Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
085e94791ce0337ef1577d408ee99b67_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
085e94791ce0337ef1577d408ee99b67_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
085e94791ce0337ef1577d408ee99b67_JaffaCakes118.html
-
Size
15KB
-
MD5
085e94791ce0337ef1577d408ee99b67
-
SHA1
8af343b963f839fd97978ab9713abd8af87ff175
-
SHA256
633c7c78c46e46afe32c11215776d6e8d3f885bbca151817a62aa406d4dbc433
-
SHA512
91acdf077a0c36f1bc81ced809fb2368fd1b5247b3dae852cb9c672e94b05d402b7c773a80a3dfaedf7c031dc799475d0349aabf75b5f7dfeea055ebfd27eeeb
-
SSDEEP
384:fHEuEDmJmEulhwmvK+RYPmp0EH8yXOSvMzNcer/h:fEuEDmJmESh7vK+RYPmp0EH8Eu/r/h
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7400621-8062-11EF-854E-7ED3796B1EC0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433996535" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1668 iexplore.exe 1668 iexplore.exe 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2356 1668 iexplore.exe 31 PID 1668 wrote to memory of 2356 1668 iexplore.exe 31 PID 1668 wrote to memory of 2356 1668 iexplore.exe 31 PID 1668 wrote to memory of 2356 1668 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\085e94791ce0337ef1577d408ee99b67_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50863bac976c223aa4f1199df0618e442
SHA139f87f6837088930ac9327a12c186eaaf53df84a
SHA256beeeff49f96677f59e69fa2fa8b56d45c4423a6ce9dfda5f6cbee725ecc287a9
SHA5121b376ba6be9fef3d0b1c8ad751574d86354e621a59fd62b620ce35799e0d45cf2ff1c803bc37b0f20b83e1f45da4d96efbae795162ae89045b81a8b1cd2a1329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fd1f688cbc24e7b102db772ac341837
SHA1a5dbbc3740f91c3c5fd9a903dff468301f527a18
SHA256dd70f84a63adc642caced9d739ef314ed20e4dad8416aaba7fbe7f66f67d4049
SHA5126de397cc5fe4864d7113d4ac29b7477cba1ccc54d658059dd531451bf5ee08377eb2b746e8cd4a91f5a89b4e87a541d27bb2918c5d489d04a1fb9282ee41cbdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b14fbdebd1075f35542ac916de3c0320
SHA1b04588b13d4d96395fda530167e2024d583502f2
SHA256c39e4fe409b6823c39626a9b96be09d8de678acd61f3fec9f4d1c6d8f124495a
SHA512949023a575f13ada0137278051956181f00c386fc7796e746ff8bf3539364aa8ac1a75596a8254af4ce2af17df62450fb1cb1c074866d7d5c1f2a29c1275ea85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7d533860c030bd8da1fa846c0b3afff
SHA15544efe962a4bc623313cf49e89218ac13a29774
SHA256442fc1bbca827f12f87516f54d1605a45b4c68a9220ea6d3ba51e0d97f8225ac
SHA512a3bec98c270f3479f30dd2824b9a87db83ec6ca47505550e104e6132e80b26521fc91935b07ab7b4191527b14d47685f8b09850ecedc55a845fd4bc4acd9f983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549e9ec5bc5a4d29cf4d9dec0a13202c2
SHA14a475779be9f12da1f2ff37d60f9270330bfc8f4
SHA25608d1bffd40881a88ab27bdb3c88477a786e61df24502426ebb7f642fbe7a3392
SHA5123dbcdcddf03487df6349c2a2783e409f26844f8e51a6e2a324880daea707b789501275aa6727ef3ffc6997303f21f4a60b7dcb23183d89c5a865d6bc3fdea197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f96031c8920f85b4d6419fb8f23ce0e
SHA157f1d4b9ae830bc49ea7ef3f7a10be69fe8db822
SHA2566b2f39af86742f80338a7d77b57f685fbac042b4c96fc4323f8d0b231ebf10a3
SHA512f9e6f17d76e24b4a170283edb23c92aecbb65c9ada0a635ff03fca482e3a32c28f0373a8e5d073fc2e3c58da4db0c8491e39c1110ff2d7a8e4a568e00708fda9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4a66af123f9b0908b5eac3e40a31949
SHA15d1789d63350101c49036613cac477d4e78ea14d
SHA25614159f066c3f37910ed0094fce914aeb4b2e668766527d43d30eda3cd2fc2769
SHA512a4d1007d8720dbd70c1881d7b9890cad9e3003b0b4ca3c47d150564cc0abcc209ee5128b51caac286b94e99cdb5fa4833c75cf69db15a70e36a78d2725057882
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f542b9ebf6e83684e7ed81dab9a32388
SHA1bfca055f05bea7c139afe0f4c8d0e32ebb8912cd
SHA2560f099bc98170fc184a556ff033ffd418a13f5db8b61a0b8f2ccb80f48b0083d4
SHA512cd0602cb8a2b87ea048db8cb82352e5bee4828a7585a0c3d2dad467f90f9b4d435dad4e1d5f064c6c746771b621e7dc61e5b5a4dd07a4a38bddd97bb4d976d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f907068f7addb761e69f23fc93739dd
SHA1736bd605d70d1652d0410d35afd477d00af63d24
SHA256c2ac6d916068f637ce7776421e391b6bf4a59144e8a09d0b7b09eda955f939fc
SHA512f6c0fa507b65a60c87300d5958f643efa8c97465cf3b7f69843a8cbbdb68335d326d94211996b8d416c8a84b5d4a52d636901909d022789fe7ff8e1ebd0fa65d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59303ab0d6e3e4e0268c0dc6333558538
SHA174f83c6cb6634edf871c854d0c41fd5f2470a02b
SHA256c862eb7b8b3b1b57518e41e3134b8ae7c8af32e11e274db013873d9c4bc8f070
SHA512934aff46198beb8634c915fd192d674b5c7bde1535f31a0f7a16b7c88805a9745c776a5bec079f3671ed6184faf732094f534ca0a018246afa30bf0d139db046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9ac6fabe5cf555061c702f62400e726
SHA1471b5ff1f27634c1ad48fb6d04015a2cfc36eb75
SHA25674de46abc4181fdbdadbd45b34345e328ebc7532204cb1ca6c0bcf194ada841b
SHA5124191647f143518e97022f71412d2013cef3e7b0f985feb47d4e8d63e284d4fa46b5d9b5ec36d7d7bbd958e97749bf587e4ea90632240e648a320c636ae6d37a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD53d8a992a446f4d8779da51db6925a1ce
SHA1954673d1605ea07e490423c4903fa13dfbdf77f3
SHA256d4cb9bf4870b281f83044284d10f8ed4df1497ed2023fa60c50bd40cc649bc62
SHA51230cf35d8018d92aa17d101f231c068977a4f9250d88f857352c42e67d45598943d4d992f7ea60b65770b647a1841897d952ab890a24eb8e92252af4d86c224be
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\cb=gapi[1].js
Filesize66KB
MD5aa012028297a26c039c37ab25a4bd17a
SHA125f23d01b5f580c00778e1c010225e5b8c73b66c
SHA25655cd2316edf7159b623e4ec2c9e3a334027c01e2d1cc386f833ebcd35ed87b38
SHA512d346eb082674fc26d562da9a12f36ad2cc7db1f1b35c891a8734284cf1bd052a967137c1281982070688b2bb2e06c7f4967d1c9397311a31a11a8560b9c45fd5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b