Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
ef3d49bbe72a9efbc5e60ed354e2507d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef3d49bbe72a9efbc5e60ed354e2507d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ef3d49bbe72a9efbc5e60ed354e2507d_JaffaCakes118.html
-
Size
3KB
-
MD5
ef3d49bbe72a9efbc5e60ed354e2507d
-
SHA1
7dc855ed97f681233b600d6dca4fd3e6b6f01f73
-
SHA256
7703f3ec91a1182bdabee7e58cb388b6a03d31972222033aec1aea2eb9afdd23
-
SHA512
4b1946a840c3e741eaeec42e0773f95af2183d951a8965e325357cd987143f80c0edd4000769b5705ad34305962148081a2365769a44e2e35a95a24d471cf9b5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000617304b07e647a321072a94ee0d82bef90bc4fb8cb011c7fb41e9b7b520dced0000000000e800000000200002000000087a6430562b1d784837ad358c8844f948808e9628c8d9fca1ce78be931ecc65090000000c66d58cee7ae89028fac4a74368e327df0c09991325a4699aff4e867f3c8279ae2746feb3d23ee27ddd50b99a1ccd4a19d0ed6c4060434008ba941ec9f724d79f92a15856f77958d6e7e664844d0fce4cf787a4654ae5d8930834eced6e5f0e8b25481926379d55742465fead3ac1084ea358822abc50da4a775f0c9add7ba9399c08c587b92d7b9cafd2ed8cde3f8434000000022af2e11f746d87d0872dd02bab27f07a96f6ebe5a45ef55dc435be5a839b61448fc2ef4415df755beb4c8a4789e93359432ee2ab5305fca9edf45d290eb4f56 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97C367F1-77E3-11EF-BF4D-465533733A50} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001b1a6ff00bdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433062356" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000a248a43bacface64b9bf5b2360f4e980a121e351c5e5b8f87830eb8b0f596880000000000e8000000002000020000000c2340033c7f12fc915549f28fd13a9f25768cec37c4cbd265568014f7a8e23f220000000a6e2a690d75f5f4d68c4989c1103b9e19c586aaa49260000270f921f58c9f2dc40000000e3563bd43b016f87f8fa6a0fdcebd50e67cf87c5ad6e7a2df9226d408987c8a9530836febadfd4b62aa2105442e61975d011b1c532646c81bfd7c34a296a82e6 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2064 2060 iexplore.exe 30 PID 2060 wrote to memory of 2064 2060 iexplore.exe 30 PID 2060 wrote to memory of 2064 2060 iexplore.exe 30 PID 2060 wrote to memory of 2064 2060 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef3d49bbe72a9efbc5e60ed354e2507d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a88051612eeb88d81957b013e6e097f2
SHA1f3bda9e29724d19ba4ee01f4a1580c1d9d3652a4
SHA256664c59817691c6595c4dd9481f177035451e5149b8963055cda67abbfbad65df
SHA5125ca478ec2206ae09a23d6fa832105ad3738736cb9641c9ecfd145a586353ca448a286306ab8d4e69dd21f489024bd6c9d11b0aad2f6ec6144e89d28c481fc151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa828858e147bf165720d3055af1fc16
SHA1b2b7348cc3648ddbb5d671218e6f38f3302f90f7
SHA25686d413f80aa7f102f5dc42b23f49c7b630cea2e70034e9651b4055cf3af64bfe
SHA512e51ba2650aa51d3c800d49f2cd14704dff031a67d2c4ac76d37f3d3697366fb2b98fa0558be6c931aff5427a6317bcb203815f874ce0ba7bd9167aea4899b210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e537dbec7c1022843eaf75d0bc4f208c
SHA137cf502d65e6fe1cc0ba78fba908208bfab6b50a
SHA256763a03beb8acda1943cc889c912206c844aaa7dcdfcdeb0dbcbd5b75e9ee1710
SHA512eec8e565b90670cda01a61c0f896bf7f07f67f9557538167aa09e8006f49bca8683a2e4c2bc33ad58c555494206dcf06ed9df5e426594ee15f63ad2451ebba7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5679a47597502073d593ffd6a8dcd200b
SHA17fd3dcac7786a5693e9f4ca7a916536cd6cf9435
SHA2560be202c6306f446f132d5c502b35b9a5ca5cd132625f4b0e43ef784a84bebf6b
SHA5122ee725c2dd9cfa10c39b7ae147723cf584d767a4d12d9cf0eda00c0c657c3bc4d543708b25f78cb3bac4f6df6ed740b0a3d6bffb50d8fff524d53ba2c0b604af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51838b461701cfdf0b773947de07fe265
SHA15112dd3b1222231fb4f35e225925914d06cd2dbe
SHA256dd02287f893101f3bad3775530c78cf768780fc7a846f9a56b1d96aa91405ef0
SHA512eb3d1aad3ca8bd886d445190b8dc30acfe61298b885259bd89d0aae2aee5919bccabe6e99abd41f29a0130d0ab7b069b65a08ee71b251c11ce1b36a247326d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500e602ce48c39b58c1d2a9a9b089e262
SHA12aa8a239321932025da10c3b844525387ec186b7
SHA2560f144221ecd45ac8c5bc7df5b279edd72492a8402ee6b1230ca64945fcd4f93f
