Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
ffb5475231a272153ac26da95ec082d6_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ffb5475231a272153ac26da95ec082d6_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ffb5475231a272153ac26da95ec082d6_JaffaCakes118.html
-
Size
1KB
-
MD5
ffb5475231a272153ac26da95ec082d6
-
SHA1
999478555e32912d702b48e2f8f9838b10b7b174
-
SHA256
861accf80bc01b669333de116de643e8de749696eaea5c51793d0fe46adf4d94
-
SHA512
ede57e8eaf548111a2945466e9b5fbca7cf6769cda21576fce535331a8472f8e1b1c0d01a3cf20ca0a4f41703440fbaf6c03212daaf95a64e85659b01586f4ed
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02d12ceda12db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433822723" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7D639B1-7ECD-11EF-B656-D686196AC2C0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000083677925ebd5c51c50bb1d0f14866f84a933dd9a073f46d53251c71c8c133671000000000e800000000200002000000078702ba06260dd7750ad36fdfea3af0ac21da17a98d3eacaf33ab419ccdf5fea200000006ef336f50cb69a08d71af5b6f90e333e312e2d1ae53bce54ae394b6473c02c754000000015742f8b75d99a94b6160504a666b4b5d10556ccd85bc471d873129c2131f789a9c71d0450f19eba806f042bbeecf0b0f836552d8e374b720ec89ee6791c0583 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000007f7f4dc22665d81cc8a6aa07570c9fe79859dc640e642d45de235fba744f9e9a000000000e80000000020000200000000366afd7c0ee5b61afeb5f93b570841eef6afb3432b575289b6aa429883bf0c290000000f4e181e6c51ad6071617a423fcde9496b99034cda641998a986356946c31bde84dbe91f1f279d5f42989f94c445adc6ceeb98824f9f5243fd8b6722bd1ae5a04fcc63f88331251e34c05fadea4a45c64bd049107c3cdb5d918b7ea02e5718a15201c1ad5a1729f0d3a62f5ac083a41f724a3b1f5ce6fdd8f84793c7f99159782b9318b27abe2a255b82633b747fc9dc94000000023603f026c48a3a7cb002c94841d46645cb406f1516737f214b754a44402916d0ee92d1f4257fa27441f5eff3e1bd2b7889c8930686e5ef49c5a491205451d8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2600 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2600 iexplore.exe 2600 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2316 2600 iexplore.exe 30 PID 2600 wrote to memory of 2316 2600 iexplore.exe 30 PID 2600 wrote to memory of 2316 2600 iexplore.exe 30 PID 2600 wrote to memory of 2316 2600 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ffb5475231a272153ac26da95ec082d6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590edc01673a3821fed29e9171a9632f6
SHA17a7fc6711b3c91da557004e0dc0eaa4c5ba262eb
SHA2567b2699d13e10980507b9ae3e13bc9a39d42c923d66f0de4368a956f97b90bccd
SHA5122d8ae8f16bc0f93971522973bc5986dfdba5b00cd9fc0677fc4797a2a712f15e4cdd0a4f69684065a5b8dd4d27a77b6f8438ff523374d4c6d3dd59c789309f78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dfb86fb539fca1cc866e3d7126cdb10
SHA1eae7e8a15336015ee21f1735914ea6c874bb67ee
SHA256e0542356917d30d80752bb5c8d528d21c1efaab441bfab212a68ba454b93b8ce
SHA51279c9ffb49b1e5b9d9c467c401c00c153b5fbff3d7b65c735ba5924fa203bf49844725311b4383ec0b4486315a2bfff067c1e10eba090be7d4eb40da7a182817c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5233b71ff47c22a36dfa9932acd12e04e
SHA11efc872b94e67295214d5009ee4a73fd47602650
SHA25668b5bcf2883f75e0fb669d503b6a53c85b87a0bb8a5ae8792bd24819da73b84c
SHA5123dbb005318ffa2a4addc19e3a4508af54d4ea2c9ca24eb34b80a243c0602981f07ebb051bf663fc4717aa68219e987e97a56e68ff3674b827e4d499aef6b76a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561d1faa04405500bb00d49fdb37706de
SHA13bbe1a9bd696f389cb5b242cdc562603bfd5e0a9
SHA2564d14556929ebf41d19df2049882856e516fb90c31c30a0473aa78a0e9409471e
SHA512855d4aa0e8c9034d2ee7b07ea457ce6807a6f77efc3aa016b4eedb57d2b3977172a7f653b9b31eb206d838f7c8766c28b6830d57fda359850678b24b2082610f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c3878f663f34099be00cb21462c9e5
SHA12449deba8f6d6d8c9dc680f0b7880702161d0257
SHA256b16e7764f74cf1a64ea8cb0c71b1e5aee2813f19678c1d0441438c78ac29be38
SHA5120a073fd88c52ce050a0fe2c03bf8949e7e5c14813c80a2e10a63c07e3b61dd672b2d18001ed7843756d111d2cb36600714853f48aea997dc9220990c7af36699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e3cc791d8dde1b551e32537ad73cb05
SHA1d65f563303713bb4c6c0508735bc1893236537ad
SHA256d455603e7f46f0ed31a43dd6ac1f2a92201ac4a1283c2f5ee9611603b7147884
