Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
eacbce2f7cc5d89ddb926bfdb582244f_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eacbce2f7cc5d89ddb926bfdb582244f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eacbce2f7cc5d89ddb926bfdb582244f_JaffaCakes118.html
-
Size
14KB
-
MD5
eacbce2f7cc5d89ddb926bfdb582244f
-
SHA1
df527214acf9f9fb96a6ce64074a352309804363
-
SHA256
b8eddae5e7c17ce7d5218c9c21eea169fbefc747467745d4ee678ed20a636f7a
-
SHA512
57eee4a850aab9a9d65e8ba21e02e03f48968535baaa0578a8344da2a364a111d12531343d707724f497f0a8cb9deac753adfcfe72eee01acb438cee8a14ebb6
-
SSDEEP
96:vZD83PJIRcKcpKnsGz7fppdGue5bTDkfXhaZg9xbsCC6QsvX6Tsz866CsUphsmKc:0uRcChgY/MZGNR3ZmfQgccGhcu1MW
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCD6A1A1-7653-11EF-AD31-F6257521C448} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890647" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000032ea905cd81060b806e0d3a8ba4ed18c1d34159343f1d2e5b389ddea5dda5c3e000000000e8000000002000020000000d6d3a8fcc2956c84375f37ef2419a1a11697963bd27e759ec65146b662f1ac54200000005f983d66b45da88ea92dcaf7ac4d14793f2209305929b953fd4b9cf77af72280400000001a48b5de2b8e90950cbd6a7dcdd6a9687b7b1c5f3e83353986b87df8247e8cb46c28574c7c687dcb71a0145b21f3eb2bfdee52b78a1660805829d763345445fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000ad321a913ebe4d90c2e6d56a773f6da5904ea07c6f1361fde73bcefcfe65084a000000000e80000000020000200000005a1a226571a7f52b2fcf56b00a18f72db35f4f5f76ff90a354956e1e10e89a4a9000000091cca6b5612cc7152a8278fd69ed5c2f401c0228c8a0bb5d2af7523686ade9eaf0707d6a31202855746b7101cf9a30ecf85299a40d54dfae456d1a2d207e7b8312d1acf6bc14e1d0b7cb37556945a69b4494fb9bb1b423c715d9033775d122318fe7235c11ab627999957c18ff40b40572b7d2ec7e11a7be03e8cdb8a6e9c32151b3420a351bacf0bf1a6b94260284c1400000008b918d029885bd0a510579819457f7cc070f766e3955f885689092c00f36f3e12c36b588a99afa07273b5aeffe6765c3c31c26ce4009ea0f0a2e201a1f6f7eef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06403a6600adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 2876 IEXPLORE.EXE 2876 IEXPLORE.EXE 2876 IEXPLORE.EXE 2876 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2876 2268 iexplore.exe 30 PID 2268 wrote to memory of 2876 2268 iexplore.exe 30 PID 2268 wrote to memory of 2876 2268 iexplore.exe 30 PID 2268 wrote to memory of 2876 2268 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacbce2f7cc5d89ddb926bfdb582244f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d136dfbc4b6db3819419e636e4361de5
SHA1c430dd7c00f2ae5dad5b89a03c2bc4ff531399a6
SHA2569432f72bcee3986d5020a4d96f7110f2376e37b773cb68a8ab8a35fa111e271a
SHA5128ecef31a4b0412f501546e0a791706033d42514db6c6f0412f556b1df79b1c282ea9126ea190af6b74b782a9cf5dcb65c26cbb7eb73bbbda4f0cfad6f3c8ee77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533ca19b43e49ba3c889c3a3831f9e5c3
SHA1aa54652df0c75c028aa5e8dcf1ccbd2c3e187b18
SHA256803acdbad22321df9312c9967e6126d851c3f43dd083f6f42d755f3215b12508
SHA512b053289dc76eb9542e67206b4c7ff6218ce8fa0a434cdd7932148fc7ce570d31dc833e14880da67bcc3fc141de951545b5856718a439151fa0f4ab45fe76b991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c7f245bf1842b148b56a433a334f295
SHA105041e649fead326ad063c0b9765661fd9def58b
SHA256d149bf777896f18ec99d7bba5812f33224b1c499af6b70d39495236e5ca4fb84
SHA512a600ad2f8b54d08122e74cf72a33c594a1d0c4f0cdec5542a0aa1815b5d344338fa8b078b9db51c363971185af0f00de05a8eaa4488b91129053a36306b371d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59adbed904f12893ef0d4d1514e12995b
SHA183aa29d870a2fd1d5d877918f7bb1e16223f8b2d
SHA256feefdff152ebcca06d28adda23dd6b53351f1e8251fd9e797700cfcc34965e02
SHA512a5a0bd7ad6a705364e3f886ac8b341609025a792f6b24aef797c110fb18ddf2ce0388bd0f3643f3707c0502b2b224734b7ec111318eabe8ac5e287927a64c5e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc05d1d789ae468b848e012ac90f3911
SHA11aea3311cf9bce352e1e6a637e0e5cf5110aedfa
SHA2563bf3f9a2f812670ea0e1a1a3792505c85ee0c465c33318e25efba2c9430b94a4
SHA5126fac3db26d31b64169014a52e7d5e20fd4a8f7948e58e9f0dc37be1990abe205686c973d6210ae20ec67f43f81396750a1c077846879fff0803d16c1ef68f63c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3a946cf46e226a92a491d0fd862ebc5
