Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 15:34
Static task
static1
Behavioral task
behavioral1
Sample
0b6060ad12eedf4430bdf0da36e7f5b7_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b6060ad12eedf4430bdf0da36e7f5b7_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
0b6060ad12eedf4430bdf0da36e7f5b7_JaffaCakes118.html
-
Size
1KB
-
MD5
0b6060ad12eedf4430bdf0da36e7f5b7
-
SHA1
3974e34df3331a6340d76b34830e6e1075a6ed07
-
SHA256
b6ce3a17200c84d6b09aa6dc33145916cb9c5059dc35db916c57b42d8038fbd0
-
SHA512
b5353fac70033fa1da9200428a042de9363111b51702082bd2c0ce79215beed8492db97e23c09ebba09194b87ff46316663720d3f8d0f4d736c2978e9155456d
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7729441-80D3-11EF-89F5-527E38F5B48B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434045149" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ccdbabe014db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000001c7995f963cb8cac6f4e471d0535cfc37d5f3a078165e18e9ef4d50beb02b590000000000e800000000200002000000016640499bae01a5b01dc0094311fda4158b93552bd2e241ad2ef13ed97dcc4a8200000008e145e6d7dbef04d10fdd7ca7f30aae394b028ed29cacf222d753f4e037038fa40000000ca51954ca7c3df2654105e11a92808a0e173303b1475fec6d86f707816f35ef3963b044fad52d749ff06f1747fa9591eb9a8966635159ad969eca507164e7b37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000a030354659dadb029104f6d631927c9384df39c46f0f06658ba38f6e9ad72863000000000e80000000020000200000001902ef9bebba30f7fda9c4df3ffe667cba9bc96df63be5b38cba17a99f68e2b69000000094d3d424928d120618b1ed4f2bbedbded48eb29f0f20610398f7ad38ef0b44e9cf1deddea0de475f5f37167899ae173a351c281fe19ecaaca8aa2ba70eabdff06fc1909ed54b316ceee83d8b441b50abe936aba38bfdbabd2d9ba7336855a6b98e8fda98c5c5485eb13235b7f4c428c02d24acc2f3fa928772c7edd4cc5e55e0e604962d3e99ae1604a4877168e28730400000004cc9776f089e3bbb744c0d3e2651d8a8ae0df58e0945480e5f75a866bfdb1b5882c848924f8f8e52cdd0d9015cc2880acf8f37f3e30b21550a924e339d7dd953 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2984 2100 iexplore.exe 30 PID 2100 wrote to memory of 2984 2100 iexplore.exe 30 PID 2100 wrote to memory of 2984 2100 iexplore.exe 30 PID 2100 wrote to memory of 2984 2100 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b6060ad12eedf4430bdf0da36e7f5b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ab1d39250965262c6485e53c0f1be0e
SHA1753239af0042d914ae3c15e80cf5c95da72f7e13
SHA256c308060acf686fe7757097d0b5598a56553328b349ebb84b89f7a902bc5366d4
SHA5126d1a131806e1de3caaac3def53be2df6cefcf270115df24903755d56bcb2252eb0d87b3bb94f7bc56d4bb8aac95e8aaf9cf8d96f7b8b679ee6d77397f79b90d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554218ca38a448713452ae60e74a29052
SHA16881a53edd592569e18bce597bae5ad3eeeaf4fd
SHA2562f0891f013b070a94072aab9dbb732b6e435ed22c5885c49e32d2e6ad6ce09b1
SHA5129e4bf980ce8f930d2b7de079d7ac3cd80a66ba9c66279d6256a3b0e18a6043b1eeb211df5ec8896db4d97cccd130c4df7c483122b70c32de6bfcb9eb4e1bcf29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5500ca788b322b00c7d982fefeff3d22e
SHA128742b0ed4aff042c4ce366ae34f7ab1bae17a18
SHA2560e9ce52f047e7bcf52a273acb4ba038856552e7848dfd8bf2720d73e22bb5831
SHA5124f874531a0e6facb7cb2ac9aa40821a2b37cfc8c050a4f955cd964178c1cc165242b4496e6238593b07580fc0842fa3394eb0ebd3f7475718528d01c123ab0af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a0f8815d19ad11a15674f4551e25691
SHA15d573f2f114cb2e5b064d5428782b41ddfff612c
SHA256060225c20570903c4ac2657da09ed5d7333cef01bc172a257757e08aeae7fa12
SHA5125d361c869bbcd34b9e4f8b1c1a67c96d0f0d5c13b72150a7be2a6f256be8438f55e7d711bfb67afcbc588f545d725f0fbc95fcec8c3ee4395224eadfebf799ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5579f79a51f6aa713d8934cfe20bcb10b
SHA13bc15494854ab20eed37fb4f2141e05671911fb7
SHA2560d87a8a59252da731ad667657fb46e195e7fdc0068bd4692b94a1ae8d5098bed
SHA51244a2e0302cd966bbf840e1ca3e51afc9c6b34b99e8c74434c9607e1f36bddf2e9fb45a483922039c224d9ac02cfec772f09fb6226a77cc1dce7880c0cc8a9e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffe59a861a3cd6acb76f87ca16de7097
SHA170ca778da25c915b6e46d0f36d9badf24203bb7d
SHA2561108a4ee9a93d953adf18dc42eb59933ed9ecf4b322309baa6586b0e30588f44
