Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
ff324b1e2db8557a13ca221fd6aae277_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff324b1e2db8557a13ca221fd6aae277_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ff324b1e2db8557a13ca221fd6aae277_JaffaCakes118.html
-
Size
1KB
-
MD5
ff324b1e2db8557a13ca221fd6aae277
-
SHA1
72694587c9fb121fd5394b9c407fa87e482f9c53
-
SHA256
64be2c58f542e31a5b277b02ed9f851be76c002580883140adeb2530fc217bf0
-
SHA512
5b8393d4eb67c4088392a981a706c3fffe0b697da44758f515f45be8cc2f65ef0122de5918098b1b562aab99a6dab58aae42732968795c8c33e7beb17b965b71
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000046da2a51e2fbc3cfa47753a2d8915de1aca2dc031fb1d67055effd65fbadf95e000000000e80000000020000200000006d079c2fe6c4573ee0acf6beb82bcc99930c29ad7c6630f92345302794307e2b90000000b07f7054dd36d13825f1acb9e3a915e2cedf5198fc3f3dec02f307f59ed2371d07b5e6f88e92b65a01bbf96fb317cd8fcbb124d8d7188964f6077907bb6cf8c8480cc7d7c0778f2700851f5c09f817023d0c0a2bb90a29d3c2b30eb69d05a5763c76c606722cfcaca7fcccf57325e743ae7dda43fb4a472ba2b0c5f9f69949ef768c9f99afd5e2d8d1700eec413c31384000000001dbe7f81adc5881e54a1051db0855ba42a1b44778ed880113e87e52f3054524d537e27f34e9eea185a589b3c71ffa6936e5d8ce8f718811bd67243155488901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000d785d26fcb9228ac6b268e08d7b77009ffcdc1620cb87955880ddb94225121a5000000000e80000000020000200000001c8ba5f3e9851a76d980eb645c5ff69f3909cf7e50428bf39c602b13bab88ce2200000004bfd7e9589ae7da57b27b8db72ad914c7f78fdd05a2b9aa667bac1af8f9b77384000000042e2db3758cabc5ec9bad9c6ec956c5f4f0f17a4c90de890b85e783eed63e5ece23bb6a2672f37fb8fc8e8f07eeff136b14f07737e16870d4f2ebe0d25c755a4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD03BE21-7E96-11EF-86C1-D60C98DC526F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a8b293a312db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433799003" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1292 iexplore.exe 1292 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2316 1292 iexplore.exe 30 PID 1292 wrote to memory of 2316 1292 iexplore.exe 30 PID 1292 wrote to memory of 2316 1292 iexplore.exe 30 PID 1292 wrote to memory of 2316 1292 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff324b1e2db8557a13ca221fd6aae277_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53165d96beb481c238319c50ea3627246
SHA16e68eb7b28fb9006c013291fb669e9975b8e8804
SHA25658d7752c4bf7b6c108b09197532defa5173639218ca531f8011419f66390c310
SHA5122ad172c1a44e7370813befccb4632d06c81a9dbb5cb03c43ddeacfc50c1149cfea7f535232daf881de8c83dadb308505628d760818ba2dd465431a1f5e9179a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543fdeaf1b26a3a4a4ce2d7a94ae6fc61
SHA1d96c8dfbd30f15a1c9e9a96827cd075964d07e2e
SHA25646ec5345d2b4aae882b514f5c1ede97e7c1de4c1f26bb6d41c2bad62e62ca33c
