Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
08409caa89164dcff62a276afc687d57_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
08409caa89164dcff62a276afc687d57_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
08409caa89164dcff62a276afc687d57_JaffaCakes118.html
-
Size
14KB
-
MD5
08409caa89164dcff62a276afc687d57
-
SHA1
fc085fd7e4524228270f7f568620a55005228186
-
SHA256
9fd145815531a52bc6dc249634879579c85a8235abb82247cee2d73d651a8425
-
SHA512
b1b882f57bc16da9266e6c518e6c151d90c7a403d677b032c935cf972fd14bc6f5ec1a354e0ff63868d5646e76858e342f53f9151f0e45d70e777912a991628e
-
SSDEEP
192:V51ckN7t+c9qW1xVLsH6M25WEKw41FgRg/f92TGRF268PRC1Vwf5iXN53NohgRZK:V3qOxPxY6U1Vwf5iXNRX0IFjp8uwZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FB3ECB1-805D-11EF-916E-DECC44E0FF92} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000004506292f17dba04965382c22235af62ef20930eca31bed475325797f8aa4dcce000000000e80000000020000200000006bf702e0c2c4901b2a0428e34e1001bee4a767266db4848a09edd97b3ec08e64200000007a15cb97646de0c16f4da6b81e688112e7080119f136cf59e5d6fdf241b1aa0440000000b3e6c1171c9c356f5764dd1ba781750b37e19b691f4b777023736c5c3c288e30ac267fb45e034102ce383c7cca26d1add2e2b7f0af4f079e3e608865aea7457b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009f9431d4d6d16b0a4ef18b7aff2fa61de1b2414345cf013131398555f1d506a1000000000e8000000002000020000000b7431144493865df69e48ec086d8dc7dece77840ae90cbdaee48c35e4caa4af890000000fab91f75087e78652ba2b4f3f6180f8082c107605e8982ba63c24136ae4c62e1946a255ecf30c3480d12adf0d6fbf17bbc8f9db50791194588f63767550271a947fd8c8895eaffcb46e97095dcd7056ade813ef82d38b035d44bbdfd9d742256f1fb21ed262d336cde9c442ffcb5b54178b88747e4f1da96a29807acc15c5acf4fe72ed365743619e439e3d272603f8c40000000a4a7178c7591dc267174fc65b326e0ecf73424ce2702c31f46d47025062c18d50d6ba4b8fd7827fab7f4cfa76d632200d4d865c806e7cd9fa260126248b6091f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433994348" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002336646a14db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1620 iexplore.exe 1620 iexplore.exe 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2852 1620 iexplore.exe 30 PID 1620 wrote to memory of 2852 1620 iexplore.exe 30 PID 1620 wrote to memory of 2852 1620 iexplore.exe 30 PID 1620 wrote to memory of 2852 1620 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08409caa89164dcff62a276afc687d57_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b3a811cdb9a4274e730416972e80d77
SHA167c2ec3020e0d395e74f3edd476aafab4ec13bcf
SHA2566cbbabe1eeb99384d11cadcc4916f178b70c2a6a623de335d3e87dd02687e6ee
SHA5127101d56d5472820ef07aa92c13fb99fde0eb1094b6d5332f2feca2e0cc12bc84a47131f047a6f9c3a421b28b26de86baa0a74882fb838201e0d31001c287a260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d0cdabac09241c8568bc732f554ac01
SHA1e9a2b45a1fd91663e049ab9128df70b8153e716e
SHA25659f85400d5f355e9317a74e464c90777d0b45cf4b94b5ea15d2e40b9c90df863
SHA51219e72bc2b3e16b453876652426e70d14e19d787cfc1cb1038e91cba60da7f44b52c3f408a92330fb466c0a30308aa523688827cc369771e8fde0654b23f26afb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f571dab12895d0bd1a84334c5ec84fd
SHA1a114e8f272f22321dc189eee9f8a9ade449cf8af
SHA256210a0a1774992693ee09f828ffbb11926cac2dc08e7907cf32bd29cb7aee8a6d
SHA512138e94878bc06facdb05b066d5721449ba7edf5d7ea924aae381102bdfed8c22dad27c690de5236c17e46a8d9a425571cd54cacd59eeab1e30295c80b5f57013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551bc0d820a7174aae9a48c3fbd1a4b74
SHA143fdeb1a7f784ddbc575983439d7fd47d61858d4
SHA2563311647a21d37fe86c0cbd750e3b79f29a7d2201753d425493c2525bef0abecb
SHA5128982d2aab6694e768351f1223c0d680c65a534a5e8c0042fa74acbb8cfaa724415c7a18598a2db25d5eb959257b6229716a6ec91d6a2ed5302fd8a64c35a6200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527dbc1443e267f1df878fc57d5b3ba71
SHA1ac782958c25863a805a1da00b52de14665965beb
SHA25617383aa15740420c05873c9ea38e46199e04f785be633a841f25712cf91faf98
SHA512a57c5e6ced6e133a018e9d4fc6d57ece42900393988f3a8a0dc6aa759cd6aadf85591ec8803981105a078699b125340d65ab29903bf130a209a43a9a4a359c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541c20df2d7bbba47894068db0cae02c3
SHA1f2dad9df7bb81b734926c98aafa2010bd7c5046a
SHA256e6ecaead10f4949e0fd2bd5dd07da3677ba3ded900ee6b909a851fbf9cb24d7d