SHA512fe9235bea2cf0ebae979a4652317dee9e20cf7d930aa36073f67834123e30da04584e8d5db6705d7a0487af8c23eece6e7321e5c5ae9e246e78239414fd9e344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551cb8c801fcb03ddb594e10a6826f1b8
SHA131d46f390c361310e7d84ed7bded98a8912736ae
SHA2560c95fe9a139d8453c0b94d3c02b9a90322c23797a75828929e8f40c658e22a0a
SHA51297c3306a546429e4728ef455d9bec6d2978a2313ea0e13714e2b3780fa2d67e5e6bd7e2f847c606b155db4c48610afb7e9008000c64e74cffa4d0a27663049c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56656c49a36939ce6d21de39b8dfca84c
SHA1574e3120165879bc35f672f11e3d6d3683f5d871
SHA256f6b1b08e46c18753cce9bb20b19b1cf709bd881dec0a39c34998352892201ecd
SHA5125605549f21646fdf71c0f316cf44742daf7b03ac58f9dae0d13386122720f7207dea50300fb55a73221f49fbcf9d43407be24bcb70c87137a0b4863a7adca029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538acfc9549eddec9f38a1a6e830c65e5
SHA162cfc457bd15bb0927b62a2eac5eb2c2bb891a0b
SHA256e0763ccc370740c38d2c0bdd2fd206e7c60fe265cd8a311f2dc77d0b40042aeb
SHA5128c5a5ada84a8690995a8bc3c42a1888bff9c3b55efb67e6eae4a97bd2f594040021da1e44566b1187c857175be4b594a8ddc02b4b698c7c0de88e2e2fb44fbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e51624871cf1316b5c510d14af19cba4
SHA152a3e7cf0b30fd5daf1c97342ba4322fdefd8ce4
SHA25682b2915872fa23be40beaf5efb66ee3da1977b30cd38b5aa10908ae9319f5ba1
SHA5126d9873e63af3a7603baac7177ca04c066ce8591ac0db3c6add7fd6d759bbe7d9682cfc6b999d58f992d130a78e4b646f6860dba7f0747977be1922b2a4097ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a72bf003187fe12d5ded51d5cbb61bf
SHA1f639f9553b2e8742f767e1892539547f610f73df
SHA256611252b8f06d8190cb76023e73e37925a4d7db9205b10711488b59856f5542d9
SHA51234f4860068734e5fa16883d312fbdf164532823f791bf02317af7e0c4320c20d7793bebb8f8c4b1b1eb123cdc92c3c06049767415a3ae3f1176edc2d3e9ff99b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51295dab6168c898c5180aa9a350b9cfe
SHA10532d525f9a492c05c2a753252ecbfa2594872d0
SHA25683395005f1d42a4683b30b6eacfa32bff3d1641a8492b4906eec1c68c0b32088
SHA51203ab7b0736c18988979f1ee35773498fe5ef1b73aa467dee60f85c5875a62e5d61e689bd799c072d2b8a7b1a0333b7b48f1b17165097bf6781abec17d60d479c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cab236c412e561c17df228bef7650e06
SHA14b15394a1f5cfbd7f57ee57403b31520f8192a60
SHA2563cc6b583be63e44a068a73c1d48100dd97411da2f33f6adffe103562bf3938cf
SHA51294bc3552708f350433496e42e0676bc7d72117cf0ddc9a0541da7046384b6ff8d81d595290038200ad97216bfbc19e6c9a72d399178b59ec7fa8f21893adfd44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b268ca69805dc7745eabdf61bae72fcf
SHA1995d05c30e08746ed54930b1ef1a27328aa7eadc
SHA256ec9b027b4e97567e4b039940e2a6e56732b9f8eac4775c150c9d9fb7df9dcb6f
SHA5128b54f0cc90ce2ca7f208c4c24e0a6d73f926cfa7925bc3ddb53dfa5382f65f173b53bb1b6f2da097ddc58596b2df3e7ea590993e933d477f3fc31efafe82a3ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b784d4b24d021be5354ed2fcf1328fc6
SHA141b8c76dfb4041850af258b75f8512841d441ba3
SHA256f422c4f1bf8d68cc8ff98a847308ff88a85a071d2d50a629afa127b255ccc147
SHA512b550093e3d73092b01ccaa86932e25328c9c3973589976f031b1d8ab70abb54511fb84f24ad1e44b35ef90e135e17a9d74aac282cc42f4a63843e47ddbe6ea4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536b376c379550363dc7f3714f1497b60
SHA10a0b45b9e945e3939ef3ce00022a9c6a9a07a9fe
SHA256f44025e67da0390ed7f73f492bc1245146ffff53fce275998c0d4a8ce1f8d84a
SHA5124a06baa42c7bdac31c05815b5c650893ab7a817fd6dedff83cb8c8dc512432dc2ad011860a22aa7de2370a0413e7c95c4e7dac3517fe702f136d893b34315d11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f9b0949ec973a4062403154992df285
SHA19c2551fbf85b51b3f40607010fc2a1337efe5187
SHA256c6378d89fb3dff2ad0496cc1827cbdecdf7d87ed36a6c67b5d5c02b837cede35
SHA512901638535ac00491e5d80bffdea04a99b4dea190ce59d5d852a6135a21f3ae7b8ce41d3b44c33e2b0a7f0a11fe68709a0cf2eee20c5b3d8eb117dfd5695301ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b7788e4b712547635394f75d528093a
SHA10aad295341173bcde05393b3184a2d80c2a6e269
SHA2563167b7a9cf5a6aa5a9eaf710a1043ad6731ed4319c52efd13d2ad2d52c31a1c5
SHA51297862fcd843ef03ce54fd8eec27bb7a6a91fbabf298985cec3b7fa079312315cc732e6b126e7634b05e0a15b0f93e402f41fd370d63b475dc59dfb2016b45d4f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b