Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
fe7f6923ba0cfea88c4cecd79385b318_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe7f6923ba0cfea88c4cecd79385b318_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fe7f6923ba0cfea88c4cecd79385b318_JaffaCakes118.html
-
Size
4KB
-
MD5
fe7f6923ba0cfea88c4cecd79385b318
-
SHA1
92f183e09485554fb6f595e3c1396a045bfc53a7
-
SHA256
30186a3686158d269cc242fdd6d2fd64928a15c6dd75ad6b6ed32baa083088ca
-
SHA512
8142985fc641af1dfb55256adf01ddb60a308c345fd5ffa17565e9c7330566a2c91d737b9655987c2e10732a6e08b278bbfe36255f42acb147df1da28c890cba
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oBiGd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDE
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAE556B1-7E5B-11EF-B788-5A85C185DB3E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000099d74b923b20425f719b39544c8eed1d7a1b4916ab4995046f1625ba13fb503b000000000e80000000020000200000006d6d52e7191f2f96193bb55fa82f66f72c8af00b29318e4471bea1996115311a9000000071108b28bbe6a3a70a886cc5097eb5263876c424d4ff4a9f019c6f73e82f5ef8f56314ed7c283432912a7e687993cbc94502d29f7d9d5fbb92186519c92a7581334c1c7e2f4d6f5837339f7cf037521032b849a7c3ca24552472621dbaeadc6c2426c666d0d6fb92cb6503ff96f758c8206e8a24db555e01531ef9f827dd422488043c1327270dc37be88cebcf169199400000003189305571d14011bc14db154dacdb15e429c3dd19ae41533f4be02fccceab2d9d3d414c8e7648bb3c084fe36e1e048adee80641c5d3da546499372d1b8f5e6e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433773685" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f089619f6812db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000e2751eb624f9b5fa7b3aab7c246d4538d126598bc33ffb80bb75d2b89d9d3b20000000000e800000000200002000000009ade286ab7a24b6829465d678d110fabc9c9b906b7e552dddb396343ab5765c20000000ef2853e42796715420dad61d67b6e1782439e9044cb13083070a3943ec725d8840000000611d903e44299a140e07a22ef4d270589f021a7ad5442ded3f0c169c2acd5babb5917a9a1f8a0a66575f222ce3b3e15cae6ef93707f79b690e4a9a277b3531ab iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1980 iexplore.exe 1980 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1980 wrote to memory of 3016 1980 iexplore.exe 31 PID 1980 wrote to memory of 3016 1980 iexplore.exe 31 PID 1980 wrote to memory of 3016 1980 iexplore.exe 31 PID 1980 wrote to memory of 3016 1980 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe7f6923ba0cfea88c4cecd79385b318_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0a4316f5434e4576d44eab3bd029be1
SHA1ba9a7ff345659e5363b2fc11cefb2efa2e0ee052
SHA2568e18168f736005baff4fb2c43c9b3e1dc4bc81bb8b620d1ffa79fc4c23a3dcdc
SHA5128a9fa5c0fa5fd03f52fb07bdc0e4cfd37156ef2431bac7b159747c01f4797bc1d2a9fc4e0779d48fe5dfa87d8d4eeeb77b92a1e1bf6c2a619010ca32a2a72dd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc313d050fcbbf41bcf2f08626244a7f
SHA154d648923b98de25027969fbf872b557fa47aae1
SHA256a0589b11495f320053e4231d25bfe6043be94e26510b6eaef277554eda4e0ba5
SHA51268a1fb18840be99661da194256ed5f3edab2735c8a8f090b6a59d70930458bad3b21f63942788dfc475320cd67e6fbc326d9028e339fa96447b28b3066e7814e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552b33b1095df7c344e8e7cabe7954873
SHA1ecbb99e41552ea4852715054831eab0c309395a7
SHA2560a8a0e3508340a8effebed44c83b6c9cf898a8b0e943e39bd0be0a6652f63129
SHA51260a856b97e362b3f039f366d5a8cb1c3f7218798e0403261d92ed328280b69892ca3a1f04820b1967fb67c9054d3309c2b1bfbc7afa72466599b40a834ea454b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51473e30b2972e6a58d04b2bc93164e57
SHA1d043968c61a32ca67e7f20c45c549a770993f47e
SHA25645eed9a14c870685f676143791ce170b9a6b7e9aa3f55472ea0fd88c8ed2c069
SHA5124974e59a2a3461672d7f779ad3e16e1defdecfd8d798a5a06669b2a22f0aa3bb39262ee8c4d8c7e19a1a13bb2ab231ffe011801667cac490bce7ebc298afbdca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d474e079a330e208d7b0191f8b931ed9
SHA17099531a0b05978b8d8c3ae420a39b7b519cca96
SHA256d032bdc73e2cea2f2a67058d363dafe266cbbe2cf701c678832a4a9644a03ea7
SHA512e3c340c40f1ac605413e72748b2c6485dd9a69a3377c04086511d0ba1d1490ea022a3f3ba9b47eef8956502aceaefdcb19c3093efa8d0e4520a09596a3661fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aef3a3caf89cebdbbedb026c8e34b8d
SHA1c6d9ef678fd77d857464147e22e1dde9948a03bb
SHA2562c4ce59cf8f476baa29047fc8491c3ac54cf9799a32ef8d1d41ba263519b2568
