Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 10:11
Static task
static1
Behavioral task
behavioral1
Sample
eb1cf39a7ac9614d8363523374cbf42c_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb1cf39a7ac9614d8363523374cbf42c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eb1cf39a7ac9614d8363523374cbf42c_JaffaCakes118.html
-
Size
19KB
-
MD5
eb1cf39a7ac9614d8363523374cbf42c
-
SHA1
848d3f165b94a631aeb827fa38dd325c2cdadaf6
-
SHA256
c0303b281ed4a919cdeca2038ce48f96d7798392beb51c9cad93b72f2ef36c6c
-
SHA512
9957c927ee715f29fd53a88effd10436217d327c75624e8b5232cbe4da8869624c524adfafcc8429d0b7b209728013970fe3ce6dc1c1c3bbce26a0458ea8b790
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIA40zUnjBh0O82qDB8:SIMd0I5nvHJsv09xDB8
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8729CDF1-766F-11EF-9E32-4A174794FC88} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432902553" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2464 1796 iexplore.exe 31 PID 1796 wrote to memory of 2464 1796 iexplore.exe 31 PID 1796 wrote to memory of 2464 1796 iexplore.exe 31 PID 1796 wrote to memory of 2464 1796 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb1cf39a7ac9614d8363523374cbf42c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feb7b770d5af5444d87eccac7715ba75
SHA15b4170cc8de3cae9a77d7a42358134e81647de9a
SHA256e0c8038371c2431982a01794cd7e0743430d23008a9bbc289a9dc2716cb5001b
SHA5128b50e1796b053a50b9ddfaed87b45d1437295cf0144a908231c5b2e3b98672883f97afba41fc95023692a32ae59d5c60631cac6b93986d163a59560a7a07167e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505acf8d782647e27d19a87e695f28fcc
SHA1b81811f709fedc3d91f65bb0d23cfb6a6433e7ad
SHA2561e6e0dcf20b924cba44ff05b676c9143eec0f1bc4cdf4a6bd8b83ad32b591a22
SHA512fef12b735bf24648898bfac82d06ce01b4c0af1275c413ad1a6622646ca943fa10a3c4897d22f32bc123031d0c6f528732d906cafc4a3ed6f17fd5c7109d030a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572d4beb878e5e42afe33160c83f37cb1
SHA164bd60de67738f8997b74527f095c1f024628a66
SHA256378a78eca68298fd3b90457883114d2ee22c9af280bb6bf7936ca5a90c2e37ec
SHA51274afe07eaddef4f3d8754ec4011a109212abf6e08b21a514e42b3ea5596a1953c2a5d3e2d78472db0a1f1bdb18ad94faa502bea548f8f8b471980b6e76ac12ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a47b5ba2698752a9f2af3ef72c36210
SHA11a2fe998887cf1d9e080416fa9e4d923a0089839
SHA256f160d34fec9bcf5429397dd9d897a2b8ec02a55ff6059cda1e250242ffff6ffc
SHA512954530914523423344a6b31a924c9a7a2b55e6b2ecfd1bdfe2ccce18a221617e45e1ec621137ae42d7299fb09d06550cdd1fb75a8ea7c0ba4da7173e5d62f699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd1f06ce2fcd242e136c8f05a6e33fba
SHA1d1bdfd9b29aafd7c283839d7916a71736e7c6ff2
SHA256b83d29e1a1f179b75ad02ee5f3c54133aee9c1bf151cb4b8b5dff03da49004a4
SHA512e561af575f3eb59e48e4b0a6ffd3bb7fba6b886357affe63370be61bb33348cbf17d6f56dbef96584281bdab62b864315fe8603918bab62d517e39aade40c004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e39d4bbdba1ad9a5b3ad240875a1ecb
SHA169ef2ff433905afb1f29e14abfa32a6c7a265952
SHA256f7c1b817c4a252857b83f156f6696aa16490041dd9ae6c6af9a92c73d7ecb5a7
SHA5123ace93a737a40d5740e0aab53a858281fba925d46e4e745ccc76827e828445960fa895f8a813228aef34ece3920d9991e136b7bbc64395f2687f7d3afefcef36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5791b39daec4aa2e3d2cdbeb82f78211a
SHA15b842fddebeb2dc79a242d6d47b82d70f7883016
SHA256a58d74b4fc48062472510957fb23faeb88207829d2b08374a09bf720d9baee64
SHA512f746f0a1638440ac42cec122075a5b1a439bc72bf237aef99b173626c65b4b643e6f2dcfe8be9849831e15bf1578285c1746d2b9552fc6f2079808d584dc6aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573b9b0ea5acc21c876533e1a4a55de94
SHA1656d224a2b0426ed273c05f158c49b7933f03a8f
SHA2569a3c355d5d2cc4c9d4b0d5d3df200f7f23568ebe74e06a042ef1a001a8494f83
SHA51205b4ea43971bb5e76f80dfe60a7690f8897a49cf1dda50b7d5284b52c4f238a1927f511eb4c2dbd7d89815b561531b491bffb1895e90fda00052365828adb5f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570eec4e4ba3e232a65a6d69c14349ca1
SHA1d96cdb1c0c0b5d43068fd7a46eadeaf756c747c8
SHA2569644b2eaed419624cc5f5e4f142dd1e446437a31bd0913b16a0ac1371c11304c
SHA512a57fdb59dd4f90e8e2fcd2ea07ad9531978b7f84d972683febd293b1b6091d9417084fb8ca1207c682df717c00847f1d8c500908df2be72d21e5d7160f46abcf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b