Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
17da97a16cfd8f20369ca39f2464faef_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17da97a16cfd8f20369ca39f2464faef_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
17da97a16cfd8f20369ca39f2464faef_JaffaCakes118.html
-
Size
14KB
-
MD5
17da97a16cfd8f20369ca39f2464faef
-
SHA1
889585c34afb2a7ea0997cafcd249a75785dbcd5
-
SHA256
58a15e709865c290e46f8ef7ed82bd51c2fa5135727353fed6afca9eb61dc8ea
-
SHA512
e40f229923bd25b2de571f33dcc80c9ea3ab44404edd7b48d19540d0d43b57fd3667644ecc419f43d031d94698f0b9ccaf5a40f6f6d6c1948f3b35bdad33720b
-
SSDEEP
192:Mr+N65EDJyjXIRKDvo/nymb5AEVBRzEfldtWyBAuzzTKqWBju:Mr+TDUFIjVBRzuzWyKYzgBju
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E41A691-83D4-11EF-A528-527E38F5B48B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434375175" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000005954a50f3e1481f985cffc6bcff4f768bd7203056fab7e3f4789a77704c51efe000000000e8000000002000020000000300d09fd77e0a575ef2b619b05004b3cffc978c73fcd9f276cd88273ddc550832000000036208a26ada2e5385e885309c230fbd24dc272e83900e220971e89a472f2fd8440000000285b4cef387c7093ebd2ef860396f9f7daa7a478ee394629cc50cafe54cac8bc0f1c0e0d6ff07a9008c98cb6cba4713fb32119c3422cfe1fd872e6101fef072c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01a5213e117db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000023090feafc3cfdb75577b41af5401aa8694e442ef9e758ac246cb0764afb73a8000000000e800000000200002000000023dfe050fe94ed4e603c475b4e3c7ab6238675503e2bdcadbf23426c6c7a07a6900000004f4133daf4e2c20927ce1aa363ad20c4f9f30b727f12cb538e8fbefdd839bfd2be7c94b7cc85cd4e90a8036a0eac5ffbec5fbcec94594cb6ca5fa0b373bb309f00b85fbf8b10d2bba1bb9a6177083724938de841a1a16d0813da82933c3bc69c02d5d346d077abb19222977aff1c1635a4c08f58f920bc862d9005ee001141a7453cfe8ea6a51b68ef55b4992c5f348d400000005c82a159fdc6259ada0d0dd36f943038029af807530ff4d690b13693b51cc4ffed9b1090eac82466c3fa47e65f66ca51962d6114fb54fcf082d99a45ea243ef0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2472 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2472 iexplore.exe 2472 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2820 2472 iexplore.exe 30 PID 2472 wrote to memory of 2820 2472 iexplore.exe 30 PID 2472 wrote to memory of 2820 2472 iexplore.exe 30 PID 2472 wrote to memory of 2820 2472 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17da97a16cfd8f20369ca39f2464faef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594dab00e277e70b10e9f4a7fb91ffdae
SHA1dda6c5db3a13ed0996b3fbe7bdb01cb8b95818aa
SHA2565859cb35c43752368f216e6e40defa88f458770f2e6f287a9ca697576ed7c4da
SHA512c3ed52d612b7fdef349515f49dda45baf2fdeb9ae3bd2142365945745ac39e4216d4708db058a34412d89eb5a4e24322e08de0bdfe24579a6dba53b3ab805797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575cb4e0daad41212adbb51c56fa4cf6e
SHA16f8a939ca267adb47699b1948cc6aba621d08421
SHA2563c2ff75589457c0e97a681afec483ff18ad31078d20d8ec676cfadc7df414c67
