbcd8ef049eeb7fc02a
SHA10a07b7d5b685fcc96ff46c50a3dca35d62c72d63
SHA2563cff7764f323a4d30975753a3418b631030e01c0a114ef0c1be2aa3c7afe24f3
SHA51237719c544f3e5a2938761d62e7ce4a17c0e1e296e25a93c74adebce19e4c78a1a3b18c55e9e962c8a9c0bea4a5546a84931fabdc6083280d9e011000983152d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3e545554f8a5ccf966319fe571f8e5c
SHA16efe68877b132eb475be586f8a9567241a69149a
SHA256ac872136ac45e0cd33ff8211893dd023e68427e3529bd473fa48ce2b47ba05d4
SHA51202bfb0643f72b3814185dd5b14c19b1d18939a9208c001f4374de03b46d2eb82cc7fa7324cf6f01f81c32bf73489574f5a349ef1d63dfc82d0559f3d8cee8089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bcbda11cedcf320e0669188661aa313
SHA130d00f56e3d7d853f9d152ce0f972718c134dc73
SHA256dabdee41f730697be1d119b27361124285c84f10095b75ebf94f90a1ff1cf463
SHA512dc32e5f8e1f513b221fb64ed56b6c128082a5755d3ebc1a0c973558a8465ff0254e49a2a668a9b77a7c20459325721fd21d2adac1b69852cb4746fe533c731a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e684d066c092b5fe1f5217a9c866caf
SHA1dec2683ea649b26fe1faa64109ec8285dec12133
SHA25617b3d4e659e00b94e6497679b5356b3a7dc4aab6fe8803192799f7719197c632
SHA51206dbd5ea4aca65db40ca0c19cb3d1bdc48dc4a21e03d5ec7e9d4480eee2b10a3a656965332cc9df0f2decb16a853720baa3faaff8851e595caa55dfdf3936d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba9ef5662e26bb0495c580309339dbfd
SHA1dc667789be12b430b3966b4718b8f2d324ca64c6
SHA256e053245db90756cb37eb8fef5f9f68bf616b0aa0c4eb95e6c5c07ca1a58b5a39
SHA5122446c11aaa01f2ca645d64f3eee0e1aca3bf65147e61ab4b3e039bef34b4d3c1d0b0b00933fb3f867f0eee7a14b7880b8b94aac1e2bf07793a648d3d9d1db31e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fa7a8d9878ff06bf292b0a56144741f
SHA1c7ea11177592092e1895e3cebb0edee282527719
SHA2567d76a6b8d6c501a6a8289137c7392d2018384842cd2b5fe910468725992bcb9f
SHA5127114aeca1ec633b6b44842001c6dcc9477f1d0918872cee4af8744a4117ad93e6b99053dcd7979a078206f25190a3c3d08b1822fead349dad5890c20d2a7b04d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573a7233848fc3b6222f657f8ae73dd4b
SHA1a0f0f8010352c087a3d7dab4f09b9e0b54c8d8db
SHA2569350696f0a06494df6e0321f82cf5184b22f13c860dc2a6a6e6c48097d499305
SHA512b29574c2e660c093120dc8b01b9117829184234aede305b66cfb005f2b1c3800d99f5b00e66d16e259c10c06751a6ac3baab473db157d2a7744e55370fc64e4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef953f92a3082c220839e3db18f4ab2b
SHA15370fecb3216586a442bfb0a6401dd614c8ab26f
SHA256ecb7574ad7a12c48477b0430652df72a40f66db0e909dd29a0de29310b353a0b
SHA512d01ad2de2204f481332b9953c8615f14f544ef60ce8a5392a0ac05c716785d317ad93a350d0d54185d347626e9d30740a546773b37e85a8016e681c562f5fbdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5578434258e7201998a82e40980060a62
SHA1a1a8985d3fc650f257f2df782ae9543dad6b3813
SHA256d75673afc4d7b01759a7b0494eca5992d2e8e56f049a2767e01f5333b5e11caa
SHA5121370dea6b13b2116d4cd032a60d0d29bbc9462098ee3602f229e45641925e17eb890b24e74069521c0dcb2807d0510e86740d96668b5e572ad1dc3cf93d2ab37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5139c2d575827b7abb74e268753636281
SHA18c8aacec38c94cebac46246dbe1e4d982c3a431d
SHA2566fd89e3d2707e71ff3b4233eeb1d4cc8847f1acfffea8859aef6e17acb45e171
SHA512853caca34369879e5f7742d71f5e2bd8b6117c67caef69976608a7c0e1e7b78b041a5b5cf87f35d70b02df606e65b5e3ce55cdbe9c2ae54b471d899dbf3643cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58007263c16f4a6b13cc85b7f90e13873
SHA1a09592da7358089edd441ff5b278861518eab255
SHA256c0fc1fbd349a0577ce95af2d2dea47dbe2d69f1dca0defe331d3b0cdc85fdaaf
SHA5123bd23b1269163444d28e167107b7c165566ad1a611d370b720fe4b082f1a7c814b18442d5117567dda53e793ef2587679d011694ab950f2d1b9a3e0dd6152df0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515325651799264fc70c716fb087d226e
SHA18ec61061cc913f682a3e711e6747cd21ddc0dd91
SHA256a356ce557627fcbf8687779c9134120747b46ba7f25b7cfe52a50ded13199834
SHA512e3d21eaa9f3ac8b5e896abad951fde174b6ac5dd67f5c239a35f1490aba86df12f5f95d34ae2917fa47cde5d6b5a13d63e1c7cb9d9c530a63904dda56c774937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d52759174b70eb35e5c7b1e4fd0a23c
SHA1a31741ff3c5ee0201f63290de1f85e1991d89614
SHA2560b7651046d6c3e0dcd29bc43559114b72f99a94ba82e1d17fb4ed9555a6f6769
SHA512767c7fab493e3e1d46971796da234085f95612ffcfd7f8f4d42074dcf54757536ff06d3f9416f3b91ffef2a5e8ac2fc4e7e9adc9ec59ea3ccd1b2908a1eac5fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57358c5dc0d5df6a399c18c8fef75f80e
SHA11cd7a0a540c35ac3c725df2760f48f84c22d6c8f
SHA2569130a89756097ba26670284808095639392b29dc8907d870a19971aba2fe353d
SHA5122ce111c0d4eff6e53d5825730b85e66634799c52cea6a8eb9c9779ecf502a4b908232bc7e3a862adc130cc6efe9b3a20ae08d1111addf80a58b51b1124ef84c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d216963c1c7d62a860fc4813a97e70f5
SHA1377bc1ce8cd037fbbbdab4dd5fec508f9e88fa19
SHA256c74e63ce4acc4e90626781ae9a6c86acc57f5fb843d64032a8bff0c853000d7f
SHA5128a4d5856f242db368aed9b4b5b222c181506b506aa9ddd51b9a0decb6ee5ab08de1041a3d150af6f83a120b672702da80ec6b1d063d818baab6ad84e7cff06d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5821792f7cad67e4e6c73aeee4a096ac7
SHA150f36d1a56ad1fde84d0bff2288c54c95ac94aed
SHA25679c940ac2ce225b0c4d0069388610c59f7b5fa2eeecc92ec276fc56679071d10
SHA51243254813b7d5ed744fd2e4ae0101e35b8e0c4118b3a7b43073aebb66d14a282cf3503c5fb2f160dba27d120e2dd430f09921b3b5aafe4f58d23817f916863da2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b