Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
016489d7bbb98335e94180dd5045a653_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
016489d7bbb98335e94180dd5045a653_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
016489d7bbb98335e94180dd5045a653_JaffaCakes118.html
-
Size
254B
-
MD5
016489d7bbb98335e94180dd5045a653
-
SHA1
ddefba21ef98606a6de35924988d8d830464936e
-
SHA256
e6b5fba63136384f3d4cced1bb057263a576b0255e1e6213e1b2a1c362d9a93f
-
SHA512
c9d05f03cd1d886a394abdb75ce762bdc087c3208783aed9a4a841e8adee84a9091604370d0acf822177747f56e1ca91db1488cb3fab585eec71fd7155c33739
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF0397A1-7F29-11EF-80BD-DAEE53C76889} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433862196" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905a86b33613db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002574cec2e1ce8409e10dc079a3e4cb3eca7c5c67b6716035c40695fce38a724e000000000e800000000200002000000045a915203d7a5e796faa2b45b2a0ebd9f1f44bf8e855c71b67388628e4372db2900000001b70fdcc9e05bc208d8bd9c39d4f2251a7378abb2df19f39e7f7c653724d51d7a9bb1825935c0e7e5a5d48e110671239eba46ec953218cfc991615953a2c9aa3dee8aa3a55e72de98929d697d4d23bd6cfcb9f21f1ccf85e0a10e4f1a33ca0d8dfa8e77990da87a899dfb28174f4343d729f3c92434e04f34143763ad3cd248bfcad887ba95a37eed10ce64f26b49a5c40000000f65d77fcff6a90cb05125ac7d9e16d3d081c6187f4852f043fbc0a23e2fa1dfa11a5b12c1234eadc75a2f499d85710ddaf24562586fa33ddd762c7bce64ad9cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000af8915b8c6152627bac472fc60b0a37ac4737a3b3bdfb293cbe5c225beb6b9e6000000000e8000000002000020000000f0ee5b37c98648b8fd5d802492355ec2dc515a1d629132001e17f13f525ce55820000000288bcb0e543d70f0b1d50b9bcd0aeb911b00bf45cbac9029f47fbbf858b15f62400000002e1fda3541e20e9622cfb554c31f8ff9f11462a2c0127dfb9d921e9f3abe20983a276db9d066a18b0f8b98537e3765e79e268fd103b9ae9120ae86a27ad3fea1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2080 2204 iexplore.exe 30 PID 2204 wrote to memory of 2080 2204 iexplore.exe 30 PID 2204 wrote to memory of 2080 2204 iexplore.exe 30 PID 2204 wrote to memory of 2080 2204 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\016489d7bbb98335e94180dd5045a653_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bb215a6a2bf6469a06c7afba214d741
SHA1d36eec306f495f2e98d7f03a04c66d30fb67edb6
SHA256ddb7903a18e297f6e693ffe06a442709c75cd04a01a2e93c3d64f965c6c082be
SHA5122ced7bc82649dbd36d150b71d80c0a5937cf2603246942b5b159cbae842e6f8398c6a058864fc83d6053ee47aa675cfacb9f85878f0346100127c06f2a258651
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afec42272cfa2a85be607011de491719
SHA10c5fe254060cda531d7f1b77cda893104a5c9234
SHA256e14ee8d2874439f3426f98c1b83c8f6e036ab286d3ec38eeee02015033752eed
SHA512a90941c0c610377c21e68493abaf2a3bf2cd0b1bd6bbcb976af48136e2779ca27129036f1221db6084758ffa4e7147f31e9d6da7014b0123b106d84793cff495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bef1c7f712ea4d717ac9123123c08b47
SHA1ce91376f8ed9b658b55e0bef274c7b9944624843
SHA256e990dfa6ca0589da7bfbc59bcc5aa4686a71e0b07add6f79a344c2b564ac1f91
SHA512b4f1f6c17e1ce83fd8e2dab4c1265354c2b0321174a0601a3e597f914e7d14d79870ca98f86ce1ce97cbc2efdaaf18bfb27afbb9ca5e2671807cec5818098fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9d0ef29f7b51b9b419317fb90e76af3
SHA1532dc77e37506eb659f57634df1a4a8d6de1db23
SHA256f4af7e0273ed6ccdfeb1e2e426ab5da3e52064d4833d454d5e11327226afbe52
SHA5121d943ecf9544fe9dc5fb61c4f95cc341008ebcd0b0ac0c1c70d1ff87fa93548f39b89cb9df59120a3d51985f39f126c52a782a54390cd54d67d438d57f98c9dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b2ff2ec64bfbf922fce9fb876a480b
SHA1b7b9516ca8daabb3100f71983563fee734740f25
SHA25632f07c2c588af3cbdd5163277472c7cc358957b4aa4887164c3c20fde27fc911
SHA5120448d1a66cd041e02bad9dc1c901857b75d40048b82909cc5eee74d93b42298153936a080be8d44f7a802d16f138071e7e7dbee2397665b058da34eea3f73a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59707e87603702276da5519b27eec0c82
SHA1555cb2d57a8e730c9a5b87b1d5bc443edcd3283c
SHA256f6e31b1300ebfbffdbf3c9f06574b7932e1fa4c723c94351bb606da914a30868
SHA5122aae3219e6a303df802a8656eb004ce37baf3d8d4f79dd82cae6ca72c518a79e681fb2568b757d239211a4727d82f9d26694842c539b2a965f61505a3f0e0eb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5246f46ee25a815d52d3942b6c4adab18
