Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
eb3abfdd794ef2bbd8275b33382e8cca_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb3abfdd794ef2bbd8275b33382e8cca_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eb3abfdd794ef2bbd8275b33382e8cca_JaffaCakes118.html
-
Size
13KB
-
MD5
eb3abfdd794ef2bbd8275b33382e8cca
-
SHA1
d86882425881aa64e4f00cc4930400d32a51b4d7
-
SHA256
5c0ccb7be9eacde9105ddc530f6c8950fba46e7c8cfe08ec075828e856fb5ea4
-
SHA512
f68cc2709c0bd4252e9edfc5ce91aa3f097d1a3d69d0bbe37245add12de0e0fe4606fd19cdcccabfd0c3239e15b0d9a7553488313ebb889951a4f1cd27bedab2
-
SSDEEP
384:O9cH0czMomn/Ef9yBCJp9PwK8EPMt32BaEG:OyrzDm/Ef9yBapJwA632kEG
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99186D51-7679-11EF-93F4-C28ADB222BBA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000efcae5af3bd05faebb4d2486e7bef1ede335f09e135bbd1f7811285e835c84cb000000000e80000000020000200000008f7c9d1a375c390735b8e7215a28637f0a10e7636dfe82cf16a281e268412f17900000000c4c905588b07bd9e9f89b49627e044b0eb1479545dfb965c1d46011c98f44e74dbbcd21c2c06592949b3ce5ed9324802319bb3de5223f64ef1b62b7a63c3a60b59ef253a727bd6d410f7e2535900f7abf9be926bfdeb01da99db36e5d36d946a51ce7ee13376956948f76ded8409eae9fe399c1eb7ebe5cbd9b8933f275775192603b3297be5f7eb73a82d3c793c6ca4000000072b71291a0236f2845aec9f0e7a6c3fe574e0606e79276ae95db0a4f7235a992b66bd68fac19eb360b1fc0432f28ddd8c3415c505c009cb7e68aac5552ca3487 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e8996d860adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000d420e15d20d35b10fdb3d3badf64e798f6d245941fdb78ecd4aee6d38e0c642d000000000e80000000020000200000009c1ade13b78b49943c3ca2b070243a963dd1b335f66afdd1cba3103d48ed73ec200000001006787c44579b792a7a6bbac1fb4354305b0ceb4feebe5432f1bcfd67167df640000000bac7ab29dd0fc8e7791f1eb0ca47b3f10deb0c7af3b5c1f2badc0f28877fec76c4a55551777461418e736fb0a25acd8eb5179ff26d84925ece19470da0ed1920 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432906878" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 1584 IEXPLORE.EXE 1584 IEXPLORE.EXE 1584 IEXPLORE.EXE 1584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1584 2216 iexplore.exe 28 PID 2216 wrote to memory of 1584 2216 iexplore.exe 28 PID 2216 wrote to memory of 1584 2216 iexplore.exe 28 PID 2216 wrote to memory of 1584 2216 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb3abfdd794ef2bbd8275b33382e8cca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543e62f8357357d0ce3b05668d58742d2
SHA195b23138a2e2f730b20e9843fdb6d5357ca6eb59
SHA25609ffe95d05589c149b399671f0f7f328cc5129ba6dd70f0b5619ad69e88d59be
SHA5128e4336fb45d83df2984cdbdf489cf4c2213acb313e1ceb8fcba83734bcb69dafcaa746e6ceff6b2921d094005b67fd27d71f1cb0572fa192106548d669475fa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506347c3fcc1e4119c6edd80b29de2e1f
SHA1ede8eb84e7a148c8b1059247e9e5a7f244fb4bc7
SHA256f343b5d8045c976aa47fe162caffb786dd19900f06fa6b21725b2f2a48cdcd4e
SHA512e45039237563e868a1fd9566fe8ed8bdb1b2167547297b0b2f483e0425cdebd69f6239b66cf0da8d532655ea1b2eb90a8042575d6e265f15b020f90c85cc9e0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51873d0d7c8088c6cbaab16ad5ecd8aef
