Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
f5842f70653264a79c0b295183e151db_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5842f70653264a79c0b295183e151db_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f5842f70653264a79c0b295183e151db_JaffaCakes118.html
-
Size
2KB
-
MD5
f5842f70653264a79c0b295183e151db
-
SHA1
c791834d072e2bb0bb4a51c8126280c608587071
-
SHA256
9f7f7a03cce4fe8296c8e889fe170a264534fbf427d273dcb2e0feeb46466c12
-
SHA512
6e38289f1ac1bb696be267ebfd765e912bc0386c61e77de80f2697b2edc05948cb9884fea319dedb486d3410768b5339b417d28f909179e36888587932678c5a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50DDCB61-7B11-11EF-B939-7ED3796B1EC0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000066e3348f536545713b18012857295b90736dba2814ec03167c37072175e067b4000000000e80000000020000200000001e03fdfc425a1770696fbd480b1eb705b92c42c8be089fee3ad3c9744697454f20000000eccfa203baf9d20f23a0330d1d9a36a668661cc3087babe4ce9a61c23a9aac8f4000000057e3d993ec0f0bdecce797e2c757ac452960f9324bb18f9d7220615b2923df13b03be7e41676031e5b9e2d778f95f476431561884eadfa648a177fabe95c42b2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608b67251e0fdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433411844" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000000b3398191313bdc9c2662246f4c00f834407972db8e7c650a277283ac0ca949d000000000e8000000002000020000000d0386e2fdc17d1aad9ddfdaab98fa3444d6d76f2fe67ca7ecc156a7abcda769c900000001d67fb25a15cd00c8f4257f29c668de1f65360c09c0a06847781bbb0e822f0e1cfe2292b6f1982b598405a8b9887840f63ac7fbf74eac1d02acbd33a130af7e16b494e82b5b74e47309ded1933d202f711eb97801f9dbbeda4a1dd802b2f998a826b81c6e43032f9fdad4f56bff68766a24a369154048766fac3ad2b6b4421e21698fa4a5ffdd9521cde23580ad8357740000000d28c912ed5ce5bdfcf3bfb392e622bd211077c93a085b36dd99d66e30802faa47785dc242d15cbae62e54d0d097d0633859d55d17136b2fd4a81807fbf3fa658 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1892 iexplore.exe 1892 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1892 wrote to memory of 2700 1892 iexplore.exe 31 PID 1892 wrote to memory of 2700 1892 iexplore.exe 31 PID 1892 wrote to memory of 2700 1892 iexplore.exe 31 PID 1892 wrote to memory of 2700 1892 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5842f70653264a79c0b295183e151db_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f1475861d2db3259fc3b0e1b65631ac
SHA19f9cd2deefb2099b08ff283dbe3588436aeda27e
SHA256634f7859afb9c5c9b14fee822ea0bc59ed1f99e092efee5df5754d6db16264b2
SHA51263cf92fee2f11db087b2693f71f1dea575a012f3cbbc280a2f678303bd7954cf8749069dd087726880d53209881b586417801d8a41f556713f2ba2b84cb55321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51540d9c36bd2d5579230fcbbd2c9ae99
SHA15541c0508cad1a32407f8da3b15750094f2a76a4
SHA256da18c5c892ccb75d6e4fef21471f311cfb3e3fcc3391feb59094f3f81b4716bc
SHA51251643cae525bd408c3ba336461bdc7f6c8dad4725148f1bfc336e230cee5cea59d476ebcd343e3f1da9d90a4033d29a8329eb36b707d6fbc0af1269993e14ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4afa12ae6dcf832f2a06f957a45cb1f
SHA179697fac279d8e90e151f21ce4f045696530cd7e
SHA256cf153604774030ce296da49d4410fa9e2a19760f5daae24ed6244de12daa1450
SHA512bedf105c4e5d9f7aef75a0539480b57ec8aedaf62d8681269ec27ff1f06b6e26a3e61847086420b54a7a59d917ab800b431b96d95261fee18ab7244bb6ccabca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff50ccda7b5046a3033204c76bcb2548
SHA1bd1ee93da4ec0bbe85886ffb1119779a78f6c227
SHA256fc2ca664a26158d2580361927af81d970cfec830b6c247d236d0038551f05ff2
SHA5121a5f28e42235aafeedf5f0209ecad962ceaf1c3b18e038e51d2650e90eb7fe5686ae637c3e0c0d29c0cc7af2f7fce411db23bbc876afd90c7697565d5b650302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588096d4172d311033438158c4d98dd95
SHA18773f1cec193a2935b9e89337cc139388e37d44f
SHA256feac69812b9bdccd8299e9eb80cae7ae6cebde00bc5d47542627d3ba148a38ac
SHA512a8a2af3cd30c8a135dd42fae336e1f39aeecc55c1709c88d93ee3af35889130ea69e072d75e0b47feb3f3ad5256f8910a593b200efa0b2780d5abfcc032e1763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534b9b8dc0331bf43b76866b718f2627d
SHA11da6af6471b53895dee86136a2c4e5bb21db493d
SHA25672f5a595f6827a7d39f5b4a5f59afe3e30f6672d582673488b7b6e2c931fb41b
