Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
1710beef84fcdd139b69d3903a27e588_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1710beef84fcdd139b69d3903a27e588_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
1710beef84fcdd139b69d3903a27e588_JaffaCakes118.html
-
Size
84KB
-
MD5
1710beef84fcdd139b69d3903a27e588
-
SHA1
986376336094a847c8e58711fa90d2aa878c8d62
-
SHA256
911110d2776766e8bf7ebcb3cb493b2d860cbb2dbf83953013754596399a9175
-
SHA512
135708a3db7ff91387f0bf1a87c247ace6f05b72fa788cd0249db1bff784b36d18c3afe753ae02fd75d51cb3644771679ef92e0ec35507e9a39abcdc45d80504
-
SSDEEP
1536:uoGzJpNS9g7+8up4FgfcMSMp5poMFUIAul3V:uoGzJpNS9ga/Xfj7FUIAul3V
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B688E091-82F9-11EF-B8EC-E699F793024F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000996b75131d2f90bf45cefb8663049840ec810171f7909a18f7f4a5410d4122b8000000000e8000000002000020000000d232546a65f34944af60d26ab251c88935a2b22311577337e7eb15329da5910f20000000a89b2a7093011c00f93032720eb2e126bcf003e168d5d7c8079ae20405be9d544000000013ea49766381a1ad6b5e59fca0522064c3941292fe489e47b0fd8519a5b4d8f2b5652dfdc5550ef237341bc2a40c6c5a147853fecf8688eb5c544593fc249109 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434281316" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ec338b0617db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000002817992f6efef82a0490e54fcca58a90e00e2e4f57cd6c27014994bdfc7bdff4000000000e8000000002000020000000691e6dfc923a653a1cce951af360ff55b04503e1efbdb35e75b5975611d382f390000000fcf2c7ac45cdc4e28e0989c13f07be6ca02dbf0b029e687af112c36793d00a1c5d6a7a815399aa2166d603fbd546087d14d951897dbd391fd95a56de9ea67e22ef7b36727cc7ef2a5e9d29569d4138da400e2456507c5f064193048b719a37776fd2cd11689a85cd5004a11f5e445488973955b0745b6ce8fa17fe67abc099d958b4b93fb130cab721473cf457a24f92400000003725939ff87029efdd55cf7020ab1453d190bf77334802a2735ae8d82aa09be4f638bc675474f2d478e1280a27d5b82a6d01e1d56577e420032644cf9909a07f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2888 2364 iexplore.exe 30 PID 2364 wrote to memory of 2888 2364 iexplore.exe 30 PID 2364 wrote to memory of 2888 2364 iexplore.exe 30 PID 2364 wrote to memory of 2888 2364 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1710beef84fcdd139b69d3903a27e588_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edc5f777f3631976d411264977d656af
SHA1d92e02b42b2d02c8804ad62caa00817d6a193b34
SHA2563fe8b45cd391302ea726d15f2d0efe3f2ba47b26a9bff7607b450e8f8ecfc2ab
SHA5128149cd74c2bc135425c9f848fcfb6ab6271fc86c952bbbdca741dcc754d80561fd496913578426b1f67679daa0e88a2f9770f5df173fed3e6efee629fc39fa12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553279bdb33cf95136b5f33fadd1cd784
SHA1b437f3bb53bed979ed24c45663347141cb7687ed
SHA2569d73edcd2bb6ddf0264ecfca6ed347a216e3839d9a7415223c9200088cf790be
SHA512a52ff760836b31f3b67f6b3ea66137f1376b55db7b5b2eabd0d9c5fba374e9d92e757ff36ce5a235b38cd991e3a9d0f4403ca4e98b79fa868447f5eeff8a9cde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4faae87740da2f435f0dc9ddaa80d50
SHA16774824647be72f5f3b4386ca8f49c56d81b707d
SHA2564baeb37dc4298dc5799e8ebb6a58efc305c6f7e21191365fc32d6c189cfbc4e0
SHA512a2d4f06857157d7d0c343bf1551411da56a1c500d9b54a32e7b8b54b68b8c9f8f847de5532521d3f485aa9b634616b671fb56fdb86a0e859f234f5006eff3662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b82ceee6aa237311c6201b1fc64475aa
SHA15ea8c5a788fd1c719bc1f58fadc489507e658118
SHA256223ba14841b799c330845315f4f358216517cb06e3a804e0c44aa103ee306744
SHA5122a6c70ef3dc0832b34de6145e1fdf0a3206f33577f869580def19c66225456369783347e2f324768e8ed3f0d02423d0b4c3ca189a3f7ff90ab082a0438406f26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c887a0408069d2c82d15bfc32a21f874
SHA1a95c0af2dd43767893b1efb4c5df5bce2fdd0947
SHA25664e0e07d95cd5bdf902fbd6a27a605613c4b187f82999ad7fe4233f2b0ee11ed
SHA51269eede65f837c23abf1c3f4f160bd577b7cad2785d467db5ec5847bd2b2e8c3e05f88f681c01b7b476e04c9c34758291c4d8a3df64ec6e8cb5443acf1c95c659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59be83be682ee4093ca7834550442c72a
SHA17ad62d6a230332bbab6401d76c61d55f6ef09c14
SHA256667911678a5b29d5c0e3746c03e092701cc25ac5a06b4c5176d1d23a9a15668f
