Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
f71c0826384da4899d103f6a91d82159_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f71c0826384da4899d103f6a91d82159_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f71c0826384da4899d103f6a91d82159_JaffaCakes118.html
-
Size
139KB
-
MD5
f71c0826384da4899d103f6a91d82159
-
SHA1
d1067d956111a92a76f5e1f7334f8444ba29e733
-
SHA256
b014e2d13a42a603e94451fcbcf8db4fc556c5c0261696fb767792376e937461
-
SHA512
e05150fa9e1d285edbf801c5bd810ce788bbfe0abe3ab9b7f8cea72b784d61b64029adf039fa7988ada858a4a1eaddf1b166c328aefa17d0df305b3cebaa8318
-
SSDEEP
1536:SdNra4FMl3FyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SdE4gFyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00ec0aba60fdb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008261f0719359887c360504a1436dfcd474035088a7150c9196e5c483fc4d2b7f000000000e80000000020000200000000a0ad3b22b99074799eff9fb68dfb2ea10634628ff2c7b61d329d21718a99bff9000000034310bfcb1e3171a3fcee9b2153f5091b6f57574103940b1e24f009e9b71d286dfbcce909e9f3da59c259fd4cdcc8586d993f192092b2af614d5587a9c868e6df80f676c52ab094205fb7b13ee6c0c62ceead7d23a4f296d196cf548b9eba3c3b86fc490a78b3d91523f8a3df6be25ad6d6299a6a36f579383074ae5c3422084e6e4ff79c67f72297c0fe82307096b6f40000000d964ca430913fc7c6483c1120a2d0d70417b869cd4f1d76b86eaa7a5af8350c9296939e1b1ae6d01119a857cdea892ed1bcf93f2a08ce3f0dc5ebd4f5e859605 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97E3CC21-7B99-11EF-9E99-E699F793024F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433470377" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000030bd4d7d4daead36cec36167df681f83f7f3e3ef5cb67cad9d388c0e33bbcd9b000000000e80000000020000200000009245fc15add20a1e1edf6f86822ee8c6478253b2f4a17805473558bfb72569ce20000000bfeebdbc50def20c3919fc19dd70d8f9f88ca7b61005b1f79e8f2bb8708a9fae40000000e117413573ae6cf340cae1b74cbc5480fc7d2e7cd87f59723f040bf0b0ad9d0cdba0da810a950fedc8ed078158a2ecb62eaf36c09243eac42f8bcf96b49bd0b0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2260 iexplore.exe 2260 iexplore.exe 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2852 2260 iexplore.exe 29 PID 2260 wrote to memory of 2852 2260 iexplore.exe 29 PID 2260 wrote to memory of 2852 2260 iexplore.exe 29 PID 2260 wrote to memory of 2852 2260 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f71c0826384da4899d103f6a91d82159_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dccef70fafd899029d2b73b95846917
SHA1ea213e08573f77911edfcefbb777503a68a9c56a
SHA2562c9994c76ebfbc23271b8e04bbc3cba0a05c2c83c5401567d2e7e8e6e74d4b09
SHA5126c5edab404a762f3ec13d42463f1cd1e53bfd3c6e87df0c55ec28c0169d5cb4e9eda054e2b47fe49bb5b3a79052a77fba626ca4a10647f10312fcd46f5c66abe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d1ab6485e9fdae06f2b1897ff5e2a03
SHA19f2dff127cc6313a498c0dc9705be8970880077a
SHA256b9f9da700334c6ed7b7e4731291e65f7d8e351bd6bb5dda13e0f188b36f71c57
SHA512051e172e5cd6237225945519a65ae60c1a657ae2bc6c2f965ef57b3326ea3ecd4981928ef23e1312e1f8f2fcf25ca3167d61dad0493c52e40f261cf5e8bbf958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ce6afee794083c36036ede329908aad
SHA1df42cbf635d257c214c58b54a1532b7a20ccaf6e
SHA256e346571669be15afbfd647947fddaff967aef1bbdd955731aca150690b803ca1
SHA51213d8ba66116818cf0f70eaefe918535c1c482fb85c02ae19be193f8a22a6154cb48926b4c0e0c1382cded03bc053a668b67487524542127002c971611b682812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504cde31e8f84241556afad12a43d8b72
SHA1f818bd9b20ba72f3ff84df1f95d10681dcbb7fcd
SHA25638eb2f4f86875fd9c2c36d4fbd296b35056725187125b6a8c9eb37aeed74480c
