Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
f0d117e2e13a6ffe31e54c9b608944ec_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f0d117e2e13a6ffe31e54c9b608944ec_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f0d117e2e13a6ffe31e54c9b608944ec_JaffaCakes118.html
-
Size
70KB
-
MD5
f0d117e2e13a6ffe31e54c9b608944ec
-
SHA1
8fed9f325e7ab1fec49ea2f859aa167f50d8b872
-
SHA256
272daa8ff9e8080318b40c6a349a970dc2f1bcfe7a3b3097c6985886f8d9b804
-
SHA512
040617e84cdfe80628ff07c392cd849b738fad8475160fb3d467c3b61e4c1f9459bad73695e07fc27447a097673e34361b74f9b81b3881a062dfd9aa327ad45e
-
SSDEEP
768:JiJgcMWR3sI2PDDnd0g69QSfmrv7UT/oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRe:JVZ+mrv7UTgTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B315261-7870-11EF-AB1A-5A9C960EEF88} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002c2a53f76391db29dd48d54feffaa550db9358f7e1930cab83d31d90430994a9000000000e8000000002000020000000ea2240b63446c414208053c4bf3ca162e9c30b674068ca9872795b1ce32f94d320000000c27a0f9676bf15bd30c2bd2e6bf4ede825b9ce560e46583e86969b49450e69084000000037cf0466d44a6d3bc3fb3b417a9dd9a617878700dc65c375ad32d818f56202e88697058853625105d55f8fb1c0502f66f252e34590b20b4233599e194a65508e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433122811" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a019bf2f7d0cdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000090a6454bea6be020f7c3cb8d28a6c6a2bace5694f059ec24fd3b9235f06a7185000000000e80000000020000200000000334d417fb6f0a87259846bda2e218a28322443e344419617d4dbc6885c853bd90000000b1d7a97b6fb2df155097e8b7f04d37eaef850cda7f2c10e8e88eced56d19b534cd2f3e4fdccaa9cac795bea86128c09913c34689a022d4271631420d5f8737468b7c90c338eabcd4ce97e680babcd9174266137aedb6e6b5fe812d1dc657d575529adbb95014f957712622b702a1ea1455d26130d732690ab4559304c45f4053ef59a6967d401ea967d4d22078f0878b400000006c45faa4654061b353f3b820b718f801dba0a956bc88259ef94286a3eee6cf1994f33579a468ae73afa54d44991c7b4b0f94206e664bf9978afe24f36f42b89f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2696 2932 iexplore.exe 31 PID 2932 wrote to memory of 2696 2932 iexplore.exe 31 PID 2932 wrote to memory of 2696 2932 iexplore.exe 31 PID 2932 wrote to memory of 2696 2932 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f0d117e2e13a6ffe31e54c9b608944ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9328937cff4c308d17e0edf82dba5ae
SHA1616d3997db5e36ca85f181b7011bac72aa11f594
SHA256358888cec5ecd67d47247dbdd1eebd3c77e9645f68465f8a6fa528e504968e59
SHA512cd89d3217da69b9eee24cc3863df8c02edc188d6d30fea0cf36976d61e2de292a2b854583c103600179de7e30013672f7a9dcbf4b70fcb140a8f8e187209ebc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f20d0e6a1b006428806f11458b72fb9
SHA1d9dae48e6cfa2cb0f77796e5e4c819323d07e984
SHA256c9ffe140ee4571ff3d9d0139735ae23dce453a0305b5fd20868f8a149fd4dc3a
SHA5125cadc1174352604b0a2f2527d8590b0b890fa0d8f858e4a0368f20f0ae33610162a0df5633cc0b99d157af64d1f1569d03f27e24753c26d56045f6bfafb30c75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb55be9b39bc703959243012d78a9728
SHA1e849242e115d4fffb3e33df41356f1ef0aec6ab9
SHA2569bc6b5056c1d14819bb0d062bc137080aca258bd268ea28be1bba21a42c85db6
SHA5125b20adf4b4bf859f44c3ad63e4ba32084254b022593d28826ab81a3c72785860417ef8f0127a04433765775d2c10d91e0c1971d9d0611045313468fb91f04f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f84c89a0ddd3cd66003d7706742aac4
SHA17d6518b6754df88026c54bd72db875af31f4f3f6
SHA256a428737dac3c27e0bf82997f45492f60501796fd5558579ef5f5a4408a9ec23a
SHA5127cf01a122e7072afd3147c30e092dd9ace4734857acf8fbcf61a6e36e858be46082f176355816c1745869d4e3f0442cbafa353c9e9c27c1ddc32dac7497f3589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b9f2c153e58b2e0094d9388c933317d
SHA180cd1c393b5c3e7c129746b5954f6d015ab8d868
SHA2562011a354014bfa748e1474d2c6f94c0764db2349158a7094d257b86e5b11852d
SHA51212c5939a3bd6d56dd8f562988a84b12b0294237a7d52fcfe3aa9a85950863c981b73f8cf49d024dfebe91f7c55f3422e56ce4fed97a376738cc1ec70d6146f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536b523448089ac8350de55cb399f7581
SHA18cd868c2fcc1fea435e7220b3d88239d5c194888
SHA256b81890f67b287b80d4f62a6bc21196b4878a8ceef2b4bb8e27a12407493538b8
