Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
fc076b36e4fae04404f2fb6b55174c2f_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc076b36e4fae04404f2fb6b55174c2f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fc076b36e4fae04404f2fb6b55174c2f_JaffaCakes118.html
-
Size
14KB
-
MD5
fc076b36e4fae04404f2fb6b55174c2f
-
SHA1
53810145c72a625030e7ed80f98af9719b6f7964
-
SHA256
5d9f1c6acf0988ee905e39b1623e6e757ea3ae3805d13d8a223b7c39b96fbfde
-
SHA512
d1601bbdc948190c8c6e6123d901d36825499998ad2aaf9e9bf94188b27d1158fa399deea8234e1b909fddc21555e627f2bf26b24022791346f3f3422f9e76be
-
SSDEEP
384:CyiRN5Hym/D9tJQ9t1j6Ai7zy1wD6Ma2AP2tJXWo9t4tJdhZV:CyiRjHyOxtwt1j6Ai7zIo6MVtJG+t4tB
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000073725ef7843ec96042b4ced36ef164d8ca0b6504fb7d0c17d7eebb9cf77765d2000000000e80000000020000200000009a1fb3248a0b5b9fd1786b21749577f2eb070dbd303c04ae7ce4d8a2b085cba090000000004064c7dd5484d70c8ce96c4dcf324e28fd479405a1a5257cea25721f2f063193e39b0d749c32a274f01b704fbc0d2f9643f46523c23c70bc009d13a7d98863acbc9586f9f24e4fc714a4a30b0d3a8fffd865aa208ccab3c4e04c0e284ba0878f2faa6675d1f5727b1e803d153306eccc503f60f0746b2aa1ff8333a260e3da3b002ead2160e28257d257aee7f1cd064000000099117692f5594b3daf92861f1eb853b1394c0c73a752a63a0891e4f255e6dddef38f04818ddfa10e2e1e4ed8031f31d5ec4a85388d6b13ee087a82361d65d9d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433678630" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79B11371-7D7E-11EF-8B3A-FE6EB537C9A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000000b058a66f05492387dc4c76a12bc1b375707293c4f41c8ae082447a61ef847fb000000000e8000000002000020000000fbb9b2e2cfd2c298cbeea824279db1d142ee1f094bf2ceaf1c6075959b3a13e62000000098c7ad5c5a5106feb5cb3d11b6aacdb692133c77434f7be9ec577dbd0ba52f0c40000000cd803c1f4b882edfbbe83a0f21408fb3ac24d12c4dce12a479f4fb1ecd7e4efaad054ea72ff0d4c7d2659c87c04d605366d0be4f6868e62a17bfd2557485e629 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dafe4f8b11db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2328 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2328 iexplore.exe 2328 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2132 2328 iexplore.exe 31 PID 2328 wrote to memory of 2132 2328 iexplore.exe 31 PID 2328 wrote to memory of 2132 2328 iexplore.exe 31 PID 2328 wrote to memory of 2132 2328 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc076b36e4fae04404f2fb6b55174c2f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb2652baaa6f1692215673f219ca2b4b
SHA1f1aec60105c01bb9a4039c2699e4984e48d6439a
SHA2560bbed0ced5b0e6ce0e6c62467204f44fef6e48379a93e9ac628ee49a1fca5317
SHA51233dc78025a21c1cf1556f6c92c0d6ea40ff2ff75f51ace71e9d38e90111d0357b1a876133f8f8bc21f64578cdeaa2f144237f72ab0f27c02afcb7a822fcc709d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d09b3fa0371ab33acf8701b0726be28c
SHA19b2c6d77427b023c1ed54268053f9cc52e4895b6
SHA256c9a93bc64d227cf5ce4086c732c2a0cf3893bf8b393e3136757b96cdcb500dd5
SHA512fd5009ef1864112dea5b01a9833772a1e09ffd532c1c56620c30aa8e378992deca3fc30512f2f16a42fe1fe64a8a4a7dcd6282767f2f7e05a71bb35db45f6434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510cb144a8783638d9d3d313a644cad8c
SHA1ba91639f485e4b772d2d0252131a60a321d50ea6
SHA25655801a5d675dfec01d3195fc2d11f41eda691bbfc4a2cf1dab187363c51ab7c6
SHA51261631692e59f7552fb4cbc8c557f4d7a38ecc3d92a648fe98ad96148ddebdf536c7c73b7b10039fe1c3bd1e1f4e1f1b8505fca1626697862f3fc3250e9467bc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522a23f538e4cb29f129e02032601a7f8
SHA1b7138aca1e686e8a3ff34d65dd80a302086cb447
SHA256a6e3f3ab381edb21d482ff1791ce87dd421adce12192e26d621be5857a23a7ce
SHA512ce96df98bc859603baa2ebf9299ef03f09d7118dc67cdeff8985075b6510d6659145f3146598334b1f20b18d081cfbbae1dc499251acbd8f586a437b83ce49bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590f9fbe522ff9c481f09eba6400ea00e
SHA1cd8316976973315b21606b05e738983dd177a9ca
SHA2567f0606ad4b51af5af55ee20bc786d6dc54bd2b2b39a5f0209b04d9f13655a411
SHA51202affadfb4f0c50cf48d7aa0c1168b6cbd6414e479a97eb11c112c368d91800f06047cac82f35b01235ef5d991a598a7fa40c97772ad68dd5be9981d475147f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c26d3e17d78d116d6d9175a76baa79dd
