Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
f9ad55c2675e6130f9ae16cc677fcf7f_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9ad55c2675e6130f9ae16cc677fcf7f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f9ad55c2675e6130f9ae16cc677fcf7f_JaffaCakes118.html
-
Size
465B
-
MD5
f9ad55c2675e6130f9ae16cc677fcf7f
-
SHA1
e0f85f217fe9f998432c5f9a1f1f12230a5bc81c
-
SHA256
5dec52ab8bfdc23fd337bdba2fe3d17d0d8b2c8a2cd000ffa5c72938a32174f2
-
SHA512
1e0857196e1e6a640bf92252e80405cce876b1193a65b06b3337aca83ab36a2977a5113a859ffdecfb91ed1171168b81af25074a559fbfddacd4adf3b9e9b2a1
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD3A84A1-7C85-11EF-BA16-7E918DD97D05} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000440baed456b647e45e52808b8a5e7e944d73373d9a05eb49c12701c892a8aa0c000000000e8000000002000020000000ffe6d221abc6f1285be18396c3475efd25dbc88d10d26125edf1e6f7dfbb2c68200000008e293625f484985e07a0eccc6ed128349751efc997c0a6b62f00db1f74a9156a40000000c7bfbc4b4ea59f5954501855aab555a94a0de01a789011a446b6be94e564c301fb7e4516a040ba8aa916b1ab9c63fcad5ad6fb3a1e192a37b5fe99066e51a949 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433571906" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000d400929dd7e3f7d0be951fa56f16b48c18861e871f60fb25d9e467cfd442831c000000000e8000000002000020000000312687f14fdb74447d1b6d95af3bb890faab2204db0b1c313429120a1b174128900000005030a313b79ac4929a9c6ad10dc77ae1de58a54f00fc96b2701020261768a5c6072546b201ebba17716d59cf559c73b54f6469dfa68588b029f4802a98b43b5ebe81ac2aaca5c9c952c060ec8d0c58634d122357036483e8ea5057d24271d416089e8dbbcd37fb4bf3a338bc252676b23d9557ddce006ee1cb43f375896e568cdc3735674e39c3cbec09a2286f6f94e6400000008c09c76b338833c65eb337f2be2b45d3f06add682fc18359cacec97bd77cb3aa606ef6558b0c9f0020f0f84b4b993de6b3af137033bc822b91cee0b326abc25a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60731cd69210db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2600 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2600 iexplore.exe 2600 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2388 2600 iexplore.exe 30 PID 2600 wrote to memory of 2388 2600 iexplore.exe 30 PID 2600 wrote to memory of 2388 2600 iexplore.exe 30 PID 2600 wrote to memory of 2388 2600 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9ad55c2675e6130f9ae16cc677fcf7f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52de3ceb6d2aa4de8d4118e946a809728
SHA14aa7f75b66f0ec2c155d92a6a2cbaf66fa35f3b8
SHA256f7e5f610fd7e7d6e002cff140ad4965d10b15f6af55f97db37adb4ffcc264af1
SHA5129174b2986ccd5480e268d640253e93acb5fd119c2e11503ba34d5ef6ef8fa1c738f89943fa18cfa705973baf36c5623aefb7e3cf06d175bf89296e8eda9ce3ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5180a8e092f4cc40ca792f83b4f745ee5
SHA19bc2de9125f06fd1098847edb976bd9c7fe03c36
SHA2565e746ca5b4ce6b490b1a58269582aafa8e710e47b40397ce3a861a33d2a7923a
