Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html
-
Size
214KB
-
MD5
124934ad0499e6086d51cb482a8b179a
-
SHA1
f368571e03abbb068c4cb9ecfb91230e0dbbd3f3
-
SHA256
e5597096485f6cbfc37f320a99c8230c0cda15c2c9ecd891cac2fb9462ec1e17
-
SHA512
cfa6ad91a5c5a50489b55d58f6abeac42a6ac6af7eb635ca2375152b2bca7f47abe38e5afe0437113554468d9f44cbb2ee350662081031f0c9a9c340bab9c9fd
-
SSDEEP
3072:8rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJV:kz9VxLY7iAVLTBQJlV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01c67552a16db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000004f9735fc3b13132352970b52ddecfaba2878d283ee42926f9fecb7f31630074b000000000e8000000002000020000000ce37f0c4bacc1712dd1bc39ad0d1b9ddcef02e69d75036d6405732eff201bf1190000000b7f4dc7d8fa14d26a667e4c68d0d2df89cd87124dacafd8719e754b9c42ac801b5a2c8dda969518bfbad267ab02e7e81693b744b2455b3140ad15f43e19ba2dd1fd2dd2d5607e98cc8792f40a4791c8a4df3681c1bc1b8b25ba5bac18f71d71e21e819dbf92dd1fda19e4db4fd1b84df5044828518c98ee9f5d807860ad5ccf40293024d3617024c1000a87750d0ea8d40000000d15d4ecee5a89c6f36144f0663eb19f87cc0d7ecf8cf728a29b225259a8bcb71aa1a126d1af0d03f0602fc20cef6871814d883aab04e1274e64f576f3eb8e765 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40B1E6F1-821D-11EF-ADF2-46BBF83CD43C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434186631" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000b39bdb06c859bccb19b416783778fa6203ee79f04c7a501007499bcf7f8ce801000000000e8000000002000020000000dbbafd7849cf367cde47651de678060992799f8f6d82d7d926a78b85ff2bae3d20000000af15b869bda3c031d83acb7040bbb9db9d4c141d7cf941ae407d7e9158c0ad1d40000000e576a1e6b7054b48a28cc2869aeac4a4a8b3ca78efe46015c06696770bc66a1c88ec575ebeed579b07eb5153afa6315029fc5e7f3fd94a9fd1ce2fb576292364 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3048 2104 iexplore.exe 30 PID 2104 wrote to memory of 3048 2104 iexplore.exe 30 PID 2104 wrote to memory of 3048 2104 iexplore.exe 30 PID 2104 wrote to memory of 3048 2104 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7f372edefd1b48c0eb97e8cf3552fd7
SHA1cbbf3acfff816b8395d10b76cc7ba3506da7c874
SHA2569e603a4212491150355820c6077d1bcaeaff75907fa07db666f8a84ba2a228b0
SHA512136640dc5de66dab960a17cc969bb997ff4d6db849bc244e4e95cbefe486252bd8439e270d453c08af0abfc8f3cf50fb5685668fad33bcc8a67c299a05db7fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec6b8ad74cc1c34222f9d671105521b0
SHA1c07906b5f21d6451d5759738b0479aabe9c1af57
SHA256ce6ab545b018e39a3811bb11fd8e2d8056225f4bd5a4093827d9a02bf427d0a2
SHA512a167fbb73976901d5b29b914109558c431020631c3986d979b4662ce3de1e5cd11cee7ec6b10293a83e36197bdec16b358f3a2bf26783d38e4be21de0d9b02ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd8f5a1a77ee5c250993066462b988d5
SHA1585a29c364b9eff8e3f144f77c9785f2f0cc5bf5
SHA256a9a9fa26ef542536dd74fdf3a4c3968a33465baeea3599fa5c757360832398ec
SHA51242dbc84b04eab880f54a02c6831286332c2b00bb6bdbaab6eaf0e92100d33ff495117f35cf7c1939105f5613225f4ad856580b00871d3c8a3868eb6731be6220
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530bedc642a7f2b521cb7e4b33a227feb
SHA13c090fdbdc43caccd6353fd5365964f6b2c40cfb
SHA2562d8ebb9dd7cefbd3305306e2a0b14cd2209a2957b1eac3535c788704f880a036
SHA512b566896e1baeef72101a3e898f8689c236d89cdc38ba8354585cfbed1090199ad74ffc046e90fd533d6ebd2ef1d04f5a027187a93be2f9a18deb2bb46b5d2905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581271f06145855af4c0adce8f504d7d6
SHA169d6175c107e95a682b4351c78b34b830f78cdfa
SHA256c80618bb5f187f0566c5d8a03eb7fffe4b29c8cde1c3d8f3901b2aca4c15557d