SHA5122067aa82f2c13d76425b8c920633643c485e11907cd10287be8620b7bffa44cfe28c29b32ed74b8d66f19e7fdf764a95ec980c4d0dff89daed47c1838afdf4e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a372abdc90bb2709666a08b77c1563ba
SHA1d45c923fc56f3ee3d6cd8eaf133e54d2383c9777
SHA2568900922c0a1bf83f7c928c3c8a5514be8a730b6a747d5d2cfa302536f490377c
SHA512acc5680ddda9b668b56008d90b7bcbdadfb8fb74e0ed26d51bc80ffa58bd80fe28168c54f8a8752b91e025943c54007a447a07fee5c2a0df876bbf7491c0dccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bef010201f755b43bfbe4d4fc0572c3e
SHA15fc7f826458b4d9f8974c766f39f3f1b18664d30
SHA2569ff139f7beb54283aaef45738f624e2dabb76c1960bd4b10c5d5e3c35ce9b2a0
SHA51283102166c03a0038af9f5610131294c75a269c536da3039990d60458076a793e2000e623a498bb288bfcf0f99bdd9b967edeed58a64692166a7d76531e70cd74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50541162b9cca591be86e0b4c8b8f6295
SHA1cf799fd0063eb57bf87cf8a03123f7d8638a1a18
SHA256f894297b6d0b629721481cc9dfc66af6039a6709003bdf9e25675edab0370b72
SHA512be33a56ff285d39a5f60355c0de8de349001b05f85f1a93ca4b7e9905ffb500b233e006e496ab12e3ee486fa72e1b38345a6e3d5764a32c2b642c30ec9455bb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5168632cca26188611f4704281cedc40c
SHA17738d62aca106976637f6eb860767dc5e27eea04
SHA2563a29fd4e7a012bea0bcbae1758863920433df707b4aac3551500913784374f3a
SHA512c107b3e61e8b07fc7fb19ded7231c364dc593d16cf1d32cadaaebab6d97b2d663b5918b191fec6f4fb34ce7ed30b4c499bc83769e2e0a17c4c6f858ac0aa942a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e54c250dbec66eac382e1f1527e63c59
SHA1f763bfa945f3cb765e1a3d7741828110ecf97fe8
SHA256f03590661fdd665ce4086e0d6d2e6a467bd8eeab351e64f88bcdfed8787c8fca
SHA5120360eddb2c45fdb7f509bfc98c72b80f5cfccdb716635714d4daad63ce4c5ae0714939f5dda7c356229c82d76840baffdd86cdff5ce241fd9a63c1676092cd38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebe18aee3e595a104cd05917e796924c
SHA12e7f144e75a378fc7af6cb75f10fc7cfc90891d3
SHA2561121127c8bd2cf43fba314fa251c3dcbf3c5a53af4edcd1c6d84b1db52bbe395
SHA512ae5506719f5f54a0572422e16775ff73912d718cdab951bdfce8d933d69df6b0f6ac5dae648b8ce5909ac63c960f8bdb7566b98b8dc9d4021f3e2f5565ded82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f34fbbee816c6fb13c452ddd3ba30c5
SHA16d8e3373791ec7d40196d7683026dc8d59590235
SHA25616c431ea7739e6bf7b9b5b95529af2b904a0da619574d223516c74162a12e758
SHA512de9a729262f4e0531076cbc089e231802969a3b9306095ef25b92e35593d7e6156379259239633fa0c8f7e51d1290941a27034f29311041895a5e506107e0a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbc8f98d8b042dafca2aed9f311ae99f
SHA1b6e30447139b2a74bbc7bec66df6b5b226e96a46
SHA2566f1506db47b59852a20453c05c1ca2493736e1cb4328ea4081a5d8134435c662
SHA512e85779dfad8ea4a566227e568a752c9abd8b89fe114e6842184a842186d4e6121dc98289ed5cbb4d04d14f4f3e65b46c1877b7fdcdef4d7bab1024b78eb31b6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eb4085a6724035fcbc96eed8fedd85b
SHA155f0017b13ea7cb923f8eb6baf98d7df1d62b09a
SHA256a71adf58c4fa296cea891f21444a17b7cc4b7d4c99d48469b31b9c7055063e05
SHA512dce10d893e139ff35fef1a9b4c738e3cdf6dc6ef776dbcc7d78f8bf2901446f73bc66c8434a2445a74748b0ad82969cd46e17c5c6ac777402ea1036782eee320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a07127fb4b15c0cd943753a2f2477974
SHA19009e73d273090aa46d88e176095eea8e0452015
SHA256d40aff086f21408ec87eebb22062eb9048a4421dd6d3d5b75b8765b9db7eab05
SHA5122892540fe0dd59078e85138240d6042ea4833b58d21ab6c48f787300834136ae53f536a8acf1ea906579a1a25dd5a46d70324678ce655ef1df9e12c23fd97281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e71d03c6e53fe750ac724f9df3e91bff
SHA19854634fe3cef3c4d2ff766030cb2dee606d0a1b
SHA256e10ab41fa4913daa83f4735359e336ae76bfb87fad60b4fbac160a927e6f0b49
SHA5128c7e122d1998ac76e75b4eb557d9790a50cb7b7c7a77572603d5603e7af29f4e70c9fa80545a4cf56a1824d90e62805e988084dccfee18eb2288eb70028aa83d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5aad3f22148fa7085ea662e185ceae2
SHA1ef8e78903be77d23e9a6c067148de952e4a75377
SHA256d4e7cbe4717645cba76e70a48672925914a9aafa14ef05136ecf4c1d38450252
SHA512ac78fcd2514568d30bb62c2d9ae09880e67f7aa04fb462c528d8d4a75a4694669b869d8db2e4d3dcd1bd9ed1851e87b55c6d0dcd5b6ceabdc5e65acbe16abac0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b