SHA5120381ee1bb00efc0a8bc7f008414fa4d7fc7b1ecd06c64239b3c2d96d171c74ea88fac218504851393d898de1b70de458eb2eb3da280495cfa3bf8be444e6ac7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541771673e387339057fa55740e4a8e98
SHA12a162f3656c881491da3b4272683f649b7282770
SHA256b9ee3576508934270069602255090e49d45eb580b929eafd64ecf441fc1ec493
SHA5125a9a23c6b8edaa951736cceec76ce8362f8157889f2d49115bdc7d22bd6426a3525efb3e2c214a120c20886bfe6779c3213b8d26898bf3f731eff94f7b9fe419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54370a70dba74abca801265b6831aea07
SHA1caf18564672ebb4b795232e77d703a36a8880a08
SHA256c3f1c5a6775d4b94c1911edeab04cb0bfef582a268a5a8521a99faa0227ec879
SHA512e54989894080c8d574d7fb024ae7bec30db835ef3eacde705b54e77b76110799074d1e3572dd32434aed465c51d885e6a7db8e8aca9d3f7327a160f4c4f69eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c6875c6d6b0d9315f1acb1227d40d67
SHA13d662222175a7a83f4324eae597044090a983e97
SHA25682e65c9273304cdb1961199bd99f1e95039a0f54cdac54e204327650d0851087
SHA5121462645a1388ca64977ef9c361b86d6edf6ec4fc82ceae318ff756dead4d6c0e63ad6940513708ef1f2ba09a0454f302f5a3d209877aa912dc547e5115fbc287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdeadc1cda37ddb5eb7e3cd45fbf552d
SHA1b1bf0c5b500ab1d0cc1bb81d7ea75bcd8064c11e
SHA2560f8d49737cda2597d0c1b32263ebe69f0ea7f375507794d742b42eb7eb7f84bd
SHA51258ee2117aca91a466ed93f5a1e6b9f632e9b0a0c8d0fe59b27f63591c3eea3b137ceb43414819847367276bf6cf26556de87bf95a38526fa2061936905daab43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525f1ad6f09330927dcc0b27fc9d75690
SHA1e65c8cd2cdc29232f9b3bc6fb91854ef41f6e6c7
SHA256a7d7922d5937c22292ff1402c199b7b122b99797f7892d388262cdb34c096a07
SHA512b38281ded0f1b8c40e8ab5352360d28dc6896ff7bd6deb503dfbb7bf6e3f11908ff3f5d47976dd5e760a4ce66f96e8b362d10563885cf275b27a4c2c9ecc091e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ea8cbc8e39705f484982970804f1759
SHA1d64c73f08b0d038e066846ca0e6f0e4c7a7eb082
SHA256c93b9127e75e88a6c39a8fcbecf1e92b1089338af80947e5f7c16d8748c50b97
SHA5126f14ffe5d5d864f11ab3392274a12449360459d76ef5f5213f3ee9f40b197322f42e8e26ba745ab5d48fbd08a889c12a1e35bd8c7818e57bbc265ee8c5b92236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc8705ade80451cac89e4ff5fab89b13
SHA1b2d6a4348e99b2c5908d06ed0dd4514524f112c2
SHA2562085738089a0a22dcbba60ad15e297c10b247b4562d87f087524355670297138
SHA512b83659fd390a0c9bf47f44b470559fac33340cb8afd633781142eb64026eae13e0d7f2574f882b27a3e825aa36f61fc044e098a16a7b026b51993e64d80f28b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feb69848de4a7900068c7d4242a273f9
SHA1ecff183c3fceffc864e256663dd393bcee6c987d
SHA2568d6a0bcce498237331280acd4f6996faa3e24a2ce9748745108ba0484bdeffdc
SHA512f73d697975e488eaf205d76faf6f2e38892c598e6553859be49cf441cd21c9a704c96dc513e7cb8a5ff618683b8259f2b136a5552566f102186425e4cbae5a17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508b057d2ccca677d101f0b1f189be839
SHA1499687525eed24a6df3031968558f31ac8065f2f
