Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
eeb73b25347bb9de469616b0288dff0c_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eeb73b25347bb9de469616b0288dff0c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eeb73b25347bb9de469616b0288dff0c_JaffaCakes118.html
-
Size
103KB
-
MD5
eeb73b25347bb9de469616b0288dff0c
-
SHA1
99a690d334e8c99905c1f94ff2d90db5e31d35bd
-
SHA256
eb46a81975cd9cbdcd702f41005d787a33b545c2dd8165b5ab39d8963062391e
-
SHA512
27a848fbf99c83ba37973955e97c9133411da886e3aefaeb0c56fdf93dd585d1e5b60c7c92bd4dafccbaadba1f65043baa7b559e940ed1945c449442a4c040a8
-
SSDEEP
1536:svAHNi7pmA39xBHWVI3vEkrYuPg2RyCL21RDR2xwIZ4+4ZMb50ghNxgefN3MU39p:cFU+4ZMbigeefR9Dt+J0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "233" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "325" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "331" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "233" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "233" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "325" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0075B171-77AF-11EF-949F-EAF933E40231} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "331" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "325" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433039766" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "331" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1940 iexplore.exe 1940 iexplore.exe 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2824 1940 iexplore.exe 31 PID 1940 wrote to memory of 2824 1940 iexplore.exe 31 PID 1940 wrote to memory of 2824 1940 iexplore.exe 31 PID 1940 wrote to memory of 2824 1940 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eeb73b25347bb9de469616b0288dff0c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594cf28f4ba1c8097dc51187e9cfa3b6d
SHA17e7dc0ac54ede4f722443dd5331f09d00bfc1932
SHA256553922ee5358237cc7581c9169ea14a88d2dbd160a27a3e78da83e64f1e65047
SHA512b52dc6690b90bac29791736f77e4d314183069153ce9d2151082e72da93244c93fac1107f7e93c2615d41c893a5a878c6a9af2ca40140234d144a83e3ea4b895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55917f591f2152282f836fec0d1650a61
SHA19a90d128819b0fcf2eb6932d1d1cc115258c76e7
SHA25682e41a1582e28e5ac8bed2760db2a5a8ea832624a98540c0a269e27d75c2bcb2
SHA512697bd928086b01de5370c42d4e459e3276406fead3b7bb781dcc05acf4e9a9fed2bf61383dcafc66d7c3c9f0aa733aafe586225686c5fa3a63c16a4e6e14ced4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e52fb44537c591f13a7185880fd1381e
SHA1878887e523516425e8677d5905cbd22c918556f0
SHA25666704f602a5912fe0c5eae73c80561d91b2abff2a2d2a71ee5ff5c9eabeb0c45
SHA51238bb9360e8ace2cb570a4d911b193283121d72d287102b10400645a3e5b3a062098419f46ab4f14d602afcf924c127ca5b46e955fb85f2e6ab78e9ba206f02f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f9da022b32edb7821553f0bd9b34264
SHA18a01faae25b5504cfb20f7b35982c877144a22de
SHA25688112291b97202118179d289624ddede866be04e51c84d457d74284abc477709
SHA512a3328084fba1f204bf9b4ded71839b1221f672310ea6d3c55378b641a6c6b80d37d0bb4e64f21248ceae29e1274a1db19ec4becbedaf865ce665b79df6c047b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56321638ec15a353957c41c81078614e5
SHA1f23395d86ee8545235dae8fb237c6ecc79bbe6c9
SHA256a8857a4531b063a266c25f13c8417c1724e1fe4bd11f97ce484d621fc90ada48
SHA51252933140590c21cfc650c82f955b92bf918a1ab8467bce7f8a850e10eff1c8da28a5e76997203186c4a02d0fc7a7f0a9ebd1558e6e4b56225bb304672df164f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f34513a9e4b5366ae6829ea2a85668c
SHA1ce28696f55b4c87c057618f65c25e7da24233879
SHA256b1ef1c4e27655ddc7195ab4ad248ed94d996e3f489b7b7748e6d2618bb25938c
SHA5128d0588161dca23f703cbf9faaee941e7948cc03e8cf2ea721878918834fa3c7d687f9406597ad9fe256291883b54fe2dab2de0b6d17878eff51d330563a7d38f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b460d88f6e0fd09c9badb1ad3a57cd4
SHA157bcb8c94612703bb0290267fa32005defb58fd7
SHA2562b24c46d5dc39099c83210ff54ff3bd63e0ab6668d0bcd20f8c603d0f60dcf55
SHA5124ba9fd20edcea22cea68df6c048dada68681b237bbdb51332566b73f09fbafb9aa2a6d7712f735ae7eba65514ca05e7c7cad63ac47d013cc6e23c4bd93f7d37d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5510e4782b535f2ab91e067ed0617dd0c
SHA141f20eba447a6376c9e57d23a0fc8d3568073c30
SHA256a280b84913c7c45d65ba2ff5a9201341b988544dd43073eb01265db924ca8b15
SHA512dd42ed8bbb25192dd2df451bc2367ecb8ea6d01e5aaf9a85391f87d044007c95c1e0e09fbe4e81468d0c8f1f887d0a8f9a43e3df0d365ddc668b360d19084b8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550a765d80283116c5228faae028a39b8
SHA15e95cb7b939beb79fa8aa2352cd3fef323918d03
SHA2564271904c6e06baaf063250fbecb357185f41fe9360ac5c6017266856b6ae1b30
SHA51210a25e8d6f3201727bf8bb921c6f1240fb2908373baf902612ba06a62fdd8cbadf323e438a25edcda31337a85b7118d2819cdd5b3a214dd4335d9542256c3e0e
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
Filesize
227B
MD5ab33f7dde102c33003a66165a38002b4
SHA14f0c31ae697fcc957f5e958816a08e94e2106b69
SHA2560cda235cb07d887afc07828fa5420be6b0c37be9fa4c3e43db74f8764f166c8e
SHA512c24ac8bba51f91ab9871d655c24d0f4f703f0444e75486671d378cadf5a57cc01a0b15096f96bd1bc82a20875fe25021ceaf2286f70f4f229ae76c04a74153ee
-
Filesize
635B
MD5a1d5d9da938482e2497201f2bbde8245
SHA1ceeb9886835d4ca72101712d7e8125b890787b09
SHA256346bca516ac187407337c5694e343ca5d65cf574530470b365079f1479a1cf29
SHA51241c334683be14d66813cf697a8e7bead8d54f59c75c459f2ee41ed6a3afc174d75f89e5fcd545c2c7f265349d2264188cc4603b56779e322a8d57e20d5d01594
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b