Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
f601e6509e0a84fb132280d350791bfe_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f601e6509e0a84fb132280d350791bfe_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f601e6509e0a84fb132280d350791bfe_JaffaCakes118.html
-
Size
462KB
-
MD5
f601e6509e0a84fb132280d350791bfe
-
SHA1
233bc2b1077a41106e77dfda9dda4340d14297f2
-
SHA256
a488667f3121e486ebf99287dde7447dd90b1fb841c6bbb656c0fd558642cf98
-
SHA512
2f4d2b47da2a61c95bb80c1f255d6117be2933f7000131eee9caa8bd36d15760491fbfdaf996ce8ad4393861a05cb079b6c32b859d3948d1a1193a17bf3d140a
-
SSDEEP
6144:SgsMYod+X3oI+YhMsMYod+X3oI+YSsMYod+X3oI+YLsMYod+X3oI+YQ:f5d+X3j65d+X3a5d+X315d+X3+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433428892" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0107EE41-7B39-11EF-A1D0-5EE01BAFE073} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000003acd4136d02e422bde7132f1419496f9bb3df9231cab6fd7b372bc6572799ba8000000000e800000000200002000000097ec6c4ccf3d83d51df28f9c56aa06cb2e09550e18a11f04292d80916cae70a620000000937b0532b66e34a7b5bff06c7d8de7d6dc89ea9237f3afac3436bc40465051a640000000364333928607c567c43fca644bcd38c8c9ea7bb6683df9f841584997e505f92c5324e2c6cfa13a100717aece11cc9438f5a823dd843bf29f10b4b402a3eece66 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6009e0d9450fdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f67daa7f0a5d91e40e0891129b540dac3bc835c6f6319390d3e857d8e5d4913a000000000e80000000020000200000000122da74ffd071d78cedee78bc2239c7881c6b824e4b3707cf3dfc25b9470cbc9000000013683793f3562c2729abc3c49290fab18683feb0bbcffc5fe1230c6a90a20bf278d2b0f3a05603b41ea5fe5a7c5d4ece379e77cf2412efda6093b64cf5af224edef99d4ec5eb8d9a876fb59456c370220bd6a82b80e03b05a18a5868ed73e7f880337ec7d9e3f365b3a47fbe95ddc54726d2aa609590fc71f92fb38c89a6217698093ca8abe082eb84deb81c48c27c9140000000c3d26098d32be0767be3a09afca31864ca3f5f7c675e55c47dd773564c4af3bc07805bbce0b3e38c6622575d02bb86287dab67a952abead5682d133a749e1d14 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2616 2700 iexplore.exe 30 PID 2700 wrote to memory of 2616 2700 iexplore.exe 30 PID 2700 wrote to memory of 2616 2700 iexplore.exe 30 PID 2700 wrote to memory of 2616 2700 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f601e6509e0a84fb132280d350791bfe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d48ea61ad27d12da67112698a3d2de16
SHA18a10cb7587724205edf0ecb294f9702e3c2e48bc
SHA2566a5bcc469c64ae75b0d1f0b69b4c78b70cc5d9417035f2e47628040e8144e2e4
SHA512b6f7064e156af255a1edd8295b3591317a64d2fd3833af61d741bb8cc1a6bc58305225a6c073d1b5b3cb9cc61beb779bb4b79a36837905e949268e1bd338187f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbcecc98021af3dd57a20bb89577ba94
SHA177f2ed7f020c440d53e43fa5386e7b4d6db68312
SHA2565b276b95c870fe59caf935329f9110f05edca95765b60066f9df933171c97225
SHA51234608e7b6b4a8c32fad70155fffc3c45f383f6f80f785bf37e8531ae8cddf8a411467e3abef70c03661f8c87408ae6e165ffa6c4a5a8d8f9ff0d619bbed8fa51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e07a680b5f510be12b1b88fcd445353
SHA1f3ed55436347ea743ae0a2a8a2ddf9bc62a5627d
SHA256661724def33e75d5df56161575592fe7415de0b15008f44e6a4730999786efda
SHA512593f62107a41f2fe937a16df8da2f3896fe08becccc0c074fafe0097c30a9a41f04719cd44264df8c565b3d775a6f7c2298b1a02ee1b0962caf47c52847a3acb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf3c5e43f0c8df29254cba4ed78d54cf
SHA12b9bea98eca8a9ac06e78bb52f1f156de553ab1d
SHA2563d2aab2fd0dd8af6af3ea6bf82172a582d22d537ec80b408c61572b54397e18e
SHA5120e5578ca0bb7e406aac9e137bac39f047ab8d4eb55ece3e480ab0c562966289cc8d57ec6e2c55763915c804f034a5bb6d57fad2a183d9d3d13daea35a7866940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dc1197b7f76682ef94e0671a5a9d1ec