SHA19efe1fd5540a01d445c907fec2b156d0a7daf713
SHA256a02421dfebb89886267862c3d39fb8e13f756edfd4ef82101e8fa7e9459080e1
SHA512f2adc3df46c0ec23c17d75face0b5ca4fbe34db397e6b204134917f64fbb33bb61effb49c2a05256fc43b0dea3643dcb8b22fc5cd3f584755a294c5066a9a06a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cdc4d34b584f0c5324e17857d586702
SHA19a868f2bb1d4c69d4bacd71dd0ce2cd7a108478a
SHA2564fb36b4b2c105a6aaaf169602438944a526922be0fd5c830893ecb112e3d32f7
SHA5121f8e2a4de81b0a2c583516c6aa6c55c6221792be1227470249b0e55e517b03a9897249164bef6c2909e06729e2841c02dfe097557097a5d0a61503cbdf32b931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53744518b7693c196aac962622c834216
SHA18e76e6a68efe69c4d6da331e5c2511c65888129c
SHA256d17f627e04891da16df49d29fb00797ee7ea147098f210e0cb28dacdaab781fe
SHA5122b1bad5237643bfb300e6c54eaaed008a122cd97230c66d4ac4eb7b01e9a8a97f2f195397cbf1bec09c9a5118f5f4c3fa0f43f6868091b28032c974619aeb35f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507a170c7b1fb566afa83dad01f7b54e5
SHA196e934f401cf86d23a1e1c72a01baa07e39be195
SHA256a2b4bc6baaf9481b562dc18cba8c127674366b07c18bc22392faedf1c78b7691
SHA5127d0e00d44544516dc2f6995ab5f4f1b6f2fd9c894a4cacc288e044e6b5fd3e3972c5f65e578170698a891607c53c628cc7a319d0691e7b9eaa94377d3028d0c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a73bc39adeae4be0a6b35e390010ddf
SHA1939deda620196cfd823483ad834ef618d4ba709e
SHA25632034b080273b5fd0a723f344adcf62c2cf93d97dfe8cce88b1da30bb3f28e0f
SHA512696c42d9d4fe6570208a4674b78d263f0c9cc26991ec44316dc0a62afa4b753e8efe5d3ff2381edac4169220e68569fb31a51615349194160cf13ee80adac56f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adbe7e5bf6d6fb53690677b50d30c8c7
SHA1e3eb9859d967e808b8779f2d10fce84e0a1db420
SHA256150032f01d0b30ff5264cab313875a31148a0e682dd530012220309a577530dc
SHA512a310931a64cb1d356654b9130c021b953a4ab7e6a242bfad36650b8c35b82efd5fb6149abc6a8f11165ceff8454ea7a6016b0c084b1c2be52cabba118f68b33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af467d1cf5456e483619a54d0655f287
SHA11add6b579659c055b5b50eb177a50452a99b81cc
SHA25606c39367ec131ce51e79e2aa031e986fc076bd7bf3880911341ae3f5d7eca3e3
SHA512ec42a5179da327c16882ec4a69b82207093840929ddc82f58da971835bcafa23a6324471c34d5e9bd1e9e988a1f2896bca0434fdaad8509239bd7aadc7cb4f47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f476257af9f10c3ed4ea244779818739
SHA1245a8aa213109f45853e66562a66ce35350c5f33
SHA2567d9fa891c085897caca569530bb901137b7dcbe34c31ace73872fef29f82bf54
SHA512c78d6308d2fb9c244e928721aabd8ed42651d99e9897d8b718549a1adefe0805e404cb2e7c067ce29134defa869ea7e5430a447a0582a9468ab0757799b6561d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a407129cf1ae7fc60906cafcd15f15e
SHA1858446831ee0dda45fd00f1e61c76a04e14b1cc8
SHA2561c8f85d8ca43f51242d8a9c24545d63d8294603d18480d559a62abdf4175581f
SHA512c129d0dce52761c2605eb43f93ddf57e70ae4a8a95800f82cbe668e93e02efedcdd5aef7af33a364912abbc548c7a4ab9e69ccff89ab2652fc0109c0a666ad3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5331f674d251ea7ef0de39e4460152a63
SHA1c2d4805d9beb67174898c0e68053037f5ab03e34
SHA256198dae5e4feb52b9190ee66d2bb0f72795d5917c4e4e652ceada1fc50420f4a8
SHA5123eeea928212df52d72106dbc9793f39e5f4065a623805f69a3cd2af6ca10ba3b2d53b324fbae87f2b903182d8cd5a8796975767cbc49be652194a8096fedf073
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e00d4963a6cecbb57c372d9d2254c65a
SHA1deb8267c9f6f92579442ad939968295f6f5b9b59
SHA25698b53031fbfcc4ef53c1f4789652396c8778c91b0929688cb77ac7d822cf8611
SHA5123c1314bb8fa336b2f4efe4adc818a39cd0872b298fcc70b3155e4a268a4bd9ce36faf079ee7c74ee5b61dba40c190c96091d1e78105db46dcd40e77f616f7231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572598fb69f7f9555f0a7bb86c520e2ef
SHA1fa37d5b2bf57ab9b7e1d8cb0465b57377718f58f
SHA256643b7ac1a6aacbbacb1476373a3139173ddc4b7fb8c5273f929869c197dd63b5
SHA51234f69596bbbb9a93d44ca28877b0ecd5f867b2dd8ce1cc9146a09c3b238e206e7ef4d8bffd47086a1ff4a3cd2398c6b2dde29c7fb54372b8d18f78d15d9929c1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b