Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 21:02
Static task
static1
Behavioral task
behavioral1
Sample
107ec3b49cea812a4a7a52fa52288aaf_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
107ec3b49cea812a4a7a52fa52288aaf_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
107ec3b49cea812a4a7a52fa52288aaf_JaffaCakes118.html
-
Size
74KB
-
MD5
107ec3b49cea812a4a7a52fa52288aaf
-
SHA1
07c4c8bb21d681c17b545504494d23473579e4bf
-
SHA256
a0dd341d03d20ef790267818c1f16ab0b5f073ab0b77773a81fe572eaeb62d69
-
SHA512
0b4a7f9321da723d038f32b20d2f92e461a818839b8773dfdd2d73dad95a3ad08f675143e16c521745dd49ad790c846cbe2e67abaa5db9f769dcddb6b30a5980
-
SSDEEP
768:K2Dqy0RUujRUuTRUuRRUuxpeRUu4NRUuwvO2KRUub7RUufRUu+RUuaRUuHiqd:K2Dqy0vjvTvRvnevsvhvb7vfv+vavHim
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000676458b0c93b2dea911be2be3ec34764cae442affd4db7ebb9dbcd24b3f97ba9000000000e800000000200002000000097bc6b89cbdff8fd4c1501de3568da8d95fa73742dc1c723fc2c672e65de98a62000000023550f1ec5e0f7d57c2842ca6d0c31d673d11fe5d544fb47e26c8748277c6470400000004dde81d348919a1faed2f119eaeb5a5f6ab15776bc35f4ae30f2a907723a8e3cb9322af3877cfb250b2898b7c4e5ddf8103d7a9679d23964762e9bf7f1b69616 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000894b5c27fdeeb2d47fa3095aa656d48f8977ff04e45bf54bb872457a0e5d885e000000000e80000000020000200000008201f5bbda7736965d250736ec110ce2de72dc1ab18f602880c7333fedf4cdc3900000008fa669633b6be81e188bb0b87cd475cbb037e873db20a631477a431fb13e26a25b5b787db7a26fe8895f76fc743e54d43c284b9fad93e17d4e6b7627af8728f8b127b4f8d8ebffbf6b3b343fe3c8f98d22d7c9796864f2817e00c133c60332d7be56f81f44a06f2bba11375e96f9e6d0e74af6953c9e21a0b87c7b9698249dcaf83187c9373210b694b1c669167a41f1400000007ee304a86163b71306c8f7fcfe138e08734b46e31fd6363e426c5ca16704e2e3e4d6aed9c67d2e90a281268fcb9248143ccb659888c9fcdac7541dbae77e930d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434151238" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501488add715db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D83A6FE1-81CA-11EF-8E54-C2CBA339777F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1884 iexplore.exe 1884 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2804 1884 iexplore.exe 30 PID 1884 wrote to memory of 2804 1884 iexplore.exe 30 PID 1884 wrote to memory of 2804 1884 iexplore.exe 30 PID 1884 wrote to memory of 2804 1884 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\107ec3b49cea812a4a7a52fa52288aaf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5aadfd708d338eaa9550e8223fd568a75
SHA1a2ed29884426b8b556dfc88154ea46fb6f9966b7
SHA256abd6695fe8db9729600ed9f1fa337d8124ed6f92529cb93eefb3cb73620afbef
SHA5128e44df94094d8959c41454e818f0e48f888d4330e79dc01b7048149166ec5488d411a7ee576c97762fc47551aae5c8f76a122624b9f77f808a83f93d65ac77b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55da53cb86404274005fa49cbf38d833c
SHA10388ad568cdcc1056170fb7dbe20f23e9ce65d09
SHA256c01b3ef9bf612038d2d4180dc53f84af53c84b32b1b6c55f48d4a2d5918f498f
SHA512e205167ccb8f0c3ad653d4b8b50d9e2d4ce9143901548a06f3c9762a2af8ef1e09b56c660bc516fdb802dd1297464a1df3118175ce27d801e17f081208a6456b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c299dff07b3c327681ea0237e6a8a45e
SHA1f881d29023c82d44b8d01e7d22c3fc566ef393cd
SHA25627875fe40bfdd6905a852ad6bc515cd1a127dc9dc52352c57e778f34f1785b48
SHA512982cd83655d65ffb2eba7b6ae58db036d3e94bf1dcc397d6f3c58026ed68e9c4e397c3a7b6eb1adeadc754b4be97976a6de4764b1af77af70a31534ef62800e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ef2b3ff347696d12fe70c0de9b309c4
SHA1cea7925fc2784fadfa20dec14add6c9e7e24de2b
