Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
eab2cd14b63151d8d9b00bc1a9aec776_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eab2cd14b63151d8d9b00bc1a9aec776_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eab2cd14b63151d8d9b00bc1a9aec776_JaffaCakes118.html
-
Size
221KB
-
MD5
eab2cd14b63151d8d9b00bc1a9aec776
-
SHA1
d27e8f17557b8d5d3153e0a267b01784458bd18d
-
SHA256
2801a67500a3a502030c1d84e057e83668f78bcf1e6b988bb34baff549048c49
-
SHA512
0c8d59f9bf347b31e0f31c58baf87a3486576fc6d36a82b633ad6a51e0e7c904ae011e214e5869cc89bfd5a76e21226b14524fdcc643e5c55488adf7d101d05e
-
SSDEEP
3072:zyhHo9nTRjIyUY0esnxepiwQvZ3CxWQE0As0e7wj8hrkSs5:XFTRjIyB0e+hvs0e7woO
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90730487570adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432886735" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000089a770e65a54eaaa205eb02dba5ca83c05be6ec525e341feb8ea4b1d24779ca9000000000e8000000002000020000000e85c3bf4176fad6fdb12149ad1c77201f1110c6a6285f84f4b894a2e3f7b0d7190000000e78bd7c15f34b4e83066018fb1cb2a57764ab870057ea82f442aa3cbb76e8c1bd33648fbdaeb9b1e0cde804a5d80d14e384d973d4acab36a2bd256b012640723af0049426ec6d6b5ca8e0523dcd67b4bf19f9774d70628c140623db8d9ce756668c1bd62d0e1f8737f10bc799a976afda274985a3ef722d8f1ea0e6543f294373417d4ec192d7e0ed156cfa2aa99302640000000431856568e11129bab72a4613f6b078b4bbeec2ddcdbc982a278c20c0f2e0acc2b0d122c4827ca2aba2febb8e8454f77cc6ff2eb34601b7c067618a90bd99e9b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001d72360ba6aa4bdc7095558e91a217d39c6c5623e74ee9fa2b2609c8020c81ed000000000e8000000002000020000000726882346c4801dd97c753168faa5d0b60b18d3a406a5ef757340973d488d736200000001a3ddf519cc272fbf6f5a33350c59c46e4e48f0ef4fc4f7866cfeef886ee160f400000006ee4ef982e9a59f515a86b9d0d2b0e5c735e79457879a87d35c88d27bfaeb10b7a3fd6b17f9c85469fd29088aaf696fa411952b51b7137c6e9a26ed55efffb50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD8B4611-764A-11EF-A567-DA9ECB958399} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2776 2156 iexplore.exe 30 PID 2156 wrote to memory of 2776 2156 iexplore.exe 30 PID 2156 wrote to memory of 2776 2156 iexplore.exe 30 PID 2156 wrote to memory of 2776 2156 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab2cd14b63151d8d9b00bc1a9aec776_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD59dd34cdd3610a78c014ecbc53427858a
SHA1bf253d6780f4b4a28df2184e08a701f0cac8e920
SHA256fdeb2c6e01066bafd9a3bfb91100c39a0408faf5b845dfff7782b17ef32fbe74
SHA5129330b87fc71f10b6c9f4c41b3d4b7cde329787da2f76e5244c7367994cd412b0888ba654b1d654a3ec3abba66db7d73588bf2f96f307ac9374804617aecfa9a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b704df530c5d7d917c0b89e6e85cbbd
SHA1764e628f7ba6ca9dfeb41e3e2168b6201bf27bc0
SHA2562f26e29213486f7f25760bc57fd3551d2ba155579f3c62d1710cbb3cd7b1a393
SHA512df5df90fe4e3cc12cec40e4c9744f109adb28fe33f20b2a4b43847793a0ed4b19164b2adbab17685c5dade05fea21d39594cb7c571ddce0eb9ef9396920cc954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57929d305724246b4fd0f056070f0160d
SHA16accf8d82ecc64964e2d2ca961b05263a13812cb
SHA256cabffb9a8952ae09580da28a232e5e7ddd2a47e2e211441e1f5020606c6f3a69
SHA512d4f02a09140ad46d8965027ec1a306fc7081d81f51233d227088086ab868e8f56a982dcf7ab8402c426d62cbdf1759f27b0ccb36ea898c43d9c4a22a2db85c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586409d5839802b692527ec8ed3155b13
SHA16f37f078469d53488b0ad1e5b01fa32fe93d9308
SHA25635e3b06dde9e8c01eb1a74d6038298da2a95a211ad67611248dbef43b3cc3e1f