SHA5127b86c922391dc07c8fb16e2f617a60838f8892f680f29e45a62f9c4f531697b940f271df2377497fe4f28db6e078c941537cba4a86535b04ae9ec306a4ebadf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a0fb66bea86e70c3645ded8ac5efc21
SHA18e735def7f7170f59904fe65c0844459951ac9ab
SHA256a406f8e928e400dbc2088ff7bd7ba8bc8c4a4197c91dec671a695c3da2bdcd98
SHA512ded747304ed3ee5e1ee047a88eb23a7c5c84882e5ae7db66647e9cc64e5df8b74a0449642a56b8694c40026d04187f650e991edb13d8e5f9d1d44112fe6ac983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aef13acc05517a32b58e7cbc7dcced51
SHA1c5b595a11826a9a03731e24d72be48ebdb88595c
SHA256c73a6dfd07dffe3b6113d10609de77714e027d955f066071d9c9fc745442ddc3
SHA512eb44618cb24d119a1a7e439114d79807e5b796b67919281e591698c61d435b530b40a38b35c70912aad947732c0326caa4fa86fcb5dba67f39e77adc6a9466b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cac3eff8224fa6252755d05543b66cc5
SHA1b115986a14a1ca89ea3080cba720733f39c3b043
SHA256f4ddd9b8a6bc3220310f8734d57b757590c36d3f5e285fea87bf2fa543c7873a
SHA512699aef09c03659be2541d33bb8eb3ac7418057a07ea78bc4279b43fa63da10d4ce51b2e6c6f306e74a3a53d36180633ac0e503c54f388c69c69f305f9283853c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5351a70fa170152971c7733d64cddfd3a
SHA103f2a51cec65afc2c2d4a305ef8559ca1ccfa4e8
SHA2562f414e56aaf46c4301a98823de2bae0b763b9589cad4876bd6bec967fcff56e9
SHA512c5ae3b40b4b41c8be745a873dbceb7bd50f65dc726d2add29b14f9e623e37516d39abdd28efd4b60411ca18707ad70c54d1e57a6b7d00ecd57506a3c9e0c9cfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54db607e00e2d4c8faaf319b6cbccd078
SHA1b7cbe7834b97c02716674ca6243c88812b8d1bf0
SHA25630c9ca416fc595f4b3a706a8683d68bab475986098db4e4ed3101b452ee5c0dd
SHA512454d231c44e596e176b52681b4298e56142b9b151ac2c2578ec33b027aa14f2bac2a4ed4ef5ded310e216dfd9f8b004bcc1e4c7904be520da3c32394c305987a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7539dfab7ae35489dba647cca750460
SHA1fe0e5d12566065bee7bf8e08eff51c011823e798
SHA256061815689cb13111d772d64e8bf6d895e9dc73974c32af4adf2158ff972af9e1
SHA5123fd792715fb39d896e5d217aa927f6da56327d42f3f60cdd4d658340597da4afb41e2abb0c718fe5af70524815072907154fc4c5f1d8460822fba663b79fd07d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504df6db31a822d12e9e3cd65fbe26eb9
SHA16a8530bbaabb23fb27f932604b5069024e28977d
SHA2567fb852ab79955a01cd2fca3aa7baf8d77fc7379554cc6bcd0bfa7b5dfc82b68b
SHA51228e5bcc35d89ce1b4c4d74b0a8f66d26ef96e40c71ef1478ed19b82ded35b72c9a81d3ec62fb8e93c80492c3c3e1749419e7a05fc23162a330bd3b27b78e1225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa05027aba3758950ba5cc1e639213f6
SHA16706bff88df5b13cca3aeb14b64f06e4d6669e1b
SHA256d5ed8e3009dcacfd0c0c15138ed5a1c5cdc961caf9d0aeabb4ec377a4fde6f33
SHA512938e2f4dcb9cc29d899f0c75b02a07228ea92d3f9534ab5f8336e561c159b24e92bbed56a6f6e83fea2a38d607c5121f85e0f008d6966a74734a675508e943a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530e840e2d721787fe99b66c018c72b20
SHA127ae5a344e542e9e7c8a03e9d7199ca109bb4267
SHA2567b2d044e781a6bbc8d94989656504e3c9675f9c399a077737fe66d1fe0f18428
SHA5125f8d9db15814f1671fc28e730df0100195e8663e57c9e6d5ecd92dc7e72c213971b683096dbf484bee8f48d12405335942e60ccaeee86902d64178c9a3598002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bcc636ae91f1624e855ac304164531a
SHA12de06ac0ee19c04c1ea7dc3dc7eb37f1ba5a325c
SHA256bf85ec9c2e06da007fd52954a2cf2dcc147d5e0e5aa0b0fccc0f2df1facfb99f
SHA5128ea17c4e80bd882f5cecfb9e549cf2053c731e9a03f7bb524308c37d2794756a4c4c1f3f4083f9d22c009412edcd4c75451140a48641468ce53778312b951de0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c32d3dd1756a27f0b5df9f99992c166c
SHA12cc082e5836a43bd8a4c506e4c033cefcd9877a6
SHA256d18ebdfba195803c815323bd55c7e1866b5ac995634a625a578334830df233ad
SHA512b7a7a74eb1b57441b4d3994ad76a2dca5c036b824a1c81e7242567cfcd59de95f10c3cc135d1de0efcdf9bd41a137a83b2a5177eda708cabeaa2d45e246854af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578de688f63615902a4da900cc1552103
SHA17679f9bc46bac96abeabe1f874f8857ffbd6408a
SHA2565973ca39b56963861f443815fc30ad444b2004f8f9776bcc6de3539a341e57cc
SHA512cdbbaf500025ea94f18eeea515ea94b3807479f78a7cf798b8c5c8310de0ea11613d6098dfbb922ec2427caa04ef84cda068ea39005c8a76b3b9d55f13737eea
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b