Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
e1cee14a67a26dbb5d84c884df63a674_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1cee14a67a26dbb5d84c884df63a674_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e1cee14a67a26dbb5d84c884df63a674_JaffaCakes118.html
-
Size
134KB
-
MD5
e1cee14a67a26dbb5d84c884df63a674
-
SHA1
a4892aa10d6db1fff09f7ae536549a1e4baaa6c1
-
SHA256
3dd0ea6f4bb3a66c2347f10d224711ef347031a07d0632ff6df1c05ea7086626
-
SHA512
abfebc7e4226c7316b5e1f96d3309ac54be34e6cf64c3c9e2edf072e6c8d2313116bcd6fe195c5d2ef536a1e72007a6e53270c9a62057d850a655d064bdf681a
-
SSDEEP
1536:SDkQDfYeFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SDjgeFyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703d42d23107db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000883b0d0a8a148b9a1398a765cad9acc2c79f0be4e6c4e32d8888d039f7143857000000000e80000000020000200000007b0d78da9b98e2b0560dc9f862b12bef7d91276b22677c4ac734b259d3341bca90000000728500a8eeec09225446d1b28c32f0b1764f5213a212f08ae0cf23f3c709e7e4519e497b35e7b59685b7eeea140275a4920ef8d5c58fe7c14d3e5cd11048e49b5f2d3a7b5abbdd1d68acc0dbac8e0d1fb281b24813a19f45c5bb580266f550994c79792162a74fb736e3101ed070b266f18444b977c69c0605fc98cefb44ac5fe1935aad3ed56dc5b20f44c5782b658a40000000d83c918b0e1912a45c4e17d8507ebbaa53a62c4d55dbdb57e7e115c714d0b5580e6d44bdd959c26e9bb5abd22506386526565f6965aca20d9802cfc1e35796e2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432540688" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAA7BB01-7324-11EF-A96C-C6DA928D33CD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000007bb03c5e6672bad8a2fbf4f723a1e2f2030c4532c5bbd43e9afd0bf5c1c3b504000000000e8000000002000020000000af3ff5a787e711077a07a7db2a90abb27e82c86982e5cb3cd8125a1e5bf8170d200000007010e9029c7fbae853dc73455e4172a4216afea4c323f57d87e5e92250189fc940000000b05eedf04cc5cb5e27ff4584a171aadb6e36bed60f129cebc217aacbc61f9a0cd2a902ab9af806ac451d0abcddbd3deed3d84f677addb136ad853e365f8c2e25 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2692 iexplore.exe 2692 iexplore.exe 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 3028 2692 iexplore.exe 31 PID 2692 wrote to memory of 3028 2692 iexplore.exe 31 PID 2692 wrote to memory of 3028 2692 iexplore.exe 31 PID 2692 wrote to memory of 3028 2692 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e1cee14a67a26dbb5d84c884df63a674_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5885741a67e72efbf46f635e8acd61854
SHA1a44c5639a9b5f7c76f49167c8181fc8930e047c9
SHA2561a7f610bde03dd6be83821e95fa3962fff9c8cc18becd40e7ae290c7036425d8
SHA512142813bdf83446ccd3c4de3a98bb0ef3a1992c62a79696cb99e8948d2b2703ec7d6c9f577bd1095225cf562825413bde3e54bdf1620dc2fedb532f0515e13e4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589e4438156e3a5b3b6a7814faa874a8a
SHA1c7e6cf684fcbaa2a3d9cb5b80251d52e2d022a4e
SHA256d5a43773c32a717a80123a8dde3f995c2a48474b4bfaac3ca544ddf12c7d6033
SHA512b01129e7c027a6a6c16d3f43d0dc6f6a9e3dd1b9bb9424c5987f9d2482b78f87b452b3b702d376649c66b05a72e34a966403a70be36f324ab19a6101d708c229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0ba393b4c34c34eddc38c0085df4d38
SHA136ad5738c6b148e377470547d3e0d30e4961817e
SHA256d8480eb0ad2fab884d49a262f4d7cec0208e5a68379b9de4a1e3c8f9e2037dad
SHA512c9d072a2800bc11a65a02df3e1db1f9364ed200d19efbec41fadb1cc23ca84497a00bd44192fc2a5dcdb29847488478c2f817c2b9286022ab595685a39a879d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578699ad6566d955c1e8c0190d1dfb8a9
SHA1136d7e2bac10762bd7e41b33bb7dec30dcfb3b73
SHA256fd499201c9e3560eb9af6664ccbec61cfd9a28e9eb9ecffedbbcf36c40ff71b9
SHA512ed40a4f97f3c0f1e0685cf30991664857604739f1eebae8549388fe31a983789c08b448ecc20d99883e53ba8d181023951ed9b3ff137484ed6cb3702164974fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50399e101779bf0f17ed6d749da2bc78c
SHA10b397a7af29063bcca14ba0f1dc41425f2cd229e
SHA256115e543069230272a9f2a0b65bc5ab0a8ec001605204788ba2ccff81adb0d435
