Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
13099dc2316476f5145b1083821c603b_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
13099dc2316476f5145b1083821c603b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
13099dc2316476f5145b1083821c603b_JaffaCakes118.html
-
Size
12KB
-
MD5
13099dc2316476f5145b1083821c603b
-
SHA1
6481a80394a33b404b1b20dbac6cdc1bae56e4e0
-
SHA256
9bc111529d7d3b65c8aa7a7ca3a0df7468df88bebae5f7f5cd2cf435ba96321e
-
SHA512
dc2b2e9e8939779011ad5004c9b7fdaa162df8027526f9174754ca325dd6177266c000cbc720337df50bcabfabe87ad90355b09c12037dc4b6af9039b0dd1f76
-
SSDEEP
192:FfzC9l1nRJq2xgP/ttjifrR7YywM+GV5kCJj5w:VU1nRJq2xgP/e7nwMRV5k0jy
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434200993" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE259AD1-823E-11EF-9F10-C28ADB222BBA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2412 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2412 iexplore.exe 2412 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2432 2412 iexplore.exe 28 PID 2412 wrote to memory of 2432 2412 iexplore.exe 28 PID 2412 wrote to memory of 2432 2412 iexplore.exe 28 PID 2412 wrote to memory of 2432 2412 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13099dc2316476f5145b1083821c603b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8f767a933739dd951e824fe5e97ebcc
SHA19e3e40c3627c359f10c576cc2c9230cc108eec85
SHA256b3866f50c2bd12c1761e4ed417e122ba5fb81f113830123cdca1714b69b5a3a5
SHA51276be16eff080aca060223501e1cca75870f758e8f449e7c9af7410fb1015f943679d64076320fb83f8d35037a2c3d778a14acf19c8133c4d9a5c09530fd3de68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5574083e17fec6b0a37ea02d6f8b753a1
SHA13aa9f93099e94424c6a14651e599d1238f2fd393
SHA2567383be2cb11e68755396b4ac8a055a93c86988f3d1a6b1f43e68f9d36abbc953
SHA512c5e3dddcb3f675746d1f1f93ee2423213714e954a891673be32ab841db6a1603fcadbf97dabdeddac0e413d302e61e0e0e88696dcda326db683eb1924f179c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a46a933d7d400e9221b15c2620151de5
SHA13d0067aeabc817ef080e32b479090d456df29306
SHA2569ec34ebfaccfd509913ec8bb465e975d7f44d32402bf677ea502cacd0db21113
SHA5128c6644967c680831306802be2f95510660c6a9735a828596474095da7309122b1ffc3666cc761a3ff862e65b916e95bb68cd0f4368a3e2cec4e9c7ab091086fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8bc371a678cf818bf08224a22d5a10e
SHA15d428af672b8db2fa038b50bb59a5c9c07fcb6e1
SHA256a33945822adb573cd5e5fd469200475f71102d6775292b074c932a66cfbc2598
SHA5122e51ab6997cbe15239339f6cd89ad130b63ba8259f7684e0a998436da1123ed6252efea4d60012ed18fd5aac7c8b739c6704f53d1e18f059b654e5a58d406a11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500e948533f58bbb475d24d539e0bc3b6
SHA1975c9878b5c83bbcdf229a189e45e8884b16b0fe
SHA2564726e3d1374bcf0b1d47e42f9f5513193990cc109c70f2e8fe774bc7176738e4
SHA512bd415f46ec99901bd3a726d1bab1251220ba320de1023c50c6b79001a4ae8175fd25f15748ca8dc713aaf58b0c5ffe69dbe7b00a4f3e6e1a6e48dccad24c86df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58da819a6019f5adf48ab7a77a1eae5c8
SHA17fd1e2c5f9964310c6a7a8e460d6940e3902b59f
SHA256bcc9aba98cb495dee65b151d7f0643e42fc5082bf0437699b483e06572299af7
SHA51237cb1f52e3bb65bdba8e39b00f2a2fe7d5fb4df14f963dda2d7da70201050b816245a8c76f08915b180748401f900583bfc5ac7ce9511e1010ade58b94ab7c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa69c763fad9f8d35007ec5485e28d59
SHA1de586e2e5be749d3707e047ff5798b700558a8fa
SHA256609b6155d9bcf01a70f075d2db8ac9584aba2cbed25611b365e0d1c0f3e9f9f1
SHA51256996d32bc93d879d6a945a721269078e0183d874b787167e5f728b56728ff51fb34e0c9601c6b58a8c80f72f28f2aa6c50d38bef7eab0090bde12660efecfc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f763636a6429c09ac4dbc7ffad5b2888
SHA11d64e1ec0444f8207954973cce86d2ce57966eab
SHA256de0c09cac3c693e5dd034895cbe6e3483adb531b123b8a2f6c499e27eaabea55
SHA512086014724fffc947349a2b1c979066e2a84ada8e0b0a7188144bf85a1d4557b7565a749d0bb58de9bf42bd229c339519ebbef789b32c22b415e0654f3444f85e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b