Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
0841eaa6a3927877173c4ea2443d5e22_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0841eaa6a3927877173c4ea2443d5e22_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0841eaa6a3927877173c4ea2443d5e22_JaffaCakes118.html
-
Size
14KB
-
MD5
0841eaa6a3927877173c4ea2443d5e22
-
SHA1
5a64c5959f5fc8196540fe2ef2e53d340b63fbfd
-
SHA256
d9270cae1450cb7e789d10244e2a1b654bab10f11fef41f611b12d62b60a4128
-
SHA512
31ab871e04dd9bbc4f7c5b2d801192d5ecb34fed652fb17b7f9bec9b0a82fbe42350e3f47a994bdbd7aef341417e093426f1b1649f1c17a3f27f45bcbdc4e4f4
-
SSDEEP
384:TvOc8qCYfX1SuScS6pEZBHJL7irgoRY9m2:yc801JS5/BHJL7irgv
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA2726A1-805D-11EF-B0EB-7699BFC84B14} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409d0fa36a14db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ccfa87e4e683c147e333ce9fad2601865e10c80df4d5adf27470f39c76c2d2ca000000000e80000000020000200000006d45ab727c411dbf9476ff722629a67de23aaf48055dbf8c9fa934733f9b32be200000001c14e18ad88dba72d6266ca276475b4ffbc97515d7d37b17f704a0b8d83170bd40000000543620d04a0480b1ca7f0e16f0db04867d6bfeeb59176e1b9c0f5818fa33d661e76f0cd40d58bf2e5aa50d388628d790bad7b17dbfa278f5c0c75010bbee84a4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000fb7e5365684dadfb92aadb30610d8afc8c585c28c15dced4dddaa8de57945b55000000000e80000000020000200000005474b7ccfa00794e5e380f6bc24310f33e819a6ebe19b047452d329e84834ab090000000e1f25c0fd9fd8d1d383f2309a3e5871af87c2e1dcdab00e3d746ce0d1520d82ec510ed4a8e764c88ca7ef043ad4dde8e134e261240895672be9979c089da294b15045d97c5862881bc6b86f16cbae357eac98c8ed7f61cbc0fde8ccaec206911f9e29f505d03039aa3bbd8253854c115d7e3d51107fc6cd558ec75f48cab422bf5594badbd63051fefac4b15039e305740000000cb1eedf09b459762fa585c5f008a9213eb8ad3b5133a1db1689caf9a6ea8d7cf4b0ce05d7db778e9b6fe335e5078bc4746da990f4b6bd84317491feff02a7f88 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433994450" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1580 2248 iexplore.exe 28 PID 2248 wrote to memory of 1580 2248 iexplore.exe 28 PID 2248 wrote to memory of 1580 2248 iexplore.exe 28 PID 2248 wrote to memory of 1580 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0841eaa6a3927877173c4ea2443d5e22_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d232b0db264654ca5432f1a3b40b3e7
SHA148643b190445338eb38d4edd43a29b43a161bf34
SHA256db365b39cb4f940d1f973bd023d930ce962c8e8fc7175d6a921a4340e14d667b
SHA512abcf53749999a87064e78233992b25d94b7a02228f17007c7e4ece029df406e9042ec10487386dcfd12aa8abdee2d1bcab547c0f5605ae2185b16e48a367ce5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d07160bdfb209a81486042c0aea39a4f
SHA19ec020a24f5161782147ddf535b35b3b1261a09c
SHA256a0c7efa9c0618f4768a3713068f70d12d6d1d42f8566ededb041b6bd1a46c17d
SHA512c98ff4c64ae8d4ee72d57632b14eb79829f3a3f608fb52ad66e8524d92557132110f78be9a9f0e4f0184f84bdca700a5a454b54e370ae597372fbef59226610d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543c8e2c9abc0d6bba7399505c3e2611a
SHA19b5adda6cc15e216ab4b25fd217d470fe499cdd3
SHA256f25a190ed0186c5752a5ddc08cd31c76246be1398cc3abe324d9946f75a9234a
SHA51291b60af1c0cf6deab465878f4d7c2cf0522f8b9d023274b5f3f6ef44276363d7907023d5b0b2a02207a3e3d47b42a2cd313302f1a3bcfed7ac0e41ba75a85b9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5d2b6caa5621577b5e9794cc198bf2f
SHA1837dd79196f359271e3bc85476205f7d7ffa5c62
SHA2568ee24e3a276f9482a6970ac79213ee13e6dd8df1ea16723ac9d0d46c53db9ee1
SHA5129236bce3226e23de67c117e40723ee0610bba0b8a5e09852f7dd2cba1140c1fb93747020cffde23980c8bf4adedf1008ec278ea6e5dcb2782945f9e4d89b52ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5200ee1b4fee182e7817eca668a10e297
SHA132de77b8cfde147cb40a5d29b9466d245572dfd0
SHA256dbd9757e94ae2262f621b8b4b4067c6a51618961c4e35236ea04d8a7cca6250c
SHA512772c0e7f46da99df12e6776b4b5d1fadbb92389a21bd0e027767fc4ca37c0e1928dd585316657402e3eb4f22143dda23fd34fb36c0db7a4ab3eb54f0f4fcfad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fcbccb174e40c3df340c6b6c4490488