SHA512e74c420e752e29d7085d458aca9d98294cf0e0a635b4e869b1125cf5ea451c36ad530a5c3d4bd4a44d0068398d92c91725d3fd2ab6f215e56da5290be2cc0f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593d11f8b8170819f3e261c30525231ed
SHA127f2424475360c95d7556f15e60a00a554393c0d
SHA2569c4e3478692212fc1e739fe55c11c45f7e60f543d0c3465adc9198bf3cb2d5e1
SHA512b22752173ac8c4b39d6978330f4b7acb98f68942ea5be62340518487efaeaaf6cf1b0399cb8553810d4121316b89e303a0cceac387e5702fa18ff43cfbc63564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2f038b8255eda1d36d54e9b800ee02c
SHA144240dfa69f3144e8e2238a7864a2efbc786ffe5
SHA2561345df4d9f3d83cb4b3117326e308be288b9d12797d8c3f74b288c3bc0e0f953
SHA5122a516542ac76dfe6658b248c547369d9e381fc4fcd35fde0990925284306fa1b6102f7e3a7eb7b9f11034953e794a05c1750b924dfb00ccb4ae48413caed8176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c84d534c4f60c21d58fc10d31a74e11d
SHA13ef7125489742dced26b9bdb84a9fb0e8cc5e3bf
SHA256e6077c4a8d7098f0b13344367a5862ff2c2136d6236b452c29ce8bb0aa05260f
SHA51206e10e5394c1d48ba24bd98c6cc853312211f5f109caded3078860ac1ade4c8ca8dcda1c341044f955e0dbe32cf304d6bdeb0ff9318a3c2f159713360d809e8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a1a1a1fd630b401bc3d56d7e48eb9a0
SHA141ac5f9d3fb4a9936fbf39be279c899f4c4dc72b
SHA2560ddb460e2b5f045f4424a7fcb535533a5bc256a2efeeb5d149d3a2afab176449
SHA51278691d1f81d87d9e4e81128daf36fc596a52cb60a3a83eea5c3cad2b179db11f93b8a5623e7a85ae4ce9c172c72aeda00a0ca7a1d59ed16cbdbb9bf200777952
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1df22fba4fb57b0f44c7ede88c512a2
SHA110244af513b77437f31674563e5376920c9e8710
SHA2564a985c5ab31870c203728430561a120f3c8620c4ba868a1dcedc24a53328e6ae
SHA5121414f450b9b47b8a1dc3be406f4393b407f1051b70b62f8a085edeff615fed65540131615eddb41edeff752bdb76d1454a636be24d5ee63734b6ce82002ab9ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6f5bab4875bad4d2d262c0f5cab41b0
SHA13228d32585454980cadda409590b79e8622ff4d5
SHA2567842e32e91fa3d3e197b02364d5baaf0b997c688db6340ecbf2bef686eef5574
SHA51204ff494528d40c2a54737d8d20eab1d353c5ff2f9227ba6a863ae1e5009faceb18d765b4637415dbc291d4c3525791672a71465f1affd00d165e60c7bb29024a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597b79f3c3f6b3ab81a42484f71bd4764
SHA11d80eb7654406985608864829ac068e68d0a1518
SHA2569b999161aada752a4391503acf75a2402a9c676205f6d3c83935a7895a0a2eec
SHA512743ed2194d32d98834dc05a90fa9b513fd2f051026e08fa86acc810d0368115b215930598ab74bd05f6db9f3bd5d36982fb5d9b9ab8cb96770c013f8ccfe1828
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5310dacafecb8ec268fb38d438722df8a
SHA120ef5a8a09610aeb63f682658ff73bf670cbe2c9
SHA256cb9389d41ecf46f831fba8cb8502c65081ff9545e618930afdf074049f0e7786
SHA512f7108514b1a6302a943ffc5aed5670404af28d64990ca66835ce22e0bcef8368093693879d25033c22404fd0bb9d6bc78b4020ca15dd925e495ac54555c78edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578809a8b83292be2f334887b65664307
SHA16c5a6dd5cfecd9ca03fe53e2ad51c1754d4cedf9
SHA256285d5c851abec4099cb48fecdfa5a5205f1c84b740944b93e744c5357b917759
