Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
0707dc6cb0325720e14facd33cc20257_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0707dc6cb0325720e14facd33cc20257_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0707dc6cb0325720e14facd33cc20257_JaffaCakes118.html
-
Size
53KB
-
MD5
0707dc6cb0325720e14facd33cc20257
-
SHA1
8dbe653aaa80e127f482f7bba120e4d2b3bcfb8b
-
SHA256
a5a750806085faeec23a5b20bf13b0ae366dffa27c9bb88715ad7414c3e4dc36
-
SHA512
3f3e42fbbc336e88f729e01bd788bf0f62deb11a761b11cb2d3b841fb0f7e72efe173942a95abd3a2528e58188101d53a4916b11129920a9467cf1830c848d8e
-
SSDEEP
1536:CkgUiIakTqGivi+PyU7runlY663Nj+q5VyvR0w2AzTICbb+oX/t9M/dNwIUEDmDn:CkgUiIakTqGivi+PyU7runlY663Nj+qK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e625353514db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000ec96dfa6ffd52926ee562501cfeb3fccc872e29adceaa7088644cb847423bdf2000000000e8000000002000020000000d9e34c2e5050bef03967cff91e6e785e456142a9ae56fa7a0e36164d5adc0d392000000080c579bb4d4b16cacee7f21e24da57dc9aa8237aefad0fd9e8d630ab8d9cbf7b40000000d83cb5245dad5f12fdbb658119a8cdf43ce03a56acc7c919c1d40e7147cf79176da41a57f2e97fb580d6a0876e7a2fa83839287c322e1711d25a5f8d205dbae2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{590ED471-8028-11EF-841E-F2DF7204BD4F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433971506" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000225e983d728d3878e27fb646de82840d3204c8c9f33143458007466a68a8e507000000000e800000000200002000000034c36551e4474296df65aa1f93826daa565df7a0e5cd7d840840baa20bf6d16e90000000265b5d5527b961467f83ac11015c657f0c8b7d75b6ec61e416293545bda88e197f29be3a21d2c28e8443d843c14aa24074d18be2a7d44543841265d376654cd04ef238a4ec70b01755d9b720d01888939bf94089023ca22b809e542549c03fdc5a3c3fbd4b0b3346f359ec336a1248a15ac4505bca9f1acf097fe00a2a191b6ffb544d331f40de594fe4e7db875189f34000000066881c3df8a28393a5ea486aa3e9dc026b7da8f568e1bd1f8f0c09160d2a4e81961367c3ebb3fc314d6502aef2f030ecfad2d3d1884e59f1d35a7d680ce13c52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2896 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2896 iexplore.exe 2896 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2972 2896 iexplore.exe 31 PID 2896 wrote to memory of 2972 2896 iexplore.exe 31 PID 2896 wrote to memory of 2972 2896 iexplore.exe 31 PID 2896 wrote to memory of 2972 2896 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0707dc6cb0325720e14facd33cc20257_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f53022ad33bc8a3d7a1edf34df776b6b
SHA144493bf0701b89017daeb5f5ce72b2a07815515f
SHA25690df005eea9989f1bde648020f460bcb520ee9792523c4cb030e59cebc52c9f0
SHA5124530149bc0b7d9c1f37fb79f75ecc8b14d9941509f7994c15e10e9b0b34ac710f6ecc4449dc5d787970d39c4debb9c0cc2674a2b0863f259a856cbc252490683
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5809c770ea6dbf88acdc93c05caed8e53
SHA1a9d84cdfb8d438d57148e21cf9bb4b0616b74479
SHA25682e7491a0f903079fab2034a10a44d65890860525e5e80251f0207e8f69c52ce
SHA512625d5e6679d531fb40e437481a3a4a1cba154976c0c014d8070deb4edbc08973ed6bb1c947d485a70e1226e1f588df91326d42f4eddbc0983a406fdcfafc6c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515e96e6db84e326579562e9fa6cb7f7d
SHA1d4e3390d9e654a64bdfeca75fab37f3b76cf53dd
SHA256fdb7db92039da248b5b15959b93cc0c551f85e09115e37e5fb3e04d0b3b47f42
SHA5120bc91bc0b35c25fde225dd70b2523c53e6b42bef51c399fafc7e61dbe64aec68d11f48da1c2812780ac340f304ffa171d56411e62854020b01c73971f76393a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f7b5b032595fc961486bd7259e40c07
SHA15021b271c6df976af6a9eadd2350c9fcb6b904f8
SHA256b00f9d22a6fba5fe29dfed49d03e4d7732f84dfcc5b1d0341364b0859fb0d8dc
SHA51201f524749980373ea6aed8f38ecef6bff385ce8b05e17248d414d05f3981ed078279bbfd690f089c4886ecbf9b11924e29c80471d231c3b58cde8f482d2307ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5055c98ecbbfbcd98abd5d6bb5dd97a72