SHA1e57edad3173b241f16ebb4ed311bb4a3a8e69cde
SHA25640e35e51be5166d6cb52d0c7834bb28b7ed3610e7ce931bed003a7089e919829
SHA512f07161ccc63dbb26a430dfef1f9017a5b108569def2edeeacaf779ad5c98fffe84dd37633fea1c1ea83c19641eaf35ec1a35e98976fabc6165353892c883f327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a9f5cd883839a8b08d2ab6988b0d8c2
SHA1d6c93f7bc90fb530955fa3bf749599dce829a5fb
SHA256695fb2c3a4db50e0e7ca875c7aaf641d6ac3ceb7456d928649bd8171c119bfde
SHA512ae5eb4ac1e86b1f756cf8463600c08b4a93f3c27270a0198a192ce1277acb9addc53d94b9859d23a8ad02f7256b33e956ea176721b225cff9f7a51b03e274d34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee0a7cceda61913b2a76f8e948abf516
SHA16ac2f8a9d3d8cd7b482180389ec6b20bff1a6ab6
SHA2562bd99c6213f88cbffcf3e378fcb36664e7babd720b441900ee85576630140be0
SHA51235c35454dfd4ccdf0d721debcf39ad3c59076f1943da3dc10b7418abc4f36d09b44380fe8d09430a4824989e05cdf61c2c5709a95c2f1f219df8e773d38e7be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5434b3956b32eebe2cdcc34c092cef146
SHA1c1aa8f0cd942510fc0489431e64ccdb0da87d782
SHA256043c07ee66ac421827de3de3d4e110a09213944d6c00fcf7ae56f20d94e9ef64
SHA5125c53a85bd96f12530df6c3b694e6b4967b071d4ce2b1c2f070a2b231eeaa3028cbe76e5a2acf964658b611e7dc64f9c54f5eca2031bb0924d4a227e3c74da8ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a65fbc722d975cd75364237a55235d1
SHA134ba1732ba8b0bf718fd2a12bdabb833635e406b
SHA2561553caa894ba2bbf80a0e872d4184cd5e4895841a952721fc677b3ca934c2836
SHA51233e655358eb279b5bc436eb7210f734a7ad8dad58ac57d0caa31dd3f93cf4f3cfd2f7dc70e7a830316c160f577cf0d20a2439c75668d8f6b4b439326c83f6f07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bfe4fd2dfafcea757b1ba31affd3211
SHA1596dd8ffe2819ea3559861fc6dd813a373941942
SHA256a2d495163ffa8947f312b1d0a554e3cd064905e1ed709ea71ed7b773d0736e4a
SHA512d705d7a2ac1f8937522c32ff53c9eec0a65fea0928214f5effa09e4605beea99ab9826998cb71809c27ae829a3131fcfea642dde54df2ce761ccf08a8c6717ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc35144834524b218c1d63cf71d49ec9
SHA170a8dd2c13db77ba8bdb7b8a34ba94ef6593a6b6
SHA25601056c944f13fd1e4bd8cf48279695061fd1a044f68d333417f4e92ff319d021
SHA5124be23ae9f951cf359f05c7c814b488678723453587ece48d1abe7af50e215b0788beb2c42fc21c341558bbe88659809ad5bc8d17a350dabd7cd953d6d66176fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9f065dd06078424757c6fa50df671b6
SHA1b736215cf2ea3fcf39bc9dd01cba283dc520612c
SHA256add586263c8d8584527f16b05701975d3687ea3dcad6fb8399032cb032b6952f
SHA5128e97a247cadd3ae6847a776911dcb777482df2ba89ca53eebab972848433b6c1e4cf1f3db6938bb7d190bfec67af2e7bc79246959ab9395cce3bbd95e26b2611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df2b301a05c5c253fb014abf3175aee9
SHA1b641b07f07e9c77a54c7db4adf2da2e719c9ef39
SHA256be78683c07c335e61ddaaa04f9c614d5a87d13cf6e783b3b39e34af50c5b054e
SHA5120bd4d3a69f75f9f79c1bdbfd8abc366a51ad75364d0c2f7735e64d4f1722aff7c8a13c235fad3230190263df584dda905353c93b44865269198fa479cadb8322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e6b36cd06f74539a6650ae4136db069
SHA145e803b186cde7e98d4440936c8c0f151ecfd198
SHA2563f11e901b9441048294d3a3b0fada9177efe1ef5cc64059a2d20b0fe96dd7b27
SHA512d2d3e8363130b772c5a197d2ebb2fe7b38653430d56ecbbe38ecd696cec5d9d8a8f17403638b2e8ac72bdd3ae936a58827f1cfa2ed72327d6510d4d2a47a75df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3cceb04a56de81706323ee2cfe22650
SHA1bfa2e1b9b56677168630b7faf21dbbdb01631fa4
SHA25666d6e447372b4e3a0576b7fb433572b06c89f8c9e2a434c1dee6df455e3773dc
SHA512bf3a5a658b1384b7a60b7687d36c456d3ab7e587fd59b9670066d7ba30a6ee03e9e0dd39e028a4d2e14e6f91980d434319503d7296d5c81a621e39733f403302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf3662232bc34821ca61e20956d8769d
SHA1788af5ddeb31141bf223fb63f92d4ec6e3d9f466
SHA256da47922e2493c0aca6e18bb9cd4bc2e78acd489a1fa161e12cf3329ba0cb8864
SHA512b0ca3751cea6e14ea120092ebfd778e4cd34a4b89fdf272a44a5c96946696ace20046ac0116a24ecd9c50febca5ede9b0dbe0357804ed4e22022c82f04cce436
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b