SHA51221d8dff9a7accee080762e67eecac390c341ea1a65ed20167cb620589be89b3507c5e2f5280019c977043d84e3b00169449537caa3996f415ab67b8766bca601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f41ba63515ed53bb1aa2700cbb5b3347
SHA1e19a847124b2eff579bcc55a08e5ae78c166a2f6
SHA256de827a2978a477839ab6a927c380524308d89936c2b964a3c1a893fcf7f1ce18
SHA5122a034e3e1007bfe9cf24a02762ad55c676889e2596dcebf5e750dc29805bb7bcb3e8a79da41a8945795544fee2a4d3752758a8eebbf05afb8748ddf882417386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e3bc0f6ef75feb998b1029288351af0
SHA16b414539d6d1625507ea03344ea6d758094e5fe2
SHA2566ace62cb7c49c5bb5b5d640b5808523c1afb6697c1077b5537748a36f40597bb
SHA51223dcec0b7dbe9aca8292a4c47f6886b4a22829bd1130d93813843ff369eea94fe350044a4dd4870fc901e7549154153bfef15b7c2774546c551e5a47af8b27e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517f493084d44059551c02b7633571b19
SHA1c23aae207525fe744cf577788849e1d311b0a6b0
SHA2562ff32ea854f95f8a39ff49b0e3c413d28922a47f8ebe80b2e937a5f3e17f73c6
SHA51238be438022850ba81d340c92be6eea383e0634407fe60c2d08e91a791b8d962027608da7e24c733121eb077be9d15055c57763859fe95e09793860a677d9f280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e43ed2d8ca32c2a8dea58b8f681cd77f
SHA1ca35c5a2675409393c2de6d2c183d5e964397842
SHA256990f0660f60a4ec5e0accbae884cf4254405b60db2ff41ff5fbe3eb11604f738
SHA5123dc38c2e0da46a41ec128b3a8fa0fa7c0380fa7fa383ebecf9d55c9513248ecaafb97fd477207c7e62c0c2ec4a215a03115c1a751bb6999bdfe46f4177a5422c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54db88b6f1ee49b6bb6fd0d9e4ea48bfa
SHA13dd4dd9f6e4a0541cfd517771965bd6c38b384d8
SHA2563eedf6e011ed7fd5cf3978e1458cc70fa59c1fd39228b973669c3f9b97d02f6d
SHA512d6c8154839da34af03ece3974d31f9d4aebbc1616adaca28c34e07f9b0e490ea9122c3c1d02eec9f28d5a2fe16068b3884695b5d1e34179afb3f82de4f19ef32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535279931064fd7b5c3841ae057607c0a
SHA1891394b3d3395a7c0c912e7bfade96e9a194d584
SHA25619c7ca67c1ffa4c4d07b2a10982c61ceeb42280649d37f5656b83e6a42d47cef
SHA512ea4df73152542b643f36aa06473b40eb58c038eee93f62a31e53f7d14261bcf9c718578f69299c9c961ce74eb84eb33d574c11bcb8e777d7b096c226ed9129be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0ae22cc2bcf094d943cebd7fb05058f
SHA1db19ff357b57a6a3dc65b581bc37c6d5aa580f6e
SHA2562e5073d697b0b33e532e21de96796f7fefa31de79b50f5f9daf7438dbb6d215d
SHA51259dc5d9078fa2ea174d339f2390ed4168449ea4d467dbd93f224e928fea449b6a30af63c1672b36e13b1d7542be7757a2782de8b67b0bfd4342134710110b6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557e03399120f8db517f514707fb9e5c5
SHA1971fd5d3125a4f1276b9c8471134f7e3baf24c15
SHA2560f2535e35a86bc85bf69460a9bc8b7b03740dc4ca9ea98d25eeeab09c87677e2
SHA512d562b50822ff4b3061cd2a6cbb261763416b1cb8cafe021ecac5bc5b456e9d68013fdc4f96078d9339466ef97840dc8bb9dbf7cef13288d80b69fc85fdd50bd1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b