SHA512ad6db1593e3bc990d73297d81e618b63720ff8ca8c0ea19616e5dfd65f0f0f28b4000e0086d0cfdd80d41be78b1d1cec90e657907681de4d7981d0a9f3acf0d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d076039946d1593bf44367f510547f76
SHA179ed81b205515c2b1e8dd0059bc8e813df8596a2
SHA25652fa32a35710c420230a68dd5d3ab7083ced1f044ba11e54093f662d692db29d
SHA512cbffec6d603269ca3cbb888d67fecb52c047bc9479f6d973390ad469cc748afd4fefa7b2306b85735d8f1b77ba544b68ed9cae8be433843d566f11a00548a7c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e0fcbe6f74743cae7f03005e968683b
SHA173e3b4dca72e820ff96670e79440a9579a51281e
SHA25673bcd3094196a08e05ef509027276e6060a21edba55fa40b81bb2fb919016897
SHA5129be4e63e724981b304c4c9abbf948aa464aebc58d0c49407cd26f5214847fa7266e781678421773ee47e247904ce84b045f3604e32b813a4a1a211427b0e0fbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8b8dc99d5b09850acfe7e87180ab5f5
SHA1c9d2517f084de62ba4f1a0c4f4bc2b2d32de0085
SHA2561026ce1a9043328c822d626fd4b0248239c78ba926617461084fe46881cc7cb7
SHA512b9600e1a74b94efcef3ce271e85becfbf5169619849a885325fd767f211ca1adb42cd9c722fdb707e19aba596500e7922f673d93d888bf2ad2b7c98b3d61bee6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574f8d60bfeffa68f372c52cac2a8b2ee
SHA110de316360fb313afaa7e2af939a42eba47a87d3
SHA256acaa2ed311569fca1205ff42c371945730dcc67cf6ab0a8129c98f0d4a8b21ed
SHA5127a189d7e9080b578848ec162d274f4ca6e7a31d244fbdc948ffe9b4bd68d5acd9b713fe5d216e7fa319f2fb4bca87937401971428a1396a71fc2f2cebb67e33e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2c01d14ddbe09dd166ea2f4b385668b
SHA12f91c2aa12fc8f12a7fa369691674dc1ff1dc80b
SHA2566a04ea4cad08b588a8eb48fb32a46cb63f2c4df1512aac3777eab886d4af2328
SHA51283451cf92b9cd07b2adc9c6dd7931fc56d819ebe81f10897327ea31876c9c1ac3b8a43b897fcd55b50cfcbecb58089d6833b391b75c0d83d14120a216a14f98e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540db7d220cbcdfb1ea2b33696428f515
SHA10eba18eb2cc184b613fb589df0679837873b26d9
SHA25611bcaa7c30246b85db409faa9c7423e00771ccade80d7eef177b0873146ef902
SHA512ae6dfa061035184edef1d70ebdebbfd1e23111520c211c030976abf7ad05a1854dd29d4e2ce26249d2599911fdac277cd58a65953ff5870905205b6e5608c599
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a5c5fa30013a062a9bc6326769e802c
SHA1dd48661d64e0dc2c324039cfbf7c29ecc5131569
SHA256937b3144643b99249e903e9449324242a7bc756ba5786f7364f239debf2f5f55
SHA512148ab851d512b6f5d5ea0a138daf01ce212e83057d9071874147a3e2e7868e063b11dcc897e48f0b0f6cfc2ec26edd65d250a8342d9369581d07bd7914952f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c947b9c1064f873817cf0bc26466c265
SHA17cf26856515c75e932e89ba0a9f273da4828fb63
SHA256994a2db47c058e5d8ea17094e324b05cbd609947ed29bc8c7ec1b6b7b341552e
SHA5122a2bc86ead9927d64b7833ae87ecf9185a1a4642726f2d89a76fe96c12580cbb57ad6c9d40e68ef4d20246fca55ed05a230323bacd15dafaa8c2a130d3e9dc8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d49f4819e21a048977070fe9077f02a2
SHA1c46ed3342bccbd439a7de2e7c35100480e50e46a
SHA2563f5376b0090a000894954552d9159389920835768c073879c33787fad79ba440
SHA5125fd916c96c7ddb74691d51e70a3a969c470f9da86f5f83099f5792f9a0e4ff06a93811e0d1dc382ce62727fdd2e5f77f23ab61109796be059bf081d72b4d5964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b91c698efb18ca7441d4ea236fc87a2
SHA135a9231460189962ad3c47ee30871bd4db281b6f
SHA2563adf526b7eea637f7db50c5436ea890eedf25ddcaad6d1118ee30c162a11ca7e
SHA5122b709fa5c89af09e2103e9c3d5d5575e86d1a37ab98ab36e782e569f1cbd9f151497fda1b95c4fdfa5beb691a6c1922dd13952c1ec435837f2e1ce768e1c926f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eb10d6a0ff132d5e9f4d66e5cd17544
SHA12db8bbccd4cea17ed9492bdce539c6d39e3d800c
SHA2560b10f4114df31e3177e6ad941662452f5651a46ec1c4dd1a22aa74c2ae498b8e
SHA512d06d0ffd04ef0b15f5836006e8a08de105cb5a709b7626f8de848b3647e05d6ed57ce4257b3bfe869a36ea86c2da179fb348570f5e05eafdcaa4d113cfb56497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acf6a57399f7ead36db01c609c55e787
SHA179d4cce3ac48d9bc25ae9a28f3ef538bd7261c9c
SHA25667c0e4f5520e7cc1cd6ace03369fce5ba8ea7326e3fc1706b1b376fd0ba25f1e
SHA512f70a073edd973efc37402d9a1bf71158dea5e6a73e360e470d4f7d9b9042ddc0f7d7045d309e1cd9e58f3a7cfd715a108b90049bbf3f839b700cb0a19ed7947a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b