Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 00:40
Static task
static1
Behavioral task
behavioral1
Sample
0d2324c61f5e8dc3095ecd78465c613c_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d2324c61f5e8dc3095ecd78465c613c_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
0d2324c61f5e8dc3095ecd78465c613c_JaffaCakes118.html
-
Size
6KB
-
MD5
0d2324c61f5e8dc3095ecd78465c613c
-
SHA1
3e6541350c051a012ec4323a19a81ef12cdfda84
-
SHA256
6c826836b15d2ea9695328169d8d86f63e9468574b8177419a3678d89dec9b20
-
SHA512
04fb10ef2cd7e685680d39ddf65f55d89b44208025a4d8dc317a18c38f5aa2606d1315e9274ead2c311b1d8d3306ff47c6258168ba7491a2600e679db7a3b3c0
-
SSDEEP
96:uzVs+ux7+CLLY1k9o84d12ef7CSTUEEtyIBojcEZ7ru7f:csz7+CAYS/a0b76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26E14201-8120-11EF-9630-523A95B0E536} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000008d838a0f5220907b24ba6db602e6ec761ae59bdcddeb6617bb7ac92cdf0ed6b3000000000e80000000020000200000000d9ed7ea9c6f7e130d038b30111b7df777244315ca8f5d6015d28348e1af6f5d20000000e03945620d222ba17fa5905f32cdedeab4101a9657db57a7363a23c086841e524000000052a468af3dd23c0b3b26096aa38de1e8e2ad71ed181bc529b7030273ede5e36ec48446d5b9634f1d6be1b17d236a07b726f426d141739f2cc67f5ad154ef1c38 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000db98455aff266e0444483ab030f4a8fa080cedd48df70ac7e46915545afd2cdc000000000e8000000002000020000000f3ffa432dccd4baae590e7c751a3d9241feadf76854d23192dbaba5941f9e11f900000004e046e1d95406eef2b28bd0d42607e0e954970fe1785d5dcbb40fe3caefd36d06ffe894620dd156b45e396c953e28a78d7852f3cce8f954087e7a3cc4efe866e69ed4ff336c6621423ad7cf63f195d1907b1715b311eb095e0311a132bfdcadac25d34d51c2cf34b8782f99853bff2d069de68e6ded31131256724508fabccf57740700de5e965b4e589fac23100778540000000fc74b961e94f0b8e6eb7de2e7b41c729b32a75343b5cd2d283d4c3f7e205775db100e2e36eed83ce99d0071204a16017053be5e7f7d2bab3485a4b4a0b139f5c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cd10fe2c15db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434077923" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1792 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1792 iexplore.exe 1792 iexplore.exe 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1652 1792 iexplore.exe 30 PID 1792 wrote to memory of 1652 1792 iexplore.exe 30 PID 1792 wrote to memory of 1652 1792 iexplore.exe 30 PID 1792 wrote to memory of 1652 1792 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d2324c61f5e8dc3095ecd78465c613c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b96805111a3bb7e816ad5bd694109fb
SHA1bf6adcae91d6be0b3d30afe27d83b976dadaff9c
SHA256650fe0eb11dfb98ac5fc23564a2ff15e6ff1cd8ca987efb926ecb56c5af2c0ef
SHA512d241e88e5b6a50963957b515de2a78dcef4683baf595770cd97c4169443fc1f22eae971ccb2c90a960a1f937780c6680d9a6646c17d4dcd8b6d5c0c8eb4dc8ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512aa593dae55ffcaa19da97557fa7afa
SHA1208c9e414239d9c58ad50697033e66a810c0ed72
SHA2562e67cbece54192f8b23539d605399fceeeeff6e2e93cd85db42400e379f03037
SHA5122ea8071e8ffac3cd32f27a33e7241a57ed68aca15e31ad46353e36ced2432de2353f0a02d0e9868dc364cf02f0f1f968b69bfb5423955de57a543a889b044082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cac1f0ccb22ca0be37d1d4cd71169b8
SHA1fdda4c6a276dc67bd952115da128a5f9c46b09e6
SHA25623d069f47036d6a75a6042a2db56191e5c13dfdb6b7b1d68c4c53ff6a2ba3663
SHA5127e85701e16077c11fec9fee431f95253464181f4abf73e3629e14b55ac2eaedc2bae647c2abcdf390fa5c7089259cbfd4e385225b6bbc586adae4b2dbdced27e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525b04da716042f0211b6a00a8e58c0c0
SHA1c267408f3ccb2cb7c7cb8e360c9709ca8b009625
SHA256266a5e3464669882a1194f24b185c1650b45efc4edf75ff9b7968290d17185b4
SHA5126252b6828db6c9128c5cc0e2401eb40ade07cb7e7f7dc6634ac1dc06b4b89b2676cffdd92d719429d93d3a6ae5bf007a52d80aa95c1b4192c86ae8bb22d40f92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccba87e3c8a72ef7e0d58dfd91dbc4dd
SHA153e33550ce06b434201a5f7e387134878fb8ba1f
SHA256fa11f9c2e7dcc801df751ed683df7ed4c09e6f5840f42c7acdd218e940888235
SHA5128d8508c159bd46f541748cc0aa37fc94a91a4161b9f54f9bac6a8d81d82506ca28a264b7eb5e3e2f69568d006df1f3cc27dde10e3e287b097706f30fc99e69e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6b444a447b10b30d53bdfa850b8bbcd
SHA1b8c1f54a97ec7788eabb4974717207736d12622d