SHA512ac8cb1fbe0637906aba19c58c23091e192bd618ce877cb76a888c630972e8319140cd573a5de78931b926ad83002f241d326867ce6a73c03b253feb1666269a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e9de78b2e5f12668c03b5b825f680f1
SHA188ec2af21ec68f4a8c0803d5e16b555560f84a85
SHA256a6c67a9bc459448fa1912b259926cc8c78f00b80d54a2966a2c05a9b26beb951
SHA5120c584c1fab2cd020c7dfb139600ff8397e4d9214f98615bb26fc95f12f552df81a665308290d077347a79d57fdb4140e5ebe7f3dad89cd493089dffc6f8d5eba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc95e84e076fac5c44ed2331c99c490a
SHA1aef84979167ee531514886f6d6df281673c18ffe
SHA25637101897690d2e2ce1a5a01b5348402b4f0b9882e0ba55dfb4eeffc5c6b9e98a
SHA512a7c450db227868e6212eb0cb03a450ca50f210b17d9522162bffa83efba1f86f86f86e9e55a3d7439b5d21aa1d8295abdb4e97fa3f62548499b8e14163139f63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577f4d3765fdbb66cc972bafbdac08e0c
SHA18eeb055a515818492eca2e6cb6ee2df126bbeaf7
SHA25608864c7b86f89e7e05b4b2e570053f7d7df55aab1608130bf156d31a02383a36
SHA512850597a3bf131a090aab4920c44f95113982a47481915fefd7a623d87ebb88ef764a1355ce96644dca24253f21cb3826c83cfa0991844e74cf873386e544c8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ac1c78a377bfac1ebee6ffa6d24998a
SHA11140824bdd384d3ad43e66d6e527530706eed609
SHA256a0890cb6830e2eae1d251d92b0cc5b2c26978e9194ac7f0927ccb7566d128910
SHA5127148a98b015bac0d4713e5c891797afd77ccb20a2918d9b26e2fbca1961e6d37ba9583565b349721f5af46a7ac939bea2ac0ac05220f5eabe5374f99b3a19236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3aab299717ffff927ad54e46d2f5806
SHA175b7126d34f4af73c96eb416b8d35a003c91e68e
SHA256ba357a212d6b414ce7ceef5702cfd0ccc18fc489263c688c501389462745ebc4
SHA51276594f2421cb5d0e6989fc7a7df0335a96255294dc7fae41f0124abe112bbc5f5683917ad1608239dc67ea1cd34592b28beef48ca47afbeab5cc80f975908e5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5799188ea6f68a7eb590a1b3dc724432f
SHA1693e9735ba9edbdcf14864dcab40042299c8294a
SHA2561e72b5e5ae73e1d49f9f90b3e09bc10f50b2eabfad4615b734a2e5d6d5952a44
SHA512331b2bb85139e072ab9ee4c6d2c1ee211cd7c451f08eae6e638dfb998ec715f3c3dd1d8826a08da84e2548f534a31c27cbeb52b242710d72e305960efd2b32c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5732790dc678b998c197b939172b02fb0
SHA163d28eea13031a0b448d5c51bd38a381f6c392c4
SHA256ddc7f1b350f8973230ab3dba764a0d8d019007197dbb16af8cb68c433b73ca97
SHA51282607b4f99b3a7c20abda2f82e2b35df0272f902bd881e988161cb7281018f2eb92f23085544a48f2f67d04969fe73217d1224fbb1bff8c10ff0ac91e5857f55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bfdb6dd16b768cf58531d25690cfbdc
SHA1c01538a150eea953fc62ef965d516000398e4e8c
SHA2564888c6f64a269f2cbe996e982eaf0c13cd68eba9e1084949228135a44176020a
SHA5126be3d9c38dadcac1b43417293aed3b483411d4e15df685f9669130615a7925993d4e95c3f9e8c9a7270913b5c3f8e2c433cdac52b8b105454c2e03b4ae081bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc6ce0321f2738c9a79bb5ba17717efe
SHA18efe808ff284909ae798b3528357fc3e66fd2b9a