SHA1bb09833044417b478f6aabeb8bae3a336d19abf9
SHA256a0a8d4a5f2be526892dbdd29a8e50f6b10d0e5bf4a7d65d03a6d09c4efff0e49
SHA512d7b1122b10899081794a2b2be0b1fc50943bb98b5c36724c7845265c87067d1fd1527b0e06e2e4edce614fafae32eaaac74c1178df8f05fcbf05d0868773a8ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a94c7385aca6d57406cdef0542a5c71b
SHA173eaad4d8faeb74d5c673fa651863b0cbc6e1471
SHA256eba8b5eae8ded1ea3dba1fa3fb619d932e191286c26c2696533ab356514b5e65
SHA512b7c5dbcb42666a6557e80d3d4e65eaf4d82a6b02d5e15c8299c71d11ba1e6b56f9b2ed202d2cbc42f80e568819bd9c0a1431dc28e76eadfa27356243dc44039b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517d8f1b468bafbf02553ab66dffe7ff7
SHA139562fe6b7c9adcf716fe02e41e4e48d41af5a2f
SHA256f49a128ec3a8590e77aaa37fc52dde8a0815e7e09ca883b392ff50dcd4cbbc24
SHA5126707bc0c0c3c317d638400bbcdd5d3b05ec55dcf903755fef9dbf25ebb3d76e10aa052a70f8b920eababe8c9fdeb688cd26b5c064c162586525a697fa46555bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54963efa2ccebf691fcd1bd7534c9465b
SHA10f4ec876dee3be812740f698f0986f795768e024
SHA256c06d51739387bbf52d5e3448b99b23d7083876b051bc4e71c2810da5e29358ff
SHA512a5b3e899f5b38334743b08b6e9f85249c12eff3b2238ae76e54125070d77049264279edb6d877be4416f12560b60b1b77c7f68cb022e8943087beaa2314bfc5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfca3f8e86c5e7c97aafbcf3a1cece90
SHA19ca1c1f3870320df1872e855d6c551765cacb87f
SHA25656159fd355693bc4dc80872290b97169149fd87131fbf5680d6a5da36239c443
SHA512b760f622c84892bf839baf07d6acd903590d2f88883a8274a20b3aed3b6e791908ea5f6a003b7a12aa650bfc56843f8060d13b194b3cdaff840b66c899e5caef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b912970d7ca6c80ab02c9d44df2bf0f
SHA19c4e8970aa1dd942d9a1e60251200befa677d007
SHA256879f1e934253dea84528f5dec88bf5a7aa41a97f314addfd616af0c1cd679436
SHA51274db2f4edfde97d3ed61400e58c4744d92cc9766d37f8f4c98975a67682e22729d5b6a537f15f5ae0c718f0c04bd0d78a92dd85dca1b63ea172bdcad9e5aed85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551724fdc690e7051c36ad60fde869e82
SHA14a35eea9f77cd5ea97a5f2b5e4ffc04ea19a7e72
SHA25672ba95e6365ca39ca5b56f58e0fa855bd2d71233071746c588e2690c632d5ea6
SHA5124ade97afa9196b510293e5de9831347675cce57962b3d08f6b9fdabf2b86a1977c0698efabdfe2c07e982591a163c022f711b9f546626c75c571ddbc6b8f98d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517e218ec254e26d9e00ce4d2d6c4b6fe
SHA1da7528520a6ebdd54db09620d24cc3389f0a5746
SHA25637fe2082bf01526cb53b24c279abfaea2dc2450a187ab6ead8ab6320cb47a964
SHA5127c41600ed5152543d4620eeb18a934b61627a775352d9347a7a29d80741862fcf62cef2d35b9525c9798025387b7f5a06f4cb6afadc72809b7680419a587b027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7da985a8a6366c6a9c1da5e87f514ef
SHA100a49b74683bf7b1edb90d997b5162cce4d9c027
SHA25609466d1928f8cf23a451101c93aad9ae2caf18bdb26d0eb20e0d581482537ca5
SHA5121b6108ba181e4ed92ec79112f204367f5726893e44cb06fb03ee47fbac7b6e226e2c8cc3be0c701cf0e09b7f481c66f49e475dcda593712869b7981796bbf774
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b