Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
04e2a08db6c71f2d1163ae3a812cbe63_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04e2a08db6c71f2d1163ae3a812cbe63_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
04e2a08db6c71f2d1163ae3a812cbe63_JaffaCakes118.html
-
Size
35KB
-
MD5
04e2a08db6c71f2d1163ae3a812cbe63
-
SHA1
c9d4d430c85a1069cd6b108c854e338851fa6d69
-
SHA256
c9505da17d469216d7ff91ffcdc34b61c5a0a514ea7514c4e6375fade8e4cb1e
-
SHA512
66c292c08071196d58a22015299d4545d130f3091323c924cf5fe11f67913ea50a00b127eb0a2cb5b80ca8b8ffd59ac603d06b77745f4cd183375fb62b3d4f06
-
SSDEEP
768:zwx/MDTH0u88hARtZPXIE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TL7P6SW66JDSD8X:Q/fbJxNV0ulS+/I8wK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000325e8d8442e4b5ba03ea830fe4edcbb7147a2343b9c59c79937bbfb5fc400025000000000e8000000002000020000000d4fd7bf2baf1cb292aacee1c2769d304efbb2b53def3ba902c1ba23517ee2eaf20000000090d5eee04fc2a15c6b626729bba22f41d639f422218d497eaa9fcf9c7d90eeb4000000058e9d86e6b6f3cef46bf26b50c96a6460d660b9044554f032b3152ce1fa146b2d0e84e9a55ca483654c246d7c3df5a4c2f88d628a03191140b0dd0b59c6d7180 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0265ee1d413db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000aed5f3f7fa728b624f654bac7bedd55eb468adbf70b1364d32b0733cb39957ec000000000e8000000002000020000000f897fdd9dcd0408234ec86a583c4265da0d1e4b96c4f0c21996ef2b2f974148b900000000e16bdac8bd079b2e7d01724a1187de68794bb03c8945e71d602dd4ca4ee428eb303f4d40a624253d2067dc8d6cf7a4767680c98f2f4883d3158131f45967b541c0f091265ad18aba592dac1e1c3fd2c6e49b52e95ed1445b0b8e3fc76758715c074222b55a3f996694abb7b3769e84dd76d1c8ee02e0ca748f498d2c860e3c8a4fdb82db19891746d3422ad89dafd714000000051959338a123674d77e5a4e519631120c63bea163410d3e2e252309b771c8a08d1b2cdea49515e3d3945bbe7fc069b722c5dc4285e75d023d69036403e31dbd6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{069FCF11-7FC8-11EF-BFD6-6E295C7D81A3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433930126" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2760 2080 iexplore.exe 30 PID 2080 wrote to memory of 2760 2080 iexplore.exe 30 PID 2080 wrote to memory of 2760 2080 iexplore.exe 30 PID 2080 wrote to memory of 2760 2080 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04e2a08db6c71f2d1163ae3a812cbe63_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a5ae67ee5842dd9c5ed793c1bfbff115
SHA11e29f8852f12870d9bff61179411530a9b7b372c
SHA25627e3762cf040f770f39cc90b8eb7ce44d98927b13914ea12293a618ad005a46b
SHA5129b5618ff15ae46fb5dc0368ee096144888765604014dbac072334ded449fd8bba194001fc05fee650f3031f57d158235895fd13ad184d17216d40185a3d1dab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe3466cd78f9fa76a35c2d71277a11d8
SHA11b07480b99add6f77ff9703ca606d0b4718ec1b1
SHA2568ca0909f7509f49edf16e154dacd4d1dec301483e6ef8268ba4a8ec367e7ca34
SHA512734af4515d5530f5a6e2da9d2b401ef73b3fc11b5e24ca9583be1fbc4320fedc753147e333baa7f3f5d762952243c7f811d40ffb323c56e33fd8f676c290f041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ffa9df9ff793e0137b1d3a4af4fa3be
SHA18656f524f0e8bc770ccc6bf5d512ecfe896712d0
SHA256f4c4bd650a41f5dcd97417eae080e6b82659e7f3ad86df4cc885f1c69c3937dc
SHA512c5f9d1ae030921ba47f23a602fbf9d69a8d61e5395b7a19e140b42272ebc6605926a5a332119ee1af0743568ab5edcc7705ad8dc41321a38aef61fca50874f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4e87b1ace58cdb472a485797e0f1ca0
SHA1e9e2f3a8dc67d1620795ddc5ef7f6513f95b7ac1
SHA25687ccbe4c0c84bbecd34f96ca495319b911632674d3de78b16728b77944d27175