SHA2562ca909e78fe20599d451edd48d712273968e558f164cafca6735a290780dd729
SHA5125a8bcd918bd633065890e6222482e38bf25b2637d098bf44fd41d7b93e639852fcc3dd17f8dfab8ddf8c475192435ae49be3c026e64e363ec3666da5c37fa638
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51426d3c8b2fc7f8cca0848a56b75e55a
SHA1756feacd3a4503b70db0c7f40820685608d11b90
SHA25677550d8cd8fccd106ad1fae72d494b28295723378f5b52538ea870f1d17905d8
SHA51257fc03b7b56bf3f13006e3e4e5ac90788e86a632bbf117b6cce3062b70ebed4e8a1171ec03a01b45595327ccef5cc5c219a88eb6e540ef35b5d3db71d06b861f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525a76bafdcaa6e5eb11d87f611ae4ecb
SHA12cdbb79c66c943d8206fa9ee26fa81c0ce6323c0
SHA25655dd8bab04a99dd9b47e87a696241453ce7e5e1eb14be9f09979f5da4a108966
SHA51231cdfc1f1805ee5eca7204e288597c401b1f2ca725a550caff5e14cf74750845624019d267e8f5d46d0c3e68524456f66b7ba622e7b1001850680eb92c7d011e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5621b127af6639b73bdff3fcd59f576e5
SHA162a37ab36bce2a7ff1aa4b076838dc89a0027ecc
SHA256920fd86fa2e4a8a9cab959beb94e8e5233817947bf894871a38d299c43af6c7d
SHA512d37613101c0a28c14d42d7c9d3f7024dfad81437a3303404c8d775bff88cae9aa6dd5be27db92ee6203d728cca6cf1e26b99cd73d9b47041e172a884a9d03407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd04dc6dab07e7023c76262030ba8bb9
SHA102ebb27413aa99ab6a11eeec23dc60bf44a8431c
SHA2562f045cdd0b351777f434251a9bd4233ff9ac400120d024b862e16bcadf042f1b
SHA5129d5926873f9659a19d3cb333653294b8ddb766a47443f9f74366d2ca28891c040435dfd4e0655e7e2b52d203fe58d9625bb65d3b089880e4fc2c33faa9005c40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d006fd80b8247d9f8da001b003d07374
SHA16abfd3460d311682f6238c5bd6df564cef471136
SHA256b582833f62fa53a65d061385b638dabdb9ae94e4fea59653fc55f23d55430fac
SHA512a3dd1b8bbd073763675cffac3e56a23dbe45b05924f5882af45b7a24bebeb3b0cea65a7cb0f10051e6de6e69b687febe4a726794bee017d084983dccc2255f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23dedd7c7d79e268911574e9fd71969
SHA13706048810c8523d2c409cdc71962e25740567f2
SHA2560c89a2993c2d0ce39ec94b2aa5df040f7e81f799e9ea0b1470376fb77ec84190
SHA512cee1b6a1875febb5194366c419c619b1fe7b41e97807bc83a7dcd1b744c0a8bd84208a2a1555007b5f4c1e9eab99081262c2811802f4eebac096d3818895915c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3a9fe61cab9ee919050230bb684fa92
SHA12afb36b75509070dc0eb96133fc39126fbd5902e
SHA2562cf2846c11cf6f42c401590795c06d7829978113bfb0979395dcc824645c1d80
SHA51254d23fa8c1213071aabe3f10e194dece8f96eef008fdb348f773e079c880d28db5de8fd444e21553f080fb77ed7c26e16a09166714b85ab6e72719d405201322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b2df2159fb99608bd74afcc686f0fd7
SHA1f77c8fa34186e18d9e180e1b6f6715d3b1c94a33
SHA256b63f837f7e589a78cc85d88071ee77f1c0e59962935f57cf187a7b748a554735
SHA512fab93d030212e975e9e41326ce4431a5ab59f1a1aaed50b9ef4ccab3b6d865a905dd6062d5313b72c96492bd5537be6e705e6bfe31d7edc8f42c77a638e4c15b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b