SHA512ffc05a4d7e6e4a9192170c8d78dad6ec62edf92d91c36bb4a172ff3374d5792b5d449634ffb76971fc9789a3b32a568b88b7ab6b06ccd0c042fca04d1b9c5fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3b87f2b91c3e8a604c7835e39754b17
SHA1dfa28d3019a47e0e1208132e170c04f86fb47ed7
SHA256ce49370835d9ce8cf82669551a3b06ead677110349fd2d47084a5b9f3adcf718
SHA51256bfacb7ccb3c7c4ebc2900eef0359cbbd7bc58a6df30c222dabab6e21580acb5d61f66fbd7766bd089c2bf7177b2fb44e00bf011c00bf12f7f34fd3cad24b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c240ce418707bea81e044c1c911bc1f7
SHA18c593987bb9df14853061f93070c4bf1de89c200
SHA256f1a0eafca1b628175138abc567190a06e5275e989e65b38a2dbee0955d8ee489
SHA5128510d362f436ba694e08e9834d3ff2bff30140768252f0e2a9cd0424b80b7d58aaa96d9c894a25c03abe0fd794b3ab318568a5d015a045dd40ca795835e36ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f280fd4bcca81129125a6f30aaaecc4d
SHA1f5c2d1da02ecde62e14ce81f69f5871c3f6f3f16
SHA25650ef58078069bcacb7b0b15da4e9fc1595e6166ceea9646979f2f461f033b7d8
SHA512d9f6825a787f0977e7c7c052475e8160383de57d07898148585664e0d3dea5ea56ac8ef8d5d3df4224770a668f5df6f936938eafbf58e1c23c52663237ba8bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548da371ee4c1ed5f58cf5a49d25eed5e
SHA1d3fe7f26e43d8663c6d316730e9aa20d748814d8
SHA256c99343987d57785adb784465cd827f0d1271b7e09f3259a3c05ed1bee016493b
SHA5125b1e9062b321fc4f20a72e044612511ee3e5cf9253f14e487c3ef288015de3e11808988482f887b6cdd5f8f1f0f5af634029bcbfc9fc293d8d5ccf1eadc951c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c567d538d16d775923e64d621248be5f
SHA1c46f59f76ab08f748f9f135764ae257abb0dfdcd
SHA256a8b33c7c0990ae077ccdcae312511bac5ea941492ea730e025df124f09647a7a
SHA51277908327a9008452256263921f7afd77434aaf905d520f833c93366826727c2c21ec0256e15bb66d568b27abd99819176cbdb651b8644e9cd04bf3e07599d14c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5668cc05000bdff8f3843d2c1f4a210f7
SHA12cbb147a326e3a859f5b5c97729894ad442bd3e2
SHA256c5ec1baed18fc6eb89d8df3713f5998417c8daa6844705c3cd56953834d7cc3f
SHA512ed8c5dcc4f6e3fe2e42e5f0f68f6d29424e3778c6d3d2193b397da413fc65aeaf8af83569a65aebc788c3c22a64aaf95a7117f4028076dfba1fb91eba873eb31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eabb88d298b7489887630417ba8e074c
SHA1dc2b92c418480cc70ccf304b91e6409b67a4c95c
SHA256b6a9647aa00050eb75e036edca203980cf682877b191707bd86d0b765b418631
SHA51260aaf4838db850943a7fb6c709481ff29f8e16b9ff28ff23b3356f212aa6479fb25ea35442b1892fa03694b224be612024d7ed314a13745d554009da7efdfbcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b14508ea44979a1d31dc9fb55d6fcd1
SHA136de1dfa290425f01410499c87e1955f320ddd85
SHA256541218f2c612bd421408012ed9b07eb778ba4ff9697aaa66bc2aaa0d000155f6
SHA512740584b7ef7c9ebdb5b3f6f62f0989adfcd2ed464ba08dfb6c55410019a86706c4b06a7ffc913b8f4539f9fd259a8c7c732480ae85be1cbf8fcac72206e2241c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fe9f52be335df761ccf1348402bcbd5b
SHA1179759caa5d7c4c0f8b7de05abef7386633f6946
SHA256efc436b4ba8a83daf9d0ababbfcd9cf8c1c709595bd2d2d9f6cd9a072d0586db
SHA512361ff1bf27ee2099c78bf5d9adf84bf21253ce74cb92ffff02de507a9af9bd4765b066d2dd1154b136f6395b9ae6e4443222852a6cbd8c41614ba7e37a23a0c5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\4BHJ54M3.htm
Filesize1009KB
MD55ca07d09904a452f1fc950a86ad9c66a
SHA1738baa1a2ccd6fdc0251afd84f3b998b08c34a97
SHA25658d936a22ae78e28e2806b551ad921ad6d8be765baf22885ff349a96ea205e69
SHA5126bf0692fdc312e7410eaaf17af5cb4d14f47d22104e180e5d66a5afaf1e9aa8d52edc9e634bcfa5d392d088b8758a92762fa7c2db5e3d6c35503384cf89860ac
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b