SHA5127bc3dc016597ef51dc4c650450cf36ecefff1e7b703015378a61fa246c4a7f9240a4bdaf7b261b01cff311b978f68021e5b23bb067b6c40a9aca31e185e03aad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5263095ebfab947917bc9f049c4b5e8ac
SHA1eb953708be232a15d0d2708939fc869170df85d9
SHA256fd0eb41fd2f40b7d9851a4234d7cf156f357477a57c27826c44dafe3da43b0f3
SHA512a28d4f465aa177c91a4d0d65c0f96cfe5f655b8d7ba3c87867dc6a4b95be8b8f1e2d38d5d88e7f663a3560d2c9824622017df3dc684cd8ba805136b24345a853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7b8d15d1de9f41b13542de8f0eb3c5b
SHA1c9b8f944705b2972d627ad0e6e2bd11d27b98269
SHA256c4f40ee827b24dc61dd350c45e7f6eef3832988ab66b51b1cc0a0a816b507ca5
SHA512cdbb8f1b11fb6e54beb3da141cb680c2e0dfbeda31e5121a384ca716b1ede3b795955105f385dbed24c35ba567d2a017428878e88fd85429196f29f6735b8c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdf0c0d2923c173c3871684d293491d0
SHA1b09d87cdb25c1d2d96cb9804d8e74a1fb447fba1
SHA256737474dee9e0887647cdddfb97c153da35fc38fa17b54c217d88496ce9127b7e
SHA512f3cc0d0bbddea90750eb2b0c75a56684b53032031478a47bed2eefa7709552781ddd0004626a456fed8f8fa838295e27b7d3397ed6c0b80c240f1af98a5d5c87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58304dd2ac67fabb0371d9ce863f82df6
SHA1461b85858a80b90a103963b834dcd1f4cce1036b
SHA256c8d51e68f35d76f39d168c1caa4794ab560b9f15da6a5406b755ca8d81775f1a
SHA5120120c2782d5068dc7c47bbfbd26e0cb598b2d8d51bb4ae7d98fbb99886b04985199e4bae0ec8a236203ac0fbb5aa87e352147dd579befacb8bb56ed187bbe5c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d53e2786813eb939ba01538aa4130b89
SHA1c8165aa5ed157bcb8a21032a5f9d2e71a933f3d9
SHA256f5bc5a91572e56ce8a7eb41e8b4403e29485e30e6910bc8c19348a1cd2d2b1f7
SHA512a250c1bbdb806c3950e5817a933e8468c8b50fb1d02d3fd17d49177357f676298f32ee68c62f49d6cb128c8575061de0b824766527d0d1a5d3eeca2a981a317e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e2f9400450b3ee12f7bae57fd3d0264
SHA16f42e73fc773e659acdd0353b9dffeee55e165d0
SHA256060e7bef5b6d6c4c0e0c22ab45b7b0f546d98c85eba95907575d9e552525a718
SHA5124fa4a8190a858e2f44036acd342a188b3767dfcc7f57a19e78637c50fd8fbb67fc9287f0236278749a2380655857f0b51efd4b07654ea92ca947c33562a28d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e93f0e69e9b4eb0cbe5840bb155659af
SHA1a220e209ca0157cf8b47b8edaade3c5833d0d515
SHA2566a68b5ded081be66eb9bec16321493461c3687540f9436d6f10ae7041a6ba597
SHA512d18f7b53ca14cc8528d023c40d85816a6940fe577006616cb5fa0c4af66c726dc6587ee2c3dbd645db1404139695a438c006bcce42c66c702527e27881c6c409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535c1dc1872c0d8ed10236d93a70b2889
SHA1cec12f4fd8f92e1bae93a891325282a837039ebb
SHA256c41c20bcbd4ff802dbb60a689ad0a0d9e7ccf87169600fc0e16e28fc9e32536e
SHA51296b337555cdf058ccb0d40693243669c65c98bb8d839301d3281ec9fa5ee04ffe1a210850cbf1a5ae5bef91e05c181dc43576baf7b7c7245d522c2cfddb0cd57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5879ea864f1e4134b845ffa8f8234d585
SHA14879ba9ac03a4697bafeb79921cc7dda828dc913
SHA256c82a4b40b7bbd3d737e741d5f8b7cd41744e164781032e84f853702081ffff33
SHA512de800d1f16dc5edbb1cd45df63c65ee09674e84cfef5d913d34ac7a78aac652c3a1fd40a9943abbf9e8dad28f2a825327bce01a7b7aea222c1736f7335ecc922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552df0324ddb03bda22ad0e21d7bb80ed
SHA10207dd6e46ac2d89a155a952bb8a59646d36697e
SHA2563b7860fd66d84564072b93b554820939d7041b23243f5c7546b5ef5976ecbe93
SHA512be0f6c8b1641a59628e00841611a8bc2c1f6dcb72e6fd6ee9e4cfb62689b62c174f3a992b3686a1a9f3458a75a112fe19ddf563c8691575a4620dc2e3eafe4dd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b