SHA1aa3c3967b01d11e7659922d4146595534bdeeefa
SHA2567e96cf5c82504ce9ffe8f843da5e01904063f63fbd7e8561c53374a5646c2f56
SHA5128b3d7b4f9bc6cf78b3e2a0eb7820d3713a3eeecbddc25feec76d4a337c6a95024ab80dc55df97fe955eaf7b7ae2abfe5f5a810dba8388c9e544f84f1729799f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535ca302f4bf98ab8c87ddaed36ac3911
SHA1ea167691db53094165b506abe838edfef908133a
SHA256e18619b73cdb437341a128259697baa55229c84f44b484faa19a13705d75cbc4
SHA51209f20e6bb77f35a0d51fcc06034b78437e4d35520faecddcea630661fe56e7a1813454e85dda8066294ff77d37344f022b1238d0b8999bed0c69a39a09a2c017
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5554fca6e26baa1f2061979fd8a087009
SHA1a7dd4089a354896adeefdef3997910f9d5b6f1d0
SHA2562911a2ff781bddc9be38ecc4b32a282bac5c0ae9db9433540b5df4222bf4069d
SHA512a0b56746dc200136f26163569ec681852dfc6d30e983887ade11c85e63a76b07f494137a851f24aea1df2cb3ac982ca671c25e45e846678b662b39a9de673aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b11de7332bc0d93cb5b261cb50f103a
SHA1dec74f744388b82cae1a2cc4343fab5a430d8911
SHA2564ea308b746e4da2c90c21ea063c11a45ebe757ee366f897ad617bcf45800228c
SHA512e9ea8eda32bc3bf20349f2dd2bed294715bcb45cdf9f45fb0154c2e92509dddc054eb047f4594c73d9a3624868ebd1fb50da718c482fe5ddad98e6328b8aa393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7b3be8a3607f7e21b6d6bb5a2ce8355
SHA15d9bab472dc456335413758d36ef6d3b110f2c1d
SHA25696326f8c08976cfc10c010b64776df6e3a772aa37349fac583523788d1af6042
SHA512656d6d667caad977f15ec2600774e279dfadeb2cec9dd8d0e965e7c859dc33d3440ce180f33c9217212d1cd196d4a5460d7f7452bff6716cf360f2f8d0cde365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b45de9bc45d01bde9943d7896984e62
SHA1551baa6986cc5bb27245af3a7fc0c020dff7944e
SHA256999db33c9eb847574c17cbb0df4bf399d1ccc31f59276fff2400bf2c96d21e1c
SHA5122cf4c61f99bd343b473dd05eaf20359af4115143859106e5b89bb00e79723916af785188768471a87b0194bd1997727cc42103be7028973f471fe0aa88634593
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f90a230efe72c78012254c3e0280431
SHA187a4474a1de802a4ebb4634ebf9abfbda406bbec
SHA25610a85903e148b5e240295d982297c977375a97412baee914be899afab51aac02
SHA512e5e75414b52bd57476854768d7de37bffd612fee6c8b4d76a2336f9663ae9c3228dc1c7b8cc7dc035499f68c35a285bf236560ae56c5054c2b06aa3ec476afd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e1d75709563fca572cc0fc6acafbdae
SHA15b66f88096b5bf9f126cae48b12a3bda91785c95
SHA2566357d85f6d70c7c5773ac8352432e5c76b799c53df8169f1199a682cd5586b2e
SHA5125b9bd9cb7e53558218d8901a3136d3f4b5ab1e789ce476b4e598820e825987855ada9eaee00d5c5de42bcd1ac3735dd5c3f407dc5fe9158f4a9490b25473c84f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58297207d0c14d1b3a901c32dd3f7a752
SHA1b811f1512e5f19dc2e8dae1b51483974c7f40282
SHA25698b6e80d930309004cf6385b1477396c0cb0576acff11066085bf0c165c36ff1
SHA512f93d7ec89b7ba3e30ba063340e21cc526ef1397eef779d91d851823d0795dce56dee0c331cf022b0c7ec474d4865aadb1f8aaaeb9ca8c3b6e84eb4212fbb2cfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1b474da91f4dc5c14f43474f443bbe3
SHA1296f1746cd653a0b0c078adfaa11c8d13773f341
SHA2568565dd919bc51140caa964f89ec0b9b7f4a1de8aa7eefead0e462e4d4077a796
SHA5122e06ac5be7f478870564a4cd19e161b111ccdf3f5635752a2ad9e35658bb72864a265099a89fb76e3d12faf188a7142b6bff70ac17939242139c2e2785e1d6ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fa31ead915e4f389897862ef852a3a3
SHA1740032546a2d6fbba0e08b54fc842b2d2f85e365
SHA256cfb716e1c85cffe222a4bd5e408ee91b763f1e9525e7e3ca6eb74ffa7dda7a21
SHA51293f0ebb292ce09b9a1b8f58ee37aa01224d06a503461c49de68524111c8c1cf7f5404e6323d6dc6ec25e98f73729612afa20b39e54b7452a05977c52f1724d09
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\wt-logo[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b