SHA512925d41a267ee61c451da3c0d394a72fdf52e8ea2e25bef3b64741cb5d82a08a943b125f63d2d5bb6a504bb814f7c56cfe4802a28aca30d7383ff63608db892f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f462e67a2693236c0044cf0cd73a3e1d
SHA10d7b1393b9aed2aada45409fcaca3a266fd1f5c1
SHA25689bfd53f4985e2ab217ae301541f5e79f9d1ffc5a666cac36ea59bb8b35dfcb1
SHA51204110f13e9c08d8ccd39c199cd2320b6e29a6d88691015e10ef6e103f0abf60dd5010936fd16b8f7e4b20f2f33a85030b847cc96d45cef8d2f5832e368d5c89b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee4e3b28cf89bb2d9ba9c8ae520e23ea
SHA1da70540d51ab2c0db2fd1d51b0c8a4eb187e9ced
SHA256feebd5aa33342f0aab57483bb330e060633bd9c34c15287324410d3ac94a4fb3
SHA51222fe792a2785acb0bc741190d68a9bab6756df62c53c3be0638a82fab3228df94273b51994de8cfae31de23368164b21b086442765b46066ddadac147ceb7b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a13528b0c843f1e805b5f147427f29b0
SHA109c037fd9dc05b6750082d3b5d36cb6140c8039a
SHA25625e63fae0d26df36c7240e5666be3ed29d67defa54db7fc078585004ad19aeae
SHA51260386e2f9c39f576f26f0b2cb25be6d8762cafda1202f75ca75a048635ff19dd42f2ec5d2ec6fc4f32ec5fa7bfb0bf9aebda7887e7dc4e73e9da48d36d73e8f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d64c0abdf92e0a71241d2efb9bd35d51
SHA1e50aea8ff3bddcfae2783dc544dac19fda103226
SHA256e288d0e9ad2acc59201dbdeeed610272a9c7dbeb1b38158739c0846874a473c0
SHA5125e564b0472f9d1cfcf8e39ab156312ed46400af17e84cc29a7f710f4012409b54839048d0c5841543da9ecdfddf3727bf2462da9b2f7ff9bb59200606f884ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bd73395cbfd35a7b4121b54c81b9f5f
SHA115b824352da6dae43500b5c7c76d8d4cccb3a977
SHA256bfca8477e39c155251aa42b127d9677e79ba72a8a27943f56fd1d92e65fb7f1d
SHA512aa6d685a0b24e75ee8fc6b692ab067a0d1493b08df9e288a95ae655e5fc3afaa99f465c757b5efaa8b15810525e59d9520b7f9b845c4691d247aab95ec10917d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557860a6868533a6e26f5b8d45d5b06b4
SHA1b3b56329bcb7e4277d0df214ffc692d1d077fc0a
SHA25644b78ed7cbf43e68dfe945820e26f4dfc53061d5495d916101b7d480db2f2b71
SHA51205d7a83e680f3c4cb8da1fe7c28bcf4a5f26da3844a46cc98c11b82c916566df25241d52f9a5c47abe69f4bc865fa3af5e48b3af701bb6bc9349ff2fc2f58572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7a604d564722dbdde27328aec6ae858
SHA1b6b79e520c95cd1b5bda43120b27952d0876b610
SHA2561cf2e773bb8f319ca472e87bdcb98ec0b4968e3aea9f5f9f81e9ed192f573cf8
SHA512b022194a2e1b11c4578975007af0ca5324b04ad026633c9481fbfdaf924305075e83313c92297faef2e9d0f017d8a0522e38bd6f22975ff48408d2f7b74e134e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef7e709c38176da86d3f0e590f2af8bd
SHA10f8bf7c71cd5851703346d7b24823d66ab47fc63
SHA256ed6e8f203eefa3cdfc85de7df40910a4c46038c97528841aee2790491340026c
SHA51246b3b18d2dbbd6dabb6f7f6ead597be14534bd7e47716793280c17b7e9d231a1081a0751c0bc7d63483b97758a0139c79d92faff4dcff313a8a864a08621600c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbc43898bb46adbdd0d4d2fce1d98527
SHA18373a0a69438ade10683265b2b9b3530fbcc4c47
SHA256a64c3e8fbaf46b8e87b4770f8e6fec64a514f9c2e8545b3362a51509615e789a
SHA5127ddda94a16837816321ead3d5dc552722b7d597363512bd2c362139b23d4e7532f979505fdb6cd329dc1c98fc6c45e0bb3247dd8cc737ccbf9c225f1572e58c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a921500eb4113fb113abb1af8c4a4ae1
SHA12aa032ccf913d6fe9a2e591c9e4fbe0c3dbbbfcb
SHA25641a21459466216e95e6932a3abd27675e294c9468abee50f25e2dc8779374263
SHA512573b64edde8d39ff070b2ad2ad141103dea55def411f8ca9c1e46d22f75fd858a1c8b3715966cb3cc4474e16dad42c0a094328eef99f6ad848aa8b3da2c958c2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b