SHA25684c8db566378ac4b863d6408168a4459b065a40847bc675906aa9efb2611b7d7
SHA512ec03db24ef9875ee5168262ad121c783600bd6c495c1569439aa8eaa721968dcbf16dae03fcd59e006e49c514c349c754424ab13eda2d21a52d881b39b6662fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b10f7062e2c4831bd11ab0e0f77b478
SHA16b92cb623908e919d7781ebc346f79ede3a066cc
SHA25622121c4938594ca57db5100a2dd952937cb419dbc89cd75baf6ad55c9ef69514
SHA512d64e43486d0471d2017d2cf24e68a89926e63911d3987d4a317cc4f13137ba66586d0c17d075c93d742e0016fa4ad363d5212c801579cdcfd3d61358471a737a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556cd57fa85c863fbdace2a1e1161143b
SHA1d8fe3a7192bcc869290e9acc5424bae924f90b3c
SHA256f0aee31c9ea504e5f5a1fb1360d2022e8ad030aed16a98b62b3f6ad4cbb4a674
SHA512ef149660a91fce8c3b4b9ea9444db90229a10b089bd72475d34f036f99cf7f4896d35128a49d3711a3f1f9b32b051f09e8c15c6758404e945beba9053bdf7078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ab6f9b768df99e6b57112c27df7e171
SHA1d0d12db12f4bd3b378d282d832d76a2bba61d7f1
SHA256ea22a568f50b8665277fcf6394c273b98d0c9a431dc752d57bf0b2baace7d46f
SHA5126c961046abdd879dfa313d0665dde290cfe534fa2f752cf3bf118d3442fbd2c7eb57f8248b3a4b77d453df49971b8cd467e7b405f25d99fffe3db57a14c24567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f266fd72586601a9f8c107afbd63153b
SHA1047d3896a24eee7e08d3dbbc1dca8061fb40bdbd
SHA256c2183d6ed2ad622952e76158f9c5c92fe32acf9e4182d92e64827102dcf56a0b
SHA512d711003f8480c068a75f7fb3b297505f8081999a33396bfefae93ec47952526c6dafc0e61e2b5c1d8f95ad10921b52c2c9f76b72a83763a458e99b0bfe3b7ef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af46d557eaea6294dfcbd409684f8df1
SHA1015128f1fa9146c4cd3e29781de18b9274c61aa9
SHA256a15be6e80d3dd5aee1827db2f3a3fd2e49e826c9a9fac7a0d37fc0970b2910ba
SHA51250f5f5ebff8fbb516d61a5d54d7f602989a897215d8f8d77a45ca6c6c4cb37c88ddd4a9722c8891e155980d34264affbe19b1161a1e36865e607b5a5258f6cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f063f71741d7d3a06f5c0d5920cb1e3
SHA18c28917814a4028180a29ae43270a2ce49039b1b
SHA25603f5cc84e448ddad81c320ff0066fb53cd87c77b5f28e54d6c2764770cc931bd
SHA51298883c7a811d649bce9845bbb61dc95c3efd49b467001997240c9d5c76d722455adb74de293d02b7aaeb70f3d0a8abad2dbd24da480b83c88a67ac903ee8ab91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe85d5ac6a558a2529f667a4a2a72dc4
SHA1b00dfbce33d15377fe1cf071dccecfd37ba78794
SHA256bcf4ecbf6b37f624754242f24eb033ecb5c78891f36862c3390e49df3f3a8181
SHA5127dde0abf549056ce94accf44d18ea9a5da63b2ab924b08b1622a2e139a4afc0961699c4cca5131692ab49e391aacd630041e93f86d554f26d98d1de744b215f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccea782121bc7e9d133b765120286956
SHA1e39b9f0bad11ebe876febdba1afe0551c1d15b21
SHA25601cddfde7a4bcdaf8a33c8a4baf9245d617d503157e52ee7242d88d431f5b51f
SHA5125cfb5fe3fcbab182ffcdc84aa63b35fb4850f67ace3b06720abc9bb8e71dab3edb2105d698ee54abaef9327189d6cd6b3bbb0ede8fbcf8074a7c878d5bd75d60
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b