Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 20:42
Static task
static1
Behavioral task
behavioral1
Sample
252c1d2468d82eecda281503ae2f305d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
252c1d2468d82eecda281503ae2f305d_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
252c1d2468d82eecda281503ae2f305d_JaffaCakes118.html
-
Size
18KB
-
MD5
252c1d2468d82eecda281503ae2f305d
-
SHA1
88902ea76c1149a3b813d59c2088f4956549759f
-
SHA256
43f7310a06030db4d52c99dd8038eec0274501ede257c9e41780886e20526d6a
-
SHA512
15b8484ca66491db1209d02d3d4f42f9ca302f704ec5b4ec4ed886cc3f5cd7a84bd86197f8d7abfa43867e26f50440a238ce18d05b83560be601ea45295c8003
-
SSDEEP
384:rF3GeGVFTm4OosiFg4D4jdRqR/F7D+vzJqwruquDiTMVPvHSblMNv6uPIjkeetyT:rF+FTm4OosiFfD4jdRqR/F7DgzJqwruC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{661829C1-85E4-11EF-A540-C28ADB222BBA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434602015" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2068 iexplore.exe 2068 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2112 2068 iexplore.exe 30 PID 2068 wrote to memory of 2112 2068 iexplore.exe 30 PID 2068 wrote to memory of 2112 2068 iexplore.exe 30 PID 2068 wrote to memory of 2112 2068 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\252c1d2468d82eecda281503ae2f305d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD57a19d4f62fd9cf3b5ecfc6d857247e1b
SHA1317cc8f1929f2af5e7ce2d92ed94c0c5427373c4
SHA256b15233b5a5ab389f115ab6711048c05986fc395e1d164ce5eb064a9a7109558b
SHA51241e7eb4406daac01c82f830023ce0fbcaafb7083e765d074d133e7afd6ea4738a7b85d04c6d17ed9a4c7d9dfc597f97069b0ccf75fa9d51708aebb8926c4aaa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3f483c80ca4e0314934e3f7be5044d3
SHA193030f58bc604ee1fbdf348cf19f1e7ed468ef9c
SHA256200df1a7800702d14774484709f20babbe4ae81e246bddd440fb450e7926619c
SHA512d9e5398b701612f79ef21d762192d9a8d4e67949aff7dd653803215056474a3874f10632546b05dd0079e2b6ed46e868ff31bec425d6ba7820be2e44fea53856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5ce17a25e422fe6cafe275038bd215f
SHA15e6ed4f8d875253d248a35019216a3ce6341f0eb
SHA25627401d7af17fd0962db829a092253a4076396eb571be7a3e6713b723261b99cf
SHA5129d0d28b77a174c71ce8c05d689ad8e427d96f0b72b245a91b42127200a102f927340f382588593a6101640f3cbde212898a7b66a379812f491fd5abaeee3e1bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd277e68ad405faf5aa2bc6c6623c357
SHA128d1690f1e8defd7fe36f6c5b3200fdff82fa63a
SHA256cfded22389287a7f6365f9c2f81b868433a34e4ab259072f2682fda341ee60e9
SHA512586e47bfc7617167582aac7655e2716c027e483ee929b514cbb4a629d571f66ffb3a2c7334f014701f3f29c65a2915fb07e766c2f36796605bb9c3a4637f5fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556879b9ab7ce5804afe9dc201bedb43e
SHA1903a282dc3a4cd15ba7cd7cc751e1141d798bea6
SHA256cc7b5eacdf769d1f2fd23a8d810e533709ee593698f4f4553195f0391436b4b5
SHA51263bac32cbd13878e7556fd31c2bfdd908941c6c9c78f0c1a980dd9db4d6eb1920be2978ef93264f17cf52e6a9f4f16a4acc359bfc18d043c48daf1606007d5f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595cca40937efd087f5224fcaea03b91a
SHA1137c7cfc6e9129ade540e12104df624886c809f8
SHA256cb3823f691a96a3e996809867af7499b6473d6862b7506a67d3a91c4304ca726
SHA5123bf3c19ccff1208175861a5adb6ca9eda7930b50ee142fba46e404c5694c70a2c20250253d2d7bbafcf58cb4a3f013207e6381682396949307ae99f40cf8cd4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51705b2b9793b2f006420525d9e1c0f36
SHA173c8739e69cdccc3af97de5164ff6d2f703fcd66
SHA256a7781fd7af71597f9800d22569996cf7c0df7e8eaca106263e2258784f3bb449
SHA512b9da738bddcdb78ab38b7c57698107f6bbcefb857fb74bf5951bcfd3973fd57673021731dc869b4c67ad0d60461ceed02f58d78f9c9aa1baf35ca96d511b9250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb9db8e1be61cc9df8094a215fe37417
SHA1d385c4ad9d43a42025039abcd666bfbe3a04d763
SHA256a6ef24ebeaad66cef7ea60eca3758d04160be5a3922c4643e96a5964ab75260a
SHA512f1ea19955875106a6da5437815077140ee561169266dd10ebbdf3e9bc4319058fc3b1c3338e0454f3810d4b6a5126a371fab0c0866a2b3cfc43d7b51bcd93d98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa4e81d1dba6ea214827ec47bbc2742e
SHA1acf94af3507e2a6b49392411a180d358d6000fde
SHA256f9ec82083e50bdbe741136fbbdba8733ce9c093c3360e32a2053cec37aab1828
SHA512ebc3267021c0c6c49b01710901e178560b1af528a202e7cec7e29ca3da817a7a2ca9d4ddbc0a1a708545c6aea641d2a459452835fe746cb0a18e9ccfa0b63e6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565191ff127e2129dcf50940917205ea6
SHA1ce68eb694375f6e7b0760a398f2424b17e48833d
SHA25652df44ebbd2cb4e0e2c438b52080502999c2a775246394b70c09a5cde8176a5f
SHA512f4756084ad171d142f579b379e5f7694adaa9a50b43779366169a7ff3c15448cd5df29c33aacf66470f2d31a19ed7d9eca0d022b0c93e110aa21d9976cc966d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548ef9b2d53b29ab640d273e3c856e468
SHA1837bd76a795e6d1c0d51edc2d257ee678404942f
SHA2569f9dd106b4e7a893b54b7fbcb3e2e412dac6da126dac8360a6bddf7076e76fca
SHA5127173f961633550052e839fc5054e7ac377bf253cc7b83d573a5249d85073e5de394e0000415ff37aacac733157a7912fe879da5a6a5fa9d6a85a8198c179e467
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD516c0e147a0a447cfbfda89a14cc4f688
SHA1d306f639239461fb7da3527506d7ae1a775eb1bf
SHA25654046be126978afb89e212b928a43185f0c4f4b41f15743b6cc90ed24de15498
SHA512c4b93212337b4443398583505636277ba3e50857bd60fb4523037f4033438d98d292b2902a47f51436b78eafdb1554172c098e0b15344975e7a85bcfadb57e31
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b