SHA25661ef3cd206194988f3b9073a2e2aebd095c89a29a622ce7f4bbe8ded14320284
SHA512b4361cb6ae087eb660c1fd612cdf19b53bfc8ab88379e86a5e716340226473806b0294fb655fd2812cd77e18b6631e005e63afbc7b1b3a1b37b01956eb0669e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3422c2a24874f6c1f83d378a5537e3a
SHA1edb9148e5e24dc32a827c542def72dee4dc25f1d
SHA25657e6f1b9e284afa887bf5b1dca00b565471e5c9c585035e6f0b37977439e4636
SHA51285e2827ab0efbbecd904430f5587d50ddfdae4941937421aebf7c3b2ae63a54b87dbbdb2922d3ef189f56a7050c596dfa090e0d844b82afb65f3b6dca73a74be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ed5e1da496ac5059503db0790f36b6e
SHA13e57e424032e3c256140826dd47cb3a1f2e8ecb6
SHA25656b780f590f2f87ad67d524dd640b305938ee90ff99c57f3772e1b63467baa0c
SHA512f61ea64a886e9d93e06f4549af0a80c1f26ca15cb2be8ea8ca3d3886f261e0cafd69697ca97b0b84c2934c73f3a07c0c043def21d41a60515c7a7c4022ee01e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ab7bbaac21a97bb7c7d143c1eced97f
SHA1386b06c6ebd49c55eaa867963c0b883e18282a09
SHA256dc76a8856021aa1bdc9eb484ea4fb842ab5fea7c7f48b206f448cd90e5d72195
SHA512b4b4dfe59be450c5d7db8a16f96ad844e723d0c337684a5e18c55669e1c8ad05da80afc44cf779fb703f758bbe899401c83fc4bbbc364f6a1832ecc37ba43798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5202a0354bae31ef9696dca00b06dcdc2
SHA19504197de6cc75ff0e0cdff5756c1c404619ea23
SHA25633ace73b1cb2185feaca14b34b05b5551ee79594b35b5d1c7299a937b3c5e92c
SHA5129b6dc6353ef65357ae8ee1faf816bd61d976f24c9289379e6450cbd1db2c669bdefb119ee972ebf47b46c7c842d6662293ed315ed634e924f2702b54953d0364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5012dbf328f32c40491caf5d6643a9032
SHA152346f66512c3df24cb06b42f9026dc682910554
SHA2563bed64294e58e910d6c0e93113d2d3cae384c954cef1e2d1cd7aa34fd5881914
SHA512f07f6a4b46fc0cc25f24f33f76e80a9305752606be246b7b4271838564871c3c84d0e87136c357ce395c1a1203398fffd353e0afb97137a10eecec584db3e7bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e7069e3d97c99eed57d796a18427456
SHA19759951cf91311d3e1ad2c11dcfebea93cd2234d
SHA256ddb918919a9dc834959334fb93e69f498d59c8738585fbf5ccdfd56d484efcdf
SHA5121183603acb5218f2c360e6e1cd83794b1af441769ce107dad23653dce2df80985ad2b44e6f3eebaec31682abffd66783243e09cbe82fdc3db6339d58dd872d55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561a1cb7a39214ad87ff5883350a784e5
SHA15dcf08c89517b1a10507572e66ea3bfaf1190f79
SHA256b24917e36876109e097e9971b29ca8b80e5498761c32613cbbfd4e23866e9783
SHA512a5ad47b399450cc4c23a79f33518f51c6f04cb12dbbcc92ddee2014ce27cbc5dbaf4cc0283e7e5a1c73ae3dcc663f6cfb16ab87172dce8cee002c0e19e979462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e10b6d9491a957724ac9bcc2215deb5
SHA1b7a5ca32f229c943e5fe8643b85898335b2dbaed
SHA256ed77666e677015da790bb936b97be9de2681e3e05781e5e657cf2155a9b32da7
SHA51258c38adc80604922749728df47fd085fa8980b2c1c5e61c50c3ab4bbac77d087300fb8795801dcaa1bab0c15df9b8daf0fb8f268f42101c48ea1886db98cc3ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f50f84c00229f4a7d0db555b79b1e8f
SHA178b622c8aac34a4c62026a52b4b7a12ced83730a
SHA256c953d832d65fc794d46b517ef0a2324d258ca897f96f648864f2478495dc64bb
SHA51291ac19c5081f6cad09f361b4bd3f689bc05cbad2cf67f2ee823d86bc43f679937fa00bd17bb0b5fc2c723d5196a62317a448a9069c1b6f904b8f31fcbefc1b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501408acda32b1a97284fa0e19bce31ff
SHA11498054388d16524eb2d8702307a0221c0a3aea9
SHA2561402c581265db0cc121f4441431d20fe21ab570de6a460b24f206b3a7700acd9
SHA512db72feb7fc1647b2d1be6ece5a32ffc21c19ef64eef9a95c9618da438d886fb5b5d0174106dd63c64de94aef806164c928423185b29f7cfd067c4d05a06e87bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a27dd49b2a71ac09fadbd57441a606f0
SHA19e3b3b3e65b2222785db3c9dfaf1d338eaba0b86
SHA256ffeb9742fb440f3187d830945816025f61af74f680ffb94a3b46b6f3c6baf200
SHA512ee8ae56f543607fa8cbfc2685b6eecccbec158ac774c47f83b6049f59e68f157e392bb386661898c0325f2e9f7d8f2cba6ccd2d4fd8dfb972aa0c013379ec509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a2e9b08257a47b282e4e4c00f9e85d9
SHA185c78593fb5fc757eba5f462fdc15c6dff5c138f
SHA25683e11cfed4d375193411e184ff47de79145dd3e95298a786a367f0ef52af3fc4
SHA5127230bd27a908fa27b28e3e6b9b8c8570d82bfb6812d1845fbc2a76f499dc76538e0fe6aa82d78ff36021081e6758cdcbf852aee621d2d0f3194377c998ec4e94
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b