Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
05578b1eda7bb2f354d7fb81b8d5048d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
05578b1eda7bb2f354d7fb81b8d5048d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
05578b1eda7bb2f354d7fb81b8d5048d_JaffaCakes118.html
-
Size
141KB
-
MD5
05578b1eda7bb2f354d7fb81b8d5048d
-
SHA1
48c7ab20678a0824e4f88b4a163d4a709843800a
-
SHA256
372ec5abd71bf1b174a25f6e7127afc9d1f817361f51a16ab789646982a0bdb5
-
SHA512
f0b06b18182a35238867c259adf73bb128c2e1e221ebc6bf7a3a730d84b1d3bda2c030baf9cc62bf2b5e354545ac9dcdd3795d07e11f494e960bc2c561b8f8d8
-
SSDEEP
1536:S4XQ1UTlSlqTo9x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SqTlOx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{048D4FF1-7FDB-11EF-ABB3-E67A421F41DB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433938279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 iexplore.exe 2056 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3068 2056 iexplore.exe 30 PID 2056 wrote to memory of 3068 2056 iexplore.exe 30 PID 2056 wrote to memory of 3068 2056 iexplore.exe 30 PID 2056 wrote to memory of 3068 2056 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05578b1eda7bb2f354d7fb81b8d5048d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e86ca597f0cc056f1553baa49229623b
SHA1f71375558f99fb892cc01283005e8c96b7445266
SHA256f0309784bfb36fbe36c638bb8c5d955d813dfe6b7d73038bc978d09d09f78b24
SHA5121b435cf16bee9ac07a6897d10ae45db635b264a3d6fbe9f6dab05d973e3eb9481457387acbd05f26bc261290dbfb2da2f175ad3c898a3ee3b0300ce558d152f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e1e52670dc69987d473879bef14f6c5
SHA12a87c3129fd005046454aae68d9752395e93dbe0
SHA25660cc9a5262e3ec5f6bbc1dae6248f61e8dfd00bb97b44716b02a85b5f5f55285
SHA512ba914ad3e8db9978c7fd7237536daea40d6057dc2b8943b03c5d7d9ba831da16f8b5e50f6320b26a16f406f0ae0737460163ff70f662f37cd074198df5173983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596f5b505223c3862582e45634cce56fe
SHA19de4f09580f4e6d2f1c91c4566d08b1ccb1c4c00
SHA256b3ed946d496fabea41b51bd7734430841ba98ef880dc8244b50a1e46badfe849
SHA512780eb87fde40d309a9aff9bff82ab4dc3a782c37764ee4cdd060252628505f8288d3812e961032470112e634b8625bde6fb3267a5a49537dc1ab4551a6247b6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5624c25d29fc4d4896df49b731fedc4ba
SHA17be94780f70bcbdf6070b801baa06656be4455ee
SHA256e642d79e3eaf26584c12bdb3b17eeced4f299a08098b2b7d3568357cf046f090
SHA5121c862bec63265c92ed8bb1f797dd53f159bcfcae379ecdf0cc856022e9a2e0dcc6fef388248d0cf7ec22e956c81d7311588253a2b200e2ee5a0a5b7124930696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a38548aab1806ed9fd8fccdfbaa386f4
SHA152dea5315ec41a0684954fcb3569165fa7c6b968
SHA2568c1b067114102fcdd844d9538d91e59663f2cba39a2f2aaa8154f8cc143c83a6
SHA5124ba7fa149201866e68b8ab2e5cde56c86dde8606e6e56c4f2db8a26ed4fb1dc7777901c3880a31b9abae4e1d72cf5aa1df1bf65cb55df99279a1edc3acc87258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a60ff5a845a2adbfc72022feaa3cbc09
SHA1f901dcf9829e1487d3ac9df2117f3038a7ba129e
SHA2568b5114807cc5cd33ea1a9b27b4ec89194af41dfa129ffa6fc05e8e6b48c2f51a
SHA51222991e4a7a55cb5cdc07e4bb70d6293ebab34fd3a76bd968defc4e54fbc5f41dd6b343643e8c3831125406f1331ecf66379cb8518c45cf0ffcaa402c17693ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e910bf33e8fa38024439738c79ededf3
SHA1ed0e00680382dc2d0581c352a0ee4db4d412e7a8
SHA256254590eb79bc6b6ec9f9a8d5fff6491b729d63f5124a2cf50ad1f24ff0b17b1a
SHA51220002af1e695c0a40e0791283f692d07ddfecdcd276b8e97d2a4d025e6e3a8024b05288ae5d2ae2e4df5ed17554bc719c839e7c4d93db5a2c37b14dd3082c1f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5958ab1cec89cd4504c1fcbe8674f9b5e
SHA11c6156d4dd15acbdfe6dde6e293b88c1b26a8a79
SHA25654c8305b4ac9557b0681d61c23ecd884a18da971b129f4acb930b156479013b2
SHA51208ce32f5ed3cabec7fed8dd0f8a4d8275bd51f6f0ffe4c792bdfcb7636dfc3b37ce3accb081b5d60183186398c6e681c42c8300834176bb022b5d971838663ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e647810f6cacafb4e9a86bc586b6695b
SHA182e0d569e7c22fda3bb6fe63383f9b098a93df1b
SHA2562e68196bc01adb872f7d2e356be69e336f2ac238637e8416d8d3391912b75821
SHA51276335c32616728a477af8a08bfcd1e4a6c2fce6eb8670105709e4c81537809ce23c1405cb536d8acf753b0e83e8784d6767b7b22e342c1c6b07d62738bea7446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef7030632b0c59742df79a7433d3bbf4
SHA1674dd993a578029f3200fcd0f18c0da8135390da
SHA2566ef9c41250277cc36c6356115cb06f8eb73d042e27691948d71b4455c4dcfaa5
SHA512b51f99de508c72e733656c4af87ca0bb0ee1836091ccef86bb3ba85741f6dd45f3855debde61e02c676502e3bc98ceccd7e5764b2f6fcc5d01b5c4a47c7568d8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b