SHA512362212a11be25c5dfde0204be044f06baa0719f9139c3b91c34e9fac48800c22155044680be78d749009fd3ca78038bfc733c729981a0e904dd8a29781a3d90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba174980ff4205141df9f7d4e4794d5f
SHA1ef301e8b49af2c5c7d168a3330cd765b3eccad92
SHA256c720bad1e928bf5cc8e5b69e54a58d655f14d429f833b900be7a16403be2d959
SHA51251c8a6b987b61ae140111bd86f57a11338fdf6e3c5b1af234e5663b934f45e75f46a9bf09fbaf5820c202767de8456f56d9781deaa8361b31648115dce6cae21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c237bab2af9ad2446c133ff395eb7c1a
SHA154b3112ab3b173191043868725b5834e32349889
SHA2562370191298bb9c01812011767b1e86d649a5c1c21f49332e3eb4e302d4353f2e
SHA512ff56bbe09c21fee99ac9655198853fd2d4255b50b92708f406e07fdf82fb29fe704aa8c7b8954beb585002c91bc0b53c6324a885374f7a002bd6bb0ca64eee61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3bf240a016c7427d06c9eb92a1a9144
SHA1fee28717d4576c48f6a4cf3ecd8456f19a61fa7b
SHA25685f575e02a5b48d479218f4eec12b7ce99394f82d7ccf05024863b5073061f78
SHA512e22d416c855b0e9d0667b8ee57e7dbfb415dcdec7f583cb6c2e0c9a10253fbb07787eefc2b83c892b0d9a560d867fd4e42389c31d6f9282e6e923dff9b25a4af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b4f006005f386a93bba06641096a5a9
SHA1134b69055112545fdb96cbb0d83c8f4bb40b0bb8
SHA25606c03781a8a7ddf36cd279404ce042d19217ed37604634a5fd8b446b9c0b400f
SHA512aaf27d8eaeb0194c79924271e4470bb901b15c226a646038335b94f1e5fc425d1486cb71178cb5398b137f726d42a4b2512cb54a6fc3471dd9ee177f50570351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584ad49b20061a737f325828ac3981ac3
SHA117f2a2ede8abde23fe8411cfdd9eff4148094ae0
SHA256aaffe8f189dfe5ef10be6b7318c704581d30f968d31a295553ffc0d7023b11aa
SHA512a3e29277f861978f9137cb859424722be0cd50090c837e4df5f98d7ad8f6be9eaa0174e4799eadf1f7960d8f947f12f993fc6cee563026d791aa76d009f56de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dc56d2bf43459c00694298a22c6af13
SHA1f750467f4b8205b0d99c2adf44e64fc2e88a8263
SHA2560852357f45c1b25896a177681899f3313a28a37989c852e57fd10e62aadcc7d0
SHA512513a0885e69fb6ad1323a845476eae14019860bf516038784f42a4c137a633286f1d63dda29b123e2d3c3414942c09d2d046a3bab31ebc2362108cd1b816c40a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568f9ad3677f44ed3b137981717a1ff7b
SHA1555b6cb0346eb281cace39dbc1450b509981d8d3
SHA256ece402b26dbb48e9ba40948fb70e1062afb6f138d6553e85bda261bbd59e0246
SHA512f5ae527aa071e57c3190fdaa621fbd7d8185491a65d1596c59398074994ba708f94a1fdb424dd357ea00c73ea154ddeaacb1ddaa1b13f2d40bb6ff40e845d51a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e8e024021d1036ab3b9b91332f187fc
SHA17e0168912d6e31a79cd25810de53aadee765fb10
SHA256371c5d9792e30ef79cf9bf625cf4d632ee17cf165840317f92145efe9dc0df14
SHA512e4bf8330caca8c4deef9e58a56d0554012891c0a070ff5338e3851fa0069f4921742c4d6111469b413fd23b62908fbda84885f2c773790a30dbae549105c725d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cde4d84356eda8efb7df6e0df063f27
SHA169d74853e76cdb36ddf3f46f39cb5de237087077
SHA256ce72f5e1add4169ba877646feb8f4681ed13f62c9b14f5d5c558015aaff5ffe0
SHA5120d940b90af4b373345bb04cb1c9a4b08d6f43c5829443eff933021f1b03768b896110d7077698faa686eeb6722babeaeedac74140799740f9732455f315a042b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c5398f44249c3dbe57942a335af8373
SHA1904c0b811b632a871a8fa62a8b05649a9c888efe
SHA256b943c85821e5ffb14b79ead584dbdc7be695cb2b2ac1f9a3c17455798577c553
SHA51223b02317dfac9ee48571316ad524a3ae669abcc4172356300f336ea8d4490750c2938bfbeb31f3cef77e4f9d27e45c08321bdd5c0a1a366b664263189e9877e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a95b8e198af9fdd074549363e3317320
SHA1c550c5f03b8ef6499d53c07119324420f4f99e3c
SHA25629ef505fd136f16a9b753140950de4ff855ae1310b0f8e6c313580f8f3d45ee9
SHA512546eb6fb92945919238a7a7c1e46ac8b216a94e2c54e9e1c57c16f5c2168c21acc5cd8674059d13634c5130981222478fda09f0e576fb8ab7d279ad4201399b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e09baef843b4c490769636fdd873f44
SHA1056588b3cb7e0263ed3b188ff52af791a0ab6bb2
SHA256b7333e8abed1263bf4b4e05ca8804ae062708af098fe49b16d5c553cb9b21db2
SHA5122da95ca93a733dfcbe1b9c2837bd196d0b0045d51d16030305dcd8413e16ca3d62e65a9f123fdc8d6ac8d6cf6a10b6988d284ceace194c62918e9134d9821738
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b