SHA512c0bf9024b4db947912c930da303344868311e0cd0f27af5072a00519975611c69b894d8a26d4748f5f349ab40b54c793e0498d4fb42b2b65c6c746c5a07ff0ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9c51e3569c92a4636d935442c0de545
SHA1c0c70ce07a5122cb4ee5466bd9001ef874908017
SHA25689c4dc13c6d9114081cf48227f9288e0935c1501c48c3a904b8869d2158d55fb
SHA5128a4897d918f3b1e75ea6cfc061712beccb91e2c4f443bcc237c7ef5f562794cbb73e4fe1e2200c531cfece0cb3353c3d5c67f8e825b7d4bcc7c372459c7db5a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529757a2ecb08f8ff74609799b5529fee
SHA16c3e782084c3eadfef96cecf87bc87ab3fd118df
SHA2566b1ed576ce0742e3a60146a22bf74d5a14d39ac0baa1c7551edd0911c0b0f306
SHA51216b991d0e77cd491d3123e3d05b6c589fb219b2811a9aaada66e6ef23a6be1d6db89bb4e8fc3da2433a384f6c5f24a1b3165cec01370321a58017e44d28ad29b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8b948bd5c1029c351241103c139da5f
SHA19c4d4a0cfb8dcda5c35f51173e36b0f12169cd98
SHA256a32724ab02e5193a60f2d06593b93c59eb194f6b7a3d4ae1f5eb3a07e2512ceb
SHA512c1c94d378adcb6776db564835ae9e180a65addd0f4d13cd630a3c267257bae97594b8e183fa028d7051045b03972d67a881c77ac81ea8320c79a6adabe7b1bac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50082308ea9f4cc52b37c06c5ef668563
SHA1bf398b582a27f6bb54285b96ca4b10ebbbefbdfd
SHA256165dd8b56a3e82b95758abd3bccbda567a913850237f6c36951f10d0b96c2a1e
SHA5122c8ed51db86560c63bbc1963ce3238515fb50622b5d380848043bf52e8d369d7a2d0a96c454817c032f74a4aa0cb50f0e8ba80c74f26da0799f229006df6cf43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad1e6d90fe49b3d71a2bf6f97dc05264
SHA1bdc3ab43666fac18c3e22ee8c23fbba961fd7099
SHA25693ecdf44e93c0f185d3c5a2e27505d6830e4aff6110dd0114c8c1426d2c554a0
SHA512b49e4f403faef578020c5b7fac12a0aab9862930ed593177012b414cbb8a17e189400d9eb3aae85cc2a17dcdc03e6aed84db6d25dfe48b767d06ad3005fb7d96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517c2f87828d65065166316d963249687
SHA10f4f44ae6b1b3d172c9a795b9756f08881f79cad
SHA2560668178ef923ddc20a7b90f27933465249fd80fd0b331a7bae34ff4d40f3dfbd
SHA5122c7d7d7883ff057bf19a37bfb75fdd7b23888d1bea3f32253d87af105e0ffc4d8df8bfed65558003d00943b35551c3fd557486247367ec55b4039a12ad962ae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fdae9e8a7dc7476eb329f341b962569
SHA113116d2c88b1ae4407ae83830c8bdb42db66fffe
SHA256fc144a834e97c14133834fd43b6c0730ca35e1f24f5501071b626367159546f8
SHA5124ff823b80e0a627b71c65af8b13ce1c03066e83d64c83d56cbda87b416c539244c629903cf23f2727a32fd04dccf56bf20c54c8a754fc88c8d4a1ee87fe0a278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f9a5a02bf641edcb28a04a169a24489
SHA1f8f71aeeae2c5b20f07d4e3ff388a3392e10fc1e
SHA256b7f076f49019b24b5d67b2346264da23e7daa0019b967d5ff0a9431b03b791ef
SHA51234f224a6c8cb90901a4cbb2052afe020c690148e0919147370a728b50f9d4c0ef0fef7570ef325707e53ac86b380abf0a977b835de221633bdb3502b2d414c7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586f6a818616ce4fdc833eb1347d7f15c
SHA1715f44f4a34de67e9a60f15f80e4367e17e03cc1
SHA256988b94a938d4da26a4bd3e84314794d85dd014156334a289572594744bca1b9d
SHA5128b9a1e1461aaaaf6beac332315fc190dc6cc0e06c8ebd70740e625b1c3afb504fdafa58bfe9b687b51f924a9c0151814230f952a5acf9b8dc8181825ac7b4d13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f2cceb06f070e433ded9d2115a092cfd
SHA12ba2464bb895e2b9539bbcb5c1ac0a1670d10987
SHA256ac2b8df1194aec4fa17e289a5f8c6d4011d1a8fd7c51313cf6560646e1adffbf
SHA512af297138bd432fb6b0c115a89e47ff026a60b3a5ee3664f1de0a1ba5cebaec2ed3da67a6a1063d99e8804e827233872fdc79fa363a5d2d1ed87ff77cd75539be
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b