SHA16d33b8ca956a9fd4739043dbacdb6b45aed476b3
SHA256a3815d3bc65bd6c044329fa0abc5dcc42cbbdc4618c7d1b0b33c09c5f33ebf6d
SHA5122f3ff1850c8edfe4ba20b46d7538366c7545251193502548710e01fc80612f1c0904e6cd99791d231fe913ce80a744a1a11802dc095d3816bc64a4e824f313db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac4c47502243195784832d2c503d3bae
SHA16ca934b3c5b5bd28b461ef2c070061e6e1b0d901
SHA2568eee91af35a7451f7abeae349e2fcdc07cac9a2ecc07699f7b890de905fa68df
SHA5122703e47df2dd017cbdb92cf38fd085dc0bef88d142b3c5532fb8f3ddcf5cedd6b1f06b65750b470dd76648d6e3fc357d6b03dcc28bb44376625806765964eb2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5defaf39da54a2017ff38ac4311980f48
SHA189ed2282b863aec549d5061ba2c90052ff0d04e2
SHA256b1ae6dc1436544572b8986bb8ee3f43855ab157f3b607bb9a2c15d66b49b0fb0
SHA512faa1adab231d93bc7c88be029da2aaa69024b56ef37e06f89f04154387bfc63f9afd4d81333c1df87c4321adb054fc54a683a0f9a849593bf502d7d6e7af770e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5431e6dabe8b9deff52c5f5e42720d0d6
SHA1a800e5cf2684743a4116d94d1a5f47bbba69740a
SHA25688e2a44e99746e69b265da0a2f684ea3f3e0e3cb0da92067ca76cd043ba9f313
SHA512296939895cae43c03168eb6e389eb0a4fc85df178476ce29ac095fe1b82fbf523af578a7d1f324554c26c1dd29b7d8b8fac0d4c729121bb3a613c682097688e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fde1c098cef773c42df85153ee73999
SHA1d5336bd7c0876a6584a90ea640d24d993a4a95c0
SHA25675f802385fe594cc0c94249d58bc0be123c124d52233df465e757fcff93698bb
SHA5125851db41dfe73d2118de73839f975b29c42f19394ff132b1396bd4a82c9e26d5d3443d23cf94cb2d220ccf26ab970f0ff8e75c071c3fc775e01fe9e120645ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b947082161fe4d62c74334fe9db021b4
SHA17d5cbeb6e67cf01944ee6db2ec4b80ce98010e1b
SHA2563ddb106946cd4270617435af901a34cc42b881dcb3ce99533506121208534ac0
SHA5128a9e2c7d0381bb17c0a3e85f2d9135b826eb9f4ef7c8d3de539bbd52d03a1fde279541a056f9bc5afe6648480e5f61589355561726f9815b13fd3ddd3b06f03f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db4e9883035a62ad212fef521117fae5
SHA10b7636838b9f4b6fb9deee118fff52a6419676fe
SHA25679716d710eb83a108c8746c2325d9e3903b2e6ab533041b712f6957d96bb0a03
SHA51225c60843cdf0904d47abbd582f07bb8599d9fe8e110fd51dcf093b8c66febc73933fadf571269a2cad1e059a0b04b98daa1bbb0e9b3b3432dde3a43b0111385e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a65d3e12ba03489be27d1c549e34a88f
SHA1ca46980d983db92fc54bb73783ef75354c715a43
SHA25632f3af8fcd56a85a95532ab05c46c216010ab244c0029370b4e9ef8de6ebd2c2
SHA512710bb2d1228dbecf9a29a7bfe8355411c24e289f109b856c34f6abfdfc96af6cad93e9a9ba03a6a0b67d44022a68536bf24a9c51b5ef094551eea2545a78d3b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53503bd9a9d740bd56563734d71e07192
SHA1c4ad63e3ea80e3f400009f8ad6a1be222ac567f3
SHA2561d40df49c4b2c521c923e88e2131c12b180e469283ff1fc0ff2095ce55923020
SHA5124104fb69df79ba177870422d7448cd76b6a43d86a08f2e5382cee4fcca47835c42bb03c5620b1ccd9ae980e9290ebee030097bd810e5fa1ed6fe7b2e4b4e516e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557b3e4125097dc14e539012f01d3a92b
SHA1e0aa4276b4747e5c07f6203be9ce521bc8201243
SHA2561ceb8e52a750a5f73ce767acee8863179a5f17dba694033b1096c4751645fb61
SHA5128cbf38fc3a972f21e56290dbd876c6ca587870ac334f015ace1e79a0ca85c2342dfd098831dfe008c3ebb967ae1b1a68ba8353c96692c2d3662fbb01d321e7dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d288521073b5320fbab9448f825bd253
SHA167c6aeb15b6f7a1dbc36132ed54a367ea312ad6c
SHA25689f6e2444d62bde8fb78659a2108a6da263011ffe317fbc094dfad7d60060128
SHA5128dbf05fd4031fb499301f1778830772628d83cf66f24f76087033a02d1a4346da1241db64bf0c97865fd777d1a93ab7eb02d6dca8140738e9486bec03c0ee2fd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b