SHA512f952614e1c42a5bd69932c053c64c65d5a6917f8d659d578af2f9fcd385c05bce9ade46d1698ae0c53ebcdfb6ad74a0a77933ce87737a755235801691e50ec61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5312288b9482503c44478f528e7ea7e7e
SHA1de6e5fc64f740d13d8233fc4ea587c2a71f3c49b
SHA2569fffdbc3e3f1d122b752df2dfe60ce5effab464e465ed89f89ec43592113abd5
SHA512e1924232d2edd65aae6d4678812d2e2f3b1eaf18644befa7c0b0c3a11fc133dc5aa121d1340d079ff2884578cee0482ff4762611afb578338d160b451992bc01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563a6edc0bb5857cbbf4b5824b5c7a051
SHA17c9a749e121236ec43a821203561ff50dc201864
SHA2565f4cfcdca562b4749491aff0e5904694a917a431fe3bc3a246ef2103c06877d0
SHA5121f7d601aa71062b764e8f60802af3128e9fb8f93841cbba2cc36b9c19870ad56c6fd49faf3fa077c121659acbcb8cc2296b7952d81dbf429c864f9fe2e8bb044
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af53ec7f34871d02c75438889452d64d
SHA19aafa22dd581c7c7b000284cd9b730d893ef3f14
SHA25674cb0cb7e88c35d9f4b476e5cb30e3efa1d6730f349719094727b6abc76a22d5
SHA512c4dd4f0d61e61a7172a80c92b00fc5aed5ddcaec21e31f92e896a17f096426da12d4394ed3aaed059b67aaac22e39dedb1a61c5fda134f265c356169e4b3f250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fa08647f07beadf08d58d15031d1193
SHA1c458e6296a0c8699758dcfc0e4439a02ca205f51
SHA256a0d0d770a0940bd81f6533d502250c6db83b32e087c1c199f80b3f8eb65428e3
SHA5122530e9dc406ceb3d9f5bd20f1cc0eb09e65e6ed78bd91f58d86b6e6907a8ef477232df4e755d5be822720f8e72cab48ddaf3154ce1e42ae0c1b0458262d88569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae243f81ae8415dbcdc4a42ea8921495
SHA1fec099e8ccba97bbab79d0231a9ff9b46bce9d96
SHA25653c16f03b87fe548da618347303edbdde4b50ec5a9dd4aa79e3d6ac31ce5cec2
SHA51224b991a7f240dd377694d43be053cc3753336ea17ea8b5443cb7b3d4b6f31b37afb109fc01c19a8e00a8353d33fdb129566e1994574cc9a42104f112fb001375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532ca051b14f52863be46871a7a69c8e4
SHA188931b31c1f008b42c7f9a51b482f3c5f6ada4ae
SHA2567b78eb27c713f32f93ed3a2a445775f15e510c31548c0dc76a7d444c46a42358
SHA512d36f5cfb0d574f61a06a29b72cf571558ac845a6e6f78a579cf3df78a4220e24b7cc7a7808cfbfbfe0a7a39f2f6ed33c65a77d2684d6eec2e592195c1c0d6067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540480021922248e3fcf5cbb9f33d858e
SHA1b5944e4e037b15018244eb57aad5f9099020d65b
SHA256e5d5f8fc7570ea0c983976efca74cf203064db47eff8d52d7ad62130cd5bdca8
SHA512abc011ab97dedb1cd4b3fb5a0f720998a2ecb5c21f32f9abca7b3d9fbcd5f7c2b843b0b701ab42512a8a54188b8fd00d62d541ce4b235d14ca5440abebe22790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b4e8d59d691a705d76c434c71384db2
SHA156808b52c0e6c3dbe3981aae4660a3f9bb807235
SHA25693982585cb9b9f6e6c2fb08b2873dfc637e01938a922decec3d9d034ff8ea000
SHA5129d9e9cf2d53ee5c38974a557510e05b07ed592749ae9da63cd18ee3b05d9059f364d59adbbcc67f3ac59b4e528088df4423a475f871c5f856b64213c878ca2fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59464f957b42f5d56d4abc59772c7671c
SHA152d8f05023752ba4ad625dfd648b2f5cff71a3c9
SHA25681e894431a6949e81fe467f107e3f1a68bf19958d7c4c521ef0cd0408a146e5c
SHA512c95b209399495cba6c7fa83f503d880e9ba8dde5c205cb4bc2d3ddf3c22d072be291497f75734cbd73751a1813db73d095b5ca97220f76269dd324b482952a52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a33e0794745ab63086f2630a401bfb7
SHA1f8f2f1de457014fc1c086c5c5399834ec814cde9
SHA25608f18ba8fcf64dda2059fccd422340abf229a70707de6784f28ca3f48440edb0
SHA51210f2bda42a2c35bebb735d77ef4f993cceeb8af3c048976fdb36102634b8a9d0ec5c567516b0fb10b20b37be62d8c55fdc5f4ac43adb0f5d7ebc60527a15b1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514a000f9fb0a5ae644c8cc930126d28b
SHA16651801d0680f1ea18f1d0b89604b932fe21068d
SHA2568b77fc852b4828ab5278503350b115ab918a6571e28a93eb4c2194176c22204e
SHA5127df182e9db8bd4e780960307405ec06a44cf9b0de3490f41723d37c478104d79d91b5c0f1291c9be328b053ffef50d39290ace413ca6749c3b07523aff9fccdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5906c4b167708853d0b994caf48d4de7e
SHA17dbd26f423046435ce14da793763d521e28e9c75
SHA256e63f20f71e7166ac81688eac543e97a270390a0e60840412c1eab2e9af2734d6
SHA512e0d1ae0d8499a5371df93e2787178ea30a72792ea03926ee99323dbd460e23836f84d97ccb811a845826db93d9acb811c4eba2ac03646a9ff3259db3d7e4d782
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b