SHA13422e1acdbe0d14ca88faf9785db6846bfe2b184
SHA25631f7b0e8ffa0895a961d47f855b1807d15439b8890e8ddcfdb8d6718b4053c38
SHA5129acc181dc6aeb8a153a01ebd1bbb0b65f782e9e263aef6d5838c34a04a3ec96dc31ed1724fb9142c84a332eb3f58ba70e0da7dea11752feccd5c81687224e6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5319eba68d487b92112f4f57015e90e41
SHA151bf1b6cc901b232a8f2f5202758889c7b69e11c
SHA25670e7aa9faa8a8ed0b3a550a964e1515d65f74a107f6c1bf4ae15176ead77491d
SHA512911a4cdf3247b5797d62ac83cd4729b53f8aa84be84c2f0434ddad69f60934be1c263ff000efc214f518dc45c63a1bffa158eebf615f7f470ae9c9091cbfd46b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530817995616d93000f856439e828a6b9
SHA1a36b0b595798da6d7817ebf583c8ca2aeffca07a
SHA256d97c2665cc4fb9ed56bb98a73d88db394597ccf4af605db6f54e68eeb8003717
SHA512233e3a18abf19551eb5ba65200948770b09d350ae40cecfd5d3de95cd25be7008b1f4a43f6f8c9e1840f57c7c15c9db5ae4231537641d45afa6804dd4bdd2f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585b99c80884a77a3bfe97df2ce1869d7
SHA1e8e70db32a6446bfa2a7d0e7adfec5203c6d8f8b
SHA2560a3214cf45509ab836ba2697a12b0e636887ff5634bbb60273deeed5d6ce52c3
SHA5127d8b186b067bb5019a5842203b5b7da7d2f12b8f38c4ef52403e4956b17298c316fa86a9f9fbb0a8704eed0f1393dd0bfa7c2736990bf4843cb17bcb4ae87869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c687f23008dd044ed008285fe66d05c6
SHA117a628866fd86a49c88941484fbf982c4e5ad8c4
SHA256234aca71eaea579cb301a2de4d94927d9a7bbf6e1978a216449825d42193c43f
SHA5121e6f16663db4e7fcec5e11db830c410ca5bfdd3b88d700da58c2af6e79988adcbfa603322db7739342edd26a1fb18060190279c354698f3bb83b1e386d1f3458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54db7fd4bf5c25a4670f6bfd4e4e85478
SHA16f1cf2c37adf7d46701f2a271f87fb30e1aa85ea
SHA2568d5088f3b1a10dd1fe11b5b52a52178b6e2c7c85e91dc84364f48512ef331024
SHA512bf762ce5c7e86e33b45a6c6aaac3f0755ba2fb5509b1336d2200ed9f0fbcc4924b594b8002aba5bbb0f88389c37cf13ef94fc5cb50a350532995343b4c1ed8d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ca11517c75877ae93caa2752f8edf01
SHA1323c2ff13501964a96f7f32d277fedcc3a2b70e8
SHA256139a0b4d515ee2a191a476134dfb481da768baedf6fd1633b32343ad766a51c7
SHA512ed30c529217996be37666388b31010a489809d77e2f8b974bf9d2341db2eee5b0cef9cbf41506ded79768ca22df6d8f54d160535f5ad6eb9785052b9d198017a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad41ef24e5baa7fc9092bcafe96a3826
SHA1159d91e06f3befdd303243f728e2f9fbe21d198d
SHA256becf53a038d3afc07e4648edc34f371fe9148dc64b553f279a4f0ee028eaa20a
SHA5129788f280464a9ddc89ce8ebbe42c9f92ee537934477192b56452c2b657465a082f847382c08af89f80e3412d6c421daf1026959cacd998ab4e6890388031b424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6bfe8db7deb8372cb391fcd38f15f51
SHA1dc4bc950ab911a84b393c4d0396d12e6dddb9015
SHA2569463326070bef11a67c876ff7584cf7478355117c518609b3d9623e4acc2d7f4
SHA512444f5b5a40433d787cda794604088cb99fba24d85a538cf02608281ea8ccc9a3a7256efd09af624547148b95cd868a2b58dffafe5e7160a622cfc6bb19facf08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a337b1358b0ee70caf4f76a06495a2d
SHA1a4e574a5c311659f94020b960096ef599fb16536
SHA2566e1d2caca1ab7a8222c557f94f6561dccecbe05d234da54a29df7cb460e4381c
SHA512ab754e63c0a4f71bceb6f66f7d80953802e07325fa9ec392266045426227446457d1fbfbf6bbf506fd21b549cac6aef5198d2607b72ad25db6ed063118863cb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5726c3421aad02608cdafaca55f297547
SHA14e9c282314687b78fd2c9f2612892c94f493cb50
SHA2568941c993ea6dadee4d0a80c20c6f5014eb520db0f5c270b430f4565a8618e3c4
SHA512df7b57ce1e1101fbcbc157ff82c6108cd5b21717761c292808589355384512d8b9d6bebf479a438e8ae283c44e4ce6900c8bab3aed0fc409d3e8822e3d86d451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53be77d57b642e9e98d7c089444a34f68
SHA181589df574fa295b2d604b9bc442271f70439ef0
SHA256d725777aa6583e5f559df9073d82116c2c399689e92de0721ab85785e52cb528
SHA512139fd7ef33bbaa19dca63fd69217568da5821d7e3f65562ed9ad398b346c6316045616657cc50a67f6906b89b5f4c30829799edac106d3bc74a9366faddc0d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6904174e00d79a4a32eccb0ffa2a7f0
SHA1bb0d93384388d3088de6760873c196f89a24fcf1
SHA256f8f4a9ecd923adbe7b99123e7c7cf898a316ff466514f105169299fa1a7c4930
SHA512bf736a251302f8695188a004e307496c5ecfde109fa182a47fcd098ec7f596ea4a4cd96a65ca4ca953a91664467179cd252a919f4471f65b23362b978af0a181
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b