SHA25653731652b2e593f4c3b17bf352f07216f2269747a733343b7f22952024c7f41f
SHA512cb8da035443de2215bd49f1265f42034040b4aafa146454662c8824e41fdcf7dd77e7749f5e822d801e99a3f61ca1e5e5ed03f35d5ae4536913e8d66b259314c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dc346fba2a820f0925ffd79b24d5be0
SHA1b5391d3b140ec3d29606e03437ba79624a385088
SHA256cc58c01757e0b59e92a2e977eed78f974a08f3196b073ae823d4356e9dbcbd6a
SHA512d79798d5cd12af8f2206acac839b3a6abfa1d8504d95f019967a426a6af002aa1fd226545cd97bc38a216913d2dbadf974f7ecbf30da65659b41226810765b8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a7af29c61fc14dbd1dddf225c6bbfd8
SHA175f90f728d5cd46a79c9d06ed349f2200d93203f
SHA2562b5bbde0aa57dfe7e05058483fcf13f5a4595d34778eac052d85469b1155a522
SHA5122dcc2636b6034a6c2fa57ec50c635ae5f68cba204786867c26e77e764331a251fcba4bea330570cd0691a779cf519ecf17ecb247b3f24eca9af4837358eb48cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59243256155cc5d53a401624e51a0a984
SHA16dfe642d1466c7b8f2aeac0829fde10d7e3bac9a
SHA25678c755d965c37a9f033c34ee589dfd474d37db8ce0917ce48076cf3976c3e931
SHA51255f7f28b8b2ce0e027b85adac4fc4c35ddad1ce232c337c884c8ed7b5ffbefc7a2d556f9a8cbe44d5c3894da2e956d2760485e7671050d145eb3e02fe354c7ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9d4c6c2ce56f94837f50e67f2796951
SHA1cd7c994d28992bd510e8aa755ae63a8c15346748
SHA2565ab9688d847b1a184ce3270bf8ae7bd2aa618bbdc9d604a441ca97f4bc520cb8
SHA512a13976e9618eea6060e405dccaa1a2008482e15a15feef954ce1dcbf08cf6b0124c7a862045a08cfae5c3fc3a99269539fa162e5b99186e88d8d2139aee7406d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526e12e40f3d2654e8198ffafcd4d7aa7
SHA124d8e399eb7a05bd885e22acf5e38a4bdd636222
SHA2569b20cf7fccdaecb80a0bfb758ff13dce443e582260462a295ca302a90cd698e9
SHA512641a7241b03b0d0a570ab1ca31afc7c6e3dd51289fed1451b30aa06de087b1cddec5af32c74275fd262201d1b9c1e0a688e726760e91432b8409441bfdeb9585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4739a1134d0c7552f4efdf47b6cde43
SHA1c952c3cbda94af60328b558549cc958747e24688
SHA25652f2c8eb07bb8bdcbe9af30c3c3925295d07c9e13e7eaf1cc0b43540c0969700
SHA5129b2abcc0e63aef6ffe68f3fd6bfa76069228cabf6ab5c5b42632971bc8dfe7e18abb6ddd77e99376536f1bf752bf43ae38d445fc043c9b3f0da8aaf34c60415a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56729c6845cf9da1df9fc49e6fae70215
SHA13e152f0fcfd22a31ea564ea9e26a5edf4f3d098c
SHA25667d88757af8c1b9dc1fe0fa32749cb6d5c3868dd7968e832accb80bf954cec5d
SHA5127c39e12d5bd7c1d324b49a7c75f0fccae5b8dd4408ccae7facea7388c4f202efea9393e06a8958c841419564c07a9e928df3af3ae35d237c67391cb891e81699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b27ea873414c95716750855e9710290
SHA132fbc8e53e574cdc1e84d838c06d8c05974eb01d
SHA256dd6e40374efbcb3c5e2f98e4935c39f92ace51aeee2d4c3906939978e63def05
SHA512dd20b410726f9ab658805ab9e27bde1eec22ae3739ce3a57d6482cf598bca21667fbba6041c6fd6a734bb971c53337df5d1eca86ef67ad785720e53798e2f0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52a083ee8541b2b6e8585307ab5baf963
SHA139f8cd006f9c718ca6c7e9bf4ccfd1ae6123832f
SHA256d0e5f04efafa1647a391338635c801461dc47c4ffef68aa5a16b10b214b82862
SHA5127a2d48057a11da5c4293e11ad900526092fc03c34d77b800919b7d5c67064604a302e37f99f18dc0cda05295f4c1b35adac8885c9121513d938cfacbd97b1ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58909eb796d77292c5c013b99b6227dfa
SHA14d08da303782c5de09ab2d2c8e0899005af4162d
SHA2564678921ec6f807d5a9c9ec2bd578ab9f316aa6553debf62b0313d176994cdc9f
SHA5123bf21c62db2ac252e4c93cc297d08ed608c1fb181e884b815e321cdb84a451a2782d365734467bdf76d255296511720cc324a5790dfe988dcf64363dfb8f1933
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b