SHA5123182877273463a8948aeac05efbe95edbe6ad03ef4afab19803867f6368c0ea08cb1cd3af758a0b7fd3fcd657ddeac870678163a64ad8acf12d95f48c6e454e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577afd04b54686c7daca515ca4f8cf49a
SHA1d4b4b4df25c18e8ef4d861a731733901efed1c22
SHA256cc05cc93a6699fd9a4d9daddd6922cc3107e631c01bfd5d57155acb7285b064a
SHA5129e39a804b54cefce9fb42239be7e774e4c34ba643373b9f1b5eeba29afa95f62a935a671098f0b8cac52c861eecb2105c9ddaa1e637e4dddca95d7f0e47591d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c24ad1d24e5047b0029e8be27f35535
SHA14a30a8fa84e22416dc7cb6b0819336f714e4ea73
SHA256d8034bda30481fd3f42ec3bccb800a515638540ab6c2e62d79c923cf2d70cb20
SHA512517ca0e2c0a3591c110fd977c9bf86a3b5c8e163b68c18e4e9727acb2b6f583dbf73abaa8039ccf9f4eca7bb9be0b6c9be8c2ee07b02f40d885ee84b9d47d0c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dc6bbf625af5ccffae195c1d9ffb18c
SHA17c60ce1a3364b5efc4faf89e0b48a595e9656bad
SHA256a37b419d03531003350ff2d4eadf1b3996d876a6db5a23b44f33401401df9865
SHA5126215adf71130efd49b35b10fd03ddd0db6a533ef710236894916767b8d6865090d2b8f8fe434cd14ef27fcdd356ad4a440cecd070dc4a6294f09fa50c889943e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5112cef0a595fd965c3bef0b9896f3b72
SHA1b01c5b639b8633bdecf9e2bbe2efdd3d6735ea76
SHA25680914dd5ef12fde5f2e662029103df835bb2540ad3815f17d2dba917f06bd5ca
SHA51238725c6179b95f8a80d9dd438687d4abada3f8592096fcec3d44e9304cb5ffe9cf6c23bc28a56c082a2f990e7d9f6692ff517bc091350283553df04fdcf21a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc2f2bc76f67ea2fb0cff747dff51f2a
SHA1331079d2da28f5a81646b30d740619e633187241
SHA2562314716be7a8d8389c885ba101fc752b20cb54b4821702a8484203ef0a5cf1bf
SHA512f43fc2e426eeb034faa983e2956c2516edbbac786b7a7c505d6102132002c363ae0fd8c7234fe3220be7b89e8d938874b2ad1fed068ab1c60ef954f90ea79604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a62240fa27642242847a2a9020f0d0d3
SHA13cc18d9b728f019d6504e9e751203246f5c8553b
SHA256cc60b01f083550d47dd5b7565f8b3930a876f51bb26e955810f047a594c53df1
SHA512d1d95a2ee86b78bc46adaacc204df3f27b90c76c012a2ccab23b201f7e719214783b8659efa0a07ab50f20f434dae70acf61ac9aaad3d7fb4fd2f3318226673f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc493a5e630c15bdffd4b066eefacea7
SHA1caa4c8b8a998144a136063445b6f3c35717e4289
SHA2568f17924e07ec1401e3f7813608f163ccfe045fc285e7bc3ddfd677c3b2bda9eb
SHA5121b293e184315d40df731c1f2743327095631e43f9670ca06d5afe4baf9bdc99e6b78d21f9581a8aee9f781bd1e2a9cc66edc9add00ddecdeb6d4c9a4c382bb34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ffa182e38b8739b9efd0c7c0cb40217
SHA1700f7c66f4cd97710775fb0764461c89ef645638
SHA2569aa5d745f85568bc23c72381bfb8f9340b9d716f6275acdb9fef957ab286df42
SHA51267d0c3644bd677c507c378d07e4f41824c38dc618f798b3efd32d651fe93d8212c376e62d933c0d4486b7ca2708322896a620791f4ec1c5268c2fd3356977240
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5339c32877917b317d3f871b7f174cd2b
SHA1093493249fbab01d0a8c90c460260dbee664cf3f
SHA25688befd7d6a38912ea45d42904dc5fb27d8b06339d9e7c7e9ec49bac56c24c090
SHA5128c0a9309f878c65812e7a60f3891e0726711e74d73a788afc60aaffa9061cb6dd9aa0c90e04b7db0b5d99cf9b41c32269d6b94639830c8a21a5b0d3e1441815b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569370a0cf6819c47e3d0fdabfbf13ee5
SHA18fe27aedef4a008c0457968bee5752e3c16c9ec6
SHA256b7e7972c02b89bf34c3c4f807a5acd80c1f73d0456c0c1c09aa06ea9717a0620
SHA51259ca623567e10657bc1a2474f9f88c8bafc8a176fb206f6034431d39a6650af4b7ba3436a5bc8f48f2192a9b0751c77ed44c146f19c0ba8fe205ad88219f4421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f27795630151a7f9a2084304bf1f5ed
SHA1f43d1f8b3cd472376e4cc0e9b8514b77af006a79
SHA2564b17e888339fcadf89bebd603a95de2058ee72ad25dee6c112795171ceceaaa8
SHA512fbcd5413ee1f7aa21941d8f59cd543c926d36c25a7b4168b5ec0681a788d29eee7cbcf6a8e0793c4cef9eb05ee8e7cb957d4cc016be06e61045990b5f26ed76f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b