SHA512f63c26566fcf538e8c989a4d25cc147b18853d55837f4abbb154490850359337c70c1f69c531855cd6bb0222ec120e092d52c550e472d9afdf6fa9b1c9ec29dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f4110a92bc9f58a7c53c29ef6c51ce6
SHA1d2cae3cc5a1ff05f12c56321076b40925085598d
SHA2561cebcf05a4d27457a3f280aca104a08637410a0c71401faecff0e83eb48907bf
SHA5125b7eb2c4df262193eb727a21dda3e56f33956057985ee9504422c0e6b466346f745df4cf8442163a008d9d9ae6300bacf8becd2db51efdea913cc9de4d9cdd6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54df63f25b2ced89119e1360654af1c80
SHA178e8f9d836cd4d519de7dc16d97d9c4afae11db1
SHA2566e27423b24e83bd24a0a6909fb9749a619839eec1f1ca7215051def1e6e31612
SHA512bf9c75c28011e8921ba47e4f9dd23f7b19301de85cd8b050e27017cd9ff5d7a6d3244348467bb83ef18c8ca3a29b8cff07e4af9984de40dcb140757d66b6195e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6102e5629180466a565c167f09ea71b
SHA18dd80b251eb1bb4107bb8c035c7c5e62e9c2d14b
SHA2568b592f54a586bc62b44fa0186de5446d4f2bfda02c85970ce35edf9963fd3c02
SHA51244dd0c082609c0d120eb651b7c4fe4520351fed2294cfc4ec6a3e5b17708d3854015c35e0f240489f33fed57cfeda3a1d98fc9cc1038d78c083b142ebfea277c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6a3bc0611fcfb7251fb9e499b4c35a3
SHA1415e79ed9a0b89cbf36f592798dbfcf4fdd43d48
SHA256c82e8d7e9fb210a34972c4198414d4d986d3cf243e1c37f62c38e7aeec4f2247
SHA512f4a41cd3dc5264b33f14099796fe9b467ab8933c4d50f753ae89dd7f225ca0e668a9697db33a77c35f3719b09069816fc1d93c4a8fd3250a86a51471dd8a3e06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a742a864d32d4f1d538efefdd6c6c71
SHA18a405bf7523bd524ace87baca0c4d2df4cbb8966
SHA256671bd0eb8280ac11e4e9d32acb14c0e3da693215397a3e0a963b157be7df6ec1
SHA512561f9320cf2821149e80cdd75a3f9673982edd338ce103cb11df949ba7e14d6fa2a5a082ecea7728c3dfcba4ecf32b26264db9220d3b9dc85bbe1ff8227b25cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5539e1ba70d7f0fd006f029543b943fa8
SHA109b52c8d8a904b70f600f4e77db9e3ecc3b21aa1
SHA2564a7dea908c692328046a9734d724263b846c806903c5d1b9e2deaaf2904a990e
SHA5128adf7e5ce617547cfd756718c6e46afc0ca9c1f3f389132f0c8469b1607a3b7ed6f3745587cc28d140b65cff86ce6f0d64044f8991cedc49f2ec3fe0d6606e98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f29eac9164b8393179af7991e35ed1b
SHA11bcc5baf61c1ee46fad4fe758d54fd1c8d40b759
SHA256cd5cd4071ac217eddaa724cb685d422e1ecd206d1c7ca199a34cb9e20d303c5f
SHA512cb4309011ec4116736886243b227eff738598eca00e8539a2271adacba52904f770e5f0577601b1b3992bf415b0c3120894a2d59947344b717ba0c9a7d70d64f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5394d0a6d394a8af1bb1c2ae053035bca
SHA1149f426ede7b35ef0032dfe7ed781584e910d8b3
SHA256d3190dfcabe00b196b9e3704f4f5aac63bcc6820ef11ac0d1ed37b891cd5b928
SHA512da45fb5cd5ccfd065bf41619304a8c77e20e9a7064d7097766cc452ee451de25830da4e098f868713fe8e7b3f8c3a6057be0070a502ca3bb23a5b1a68aba9aca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcb2447aed6ea8ae1f3514acbe58ea00
SHA1f42b10be7a217dc5203f8dcc815c2762a6b1c7cd
SHA256f26de949c828855ad3f1f6e67261883ae103e1b0a45e2291a6bedf8ec2f2443e
SHA51224373d6469e20ab3dd073500fb5bd86093811b6a94ab1de48b9e578cfa86dc50b6522b1417746d414e462779733a50854948c8cfad9108989ce71df2477a03e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567f0ace5fa7743868942fdc93fcc7c01
SHA1356237e9419401560ebbd8346bdc1c762c93f212
SHA256ffc8444ec848677b0a7919b4e2f888185019f9ed3fd56eb870de1901cc7e14ff
SHA51264aaa758facf4595a666bf4f12d97d7d1832b6d405865bd4275c8a5a22e3ba6c423e805a54e7350f3e38c8939ce4f61c2ed9544e92beaf1b84f428c0dc0e3825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555a4b9c63006356bf162d0f3d99e7246
SHA16627c35402319c1de24d8bd058a46c85163c38a6
SHA2562b5181a31573f249446d09d4cc519948da3b05a8eac4adb53647cfc4c29a782d
SHA512336a3f0d0818a93d7694c9bb433f5814eb28c8e25c64dfd8e4f1d2db2ff3f315d97ef095f09a9324b6975c2bd6a9a382855779413fb5047aa7e58897548601f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a42028005fbe06cb9b4f19ad714fa40
SHA1f5ed2c2d18093438e6ba2086f57901e875d94ef4
SHA256941436dd4288f0927e6ef0ab4dc1960e3a78bca3ef8a9f2e6ad0794109398806
SHA5128c2118ede5841f555b7e395a1b5af04e4ca70d7636c06c2bfd0053a33cee770d50fe424b96d634dc27762c6ba06bea0b8279b3a6728d0c3e56c45d2d7812a805
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b