SHA5125e109e9dc96e06cd9a99afd3e57d10ffa92bdc82c4bbe9e8f6e9a74f4ad23b20649813c221ae3751d5356b4bfbe9581ae817d1c08cb43ec6b80fb5763588475d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2f47ab26d2c1258b76519e1264476c1
SHA142d0fd987f7ea8dd3aae87aa4a74d9971529d945
SHA256caac37739869f856b42a8aa7b155af8add22bd8cfb7e010ce9db0e92b4208a84
SHA51245f4396311e5a089a498d06c1e91558209ef63d1bbed4df77fadca47e4519cda16d65d7ba9e12a0cfbb99d6d25a845802b22527185a714ed9d7421a6c4e41733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3f427da523f5d1216c749210b97c2ff
SHA1ca9ed3c951a91c07c20fdf66ac4074146fa8036c
SHA256af7cfc1d32ab826df90f4d2a96bbd951ca6190e2d373a650bac4b6f9d31ea38f
SHA512109428b752230ed82ddfa9d9a37ae3986d233d07c7e4a2da4dc6370d4274925a1f218f7986605b7a4a896ce3dc44974c046741b478a448319673c2e0671199ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5083afd439e03a0b8e034043fd4365bc6
SHA15f3b5fa46f5993f0217a8e3035ac85da24ad6c44
SHA256df5001d0aaf066c6925ae4b4a357ea430be931e7010da7cfc43d79ae58aba519
SHA5122e4dec7d6f827dc6a47bcce4f9ac63700df4970fa3c350283c7343be2a751b9aee6035de26000c9797137d4316da5bfefb26fa4002372087ade741c32c75cdbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579e6a3f6a3831a1e7d52c8936a1a146a
SHA1e720786f11efc7da6c23f3d7c48adccdd8bd1a5f
SHA256554d4886bd4c2e01be1bbdc6ba02670de1261ea206807c99a7b8f1e79827cdb6
SHA512af5d307fd3fd65ba40c6176d01fd7a85d9e7acd7bd918e4555cb6759f8283f16009d7da534341abfafb1b90aa0d76c747ccdc62003b1dd28c77a708f8fb87f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4916387121e75c86e3adb57ae85180d
SHA128a2843d43af13de79a20ee65180d1d606dfb8d4
SHA2565d9cd3ccc98d809658fd5ef428524a616c4efea91ee726876210a4a7b3d56288
SHA51213aab3bea04c814fbc78c6fa72071a5f325bc92b97a050f81f006a5338506ff02136d6b4fddb97379818dce0c27c18743cc7e047a6d216bf8390487cd960dcfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f388b038cc80ae8ca9a5fcb4cdddad6b
SHA145f1440cf36f08cb804847f8405a3eb87d8e1b91
SHA256c35b90f1300f6e1762cd06ddacfdc3a4d7f30fbe0f812b9e05b5b1abe696ad25
SHA512845941336374e31ffb06b1176d41b6b5a24c48e5da8bec59838962dba85932e8437d37b05f844484321bb9481f741be7b66703b9c1be406c53a9e0eb6133c385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52045811ee78cf66988c20be189065066
SHA1f64c4448f4e3d4419fbcb10e4126ee91d969708b
SHA2560c39d8a5a59ccaf205a341d9a0794ffed0e82dfbd5c1d8b555cb77aad1cfb0ee
SHA5120bbfc2658850f6fb8c162304d6c286caf76de9268487cb39c7e43a778b465337475bb5ea4c10c7a38e662171dcf46236a93fd890a440f9e09fa8a01845d838aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b46889b6797b369de1c611fdc40b8c0
SHA1f46449a63e866463d53c8e1bb023fd1da38d3ef2
SHA256eb1b6e5dafff82ba35024785ded392ccbc7b3f7620b6ec885e9b6a1ec7003eb8
SHA512efa4f0f1e00ce6aaf2e1f874a6d4d8d84c51f6258554600bba71d74c6741a102e6305792c0bc226c95a1a61b6c8be8bd8ed4862b9b92d818da54f442d8c80fd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1f0f11cd3d2347519e3bc5d2cffca0b
SHA121f10f683eb63368941a6ebe95e9d3137d36d343
SHA25676c6beaafe7996141b6047ed26df6df9f8d60e5f4f732134dc8241fa2425bbec
SHA51216ff107d32ad2fc01dcfddcbc5310954d50983b5dee85e1e2237b314b26ba05aa26efb2279b010e0f9523b09884e0b148d89853aaeb86fe075f0a53fe1fd4cfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d466557561e1eb8e553ab29b8872c94
SHA197d8a9b8724a86d424e325bc05e3c6e4a024911a
SHA2564eda1ade8babb480098255354722aff2df11f68c707fba721b61e31509ce0bbf
SHA51241d12e7b1b6a3221fcf56d1526ddb85819dc248294d43d75517b01f311d2da2a7451f354a9a55831cb8db0c612493fccd723723c4b552da2d228414e4c50bca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0c0a2dbc8c52d0f867261b1ba2f4032
SHA100c4706bc90aa0bf632ce6ea53192c94d802ccee
SHA256e94951a3e5fe970eaeba5f3ddaec198b115cc96705ba80965e741a213ad79069
SHA5125ed0576f43d126cbbc77143bb38c48e82385f1fc866a89824978c7d751e8934a6abdd350d9a0c4e07b022b423f7966070c1af747b2e25ce7b10fb9ca3afc53d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cd0336a4e46c5303ac0e5cd93544af5
SHA13d98cbcc0c0dc9d9c57f82d3a3663e128f411eca
SHA25649977d6a645d56b37eb370b39abb4a5f10b0c5d9939b3109b54ab44080d8fabd
SHA5122f05514cab47c4123d06884736cee462577e0321f8b88ca56c3b0128cb4a20feba7935d8aa6069fe5f74e7d6988a971d5d2cb991931dd41de8dca2c4e8fa76e9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b