SHA1411d7b61c05f221b036c09329eacc5eb2f4beb3b
SHA2562d357d4d4bb65a8801ce3f4babd86face7821e929b93fc39caa90c3e0a2f6fa6
SHA51281356c5505a8fd3018cb9ccc1ea3bcce5c19461b3c3c6f892e3f395a36c2ed950f313cb54a7754b1b918306ad360887bb9756c755ca7873cf9215c980197b337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f5423e33bfd6b9349834add84b73297
SHA1d8fce11d5194b4bdf29863c17ebb14e98ec70467
SHA256ed46ce8502a2506e6d9818939692a344c0fecd3f6a3f45e6ef1cf6b943954ab7
SHA5124f3fce1b3990ffa5214804360f816ed6e2d2042081a655dedf5ca938204bc4e28f56ee6a40487b0cf1dd4433d06962a7ee17cf8e3298b96523e9f2302db8ee81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc7f5555ce41a85d34d3d98029b7e478
SHA18f73ea0dec945f2a293ea8872d6527031582b149
SHA256cff161f324f98f1f3095f4313c04f23294ff9804acf134c8c8de1adaa1999cdb
SHA512e1e9fecd3d42d19936978c96913a93c7bb1cec75be43cc6259a4a3dd046e040286e673198a507a0caca8b7fb22bde5831c13b28e3b80f1ff393acd4fb76a187b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9ab79cfcbd11e11b352a7f2afb5523e
SHA1bb1ea4be3b6cc3b842e7749b1dd0ab2d395a9f54
SHA256414651aa8e907617f7c04e70776b9ad697b62eed8cde7914ca3c7ea651be342f
SHA512f846bff8781a49e3d04386cb13c1992a4c7998f2f0794fc7393117cb9d9bdb59a1904d46ca1b44e1abc2d5320e1c2a2620aec644a7f0f766869ac141f122f2f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56abf48ed80980383bf0b3766fbe4c150
SHA17ca5478a6f5240e87f6351a9fd3d1bc25c4b7414
SHA2560164c81bb395f042e7f6dac2d9f66bfd001e9b3edab8de5568dc37b588d76849
SHA512dc5dcdae212e278fc7511eb4c3a92995db2b50b7c9720655dd23ed7f3c3051e5a438c8d106318d182bd723ac98673b6da1f1e3e3e03705bb5a15e8eae66cea47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5977222e1d7a437fedc74e1d8ab7f4dcb
SHA1a494dd9b7fe77df5c651f92a5b6ffdcb089df4a2
SHA256db3b311f62978a6ca1d6f9170379086f8c9f91ea38c4d49fb7e89cffb1aa5a08
SHA512303cf26c81d4f5b8ab293bd647d6165c5a11fb433d6c95172905fb4f5710c16ddd63d1756f853d4be3b43c4deafbf5fa2da09c0e5427ee03b5484bda6136e038
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dc9b18238e0b9e20f4e5d6d90ecd1a8
SHA10fa0d1b8f7945a7854fd9e86d142728013f679c4
SHA2561b1f4796c1a765e89a2807350042ee7f0c7dd36b35691491342732a11779470b
SHA5125f80d4f1ac6078813debd5996e3663cde79f1688af84ff9e791252ce44deec9b1e146d503d1a53832a1ec8e789d04e7e5fdbb17f24121ee2840246a792c5486d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55954350936da3d8b5e03077bc878d3ac
SHA1495652143b45a92c9166074eb9560c3528f7cef3
SHA256131cab1ec2a2adfe1b50c355d3040eb7f9701f2714ef21cb1e45d9e1bef87639
SHA5122126e3563e2d6fbada27b23eb57a3ddbb93d7326875a97db52f1af466e05864aa54a9f875733e552fbecbc45d3bed6e0fc3b2317d67906d76b565cc598968bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5837f3f2f7da2bb6f1873fa7a64675637
SHA1e81677998cb1d2e8531836bd06a29ac50acf1e53
SHA25617820a855051fadf881d80cfb0a8a55ca6932f764888a5fb7b40147f3ba7fadd
SHA512d63ed33f064e5b887a073e9e0cf64a9aa3efe86ca4e7601baa2a31cbf7c9c8ced7745285d1d919fc67fdbd0f37f7b5687b5e78ad47e72dd9f9be5e84a2e10d7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595a0b022d7392396c580a6cabc802dd8
SHA11ad5dd0cfca03b2a520be77089284e1b5da59957
SHA2562081ea947b896d3aa5a6e87c58dbc124fba5110969af1eb49890a366ef17b25e
SHA5122b5bae37981d1ecec4c31b4a1531cb5a4391185d5f56a9cddd43b19cab3111eb5788877d0a62ab54ac79846f39191eaa6061e2238c264d05d9ee078fbf23318e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb30962d93bbfbb8d727af43be780c66
SHA1eceb9b89f4e0d12cb689b729367afcdb72088539
SHA256d5747fd93018fe2ce48b33f485795c5d8783ee04e2587bc4c49f0facf39b342d
SHA512e2bfc1d77e53f91d6773838b65e95d67d6457abf527c142252532e1776358f00a40ec7a003143ec2d2cebc8b15cc291d9d24adb8f0fe57192fb360c1d9f37299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571ba5cfe0ca34471682ae9a2fa8071fb
SHA124bc89e36c0bb964bc46c8ef72fbad36d7bd8b52
SHA256f61b98e93e1a8039996f8661424158abfae61d58e8b5053f6ffa978ad3baae81
SHA512682438896f347dbdd7e5ec9cde111b56501872db5c3b67e4bf36f08c68900f7b5adb3bfc3c3565de0a8baa3d9c68ae567af2a3c7d15c4df5e122717358672c34
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b