Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
27dbe21b336d41e50a812910025079b7_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
27dbe21b336d41e50a812910025079b7_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
27dbe21b336d41e50a812910025079b7_JaffaCakes118.html
-
Size
19KB
-
MD5
27dbe21b336d41e50a812910025079b7
-
SHA1
231c5ebdaa4735bdfa5afa1d939f94eb1b1f0cae
-
SHA256
bbb9ef2b81a6883a8e47192de6e371dedfcd6fde72c937ed77d07626ff8f0d6a
-
SHA512
835930e7464feb8af7231bb5b4fa5f093fc71dd24bd1dec1a2ff1c043aa9d5ed62583df4bb122d7451c2a58e231ef7313c2a7c86257f3d4f10ad0b62fc200046
-
SSDEEP
384:sIlIcKcnwWzTAhGLp/a7JpmI7Koqerh5PLt4x/g8my5guLZ:wkmGc2gQ5xLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C4A5E01-8612-11EF-88C1-C26A93CEF43F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000bc3b6f5c51af1ae313ae143c1c7291224ed4bbb8682166009fcb759300707728000000000e800000000200002000000080fa809724d702001da65772569e4619abe6e98edf1091ce236d734ab598291120000000f4c3784eee8a7e67a3d67f234c7e108a186838ee36eeb2c2dd613f859d33c14f400000004dc1a716bdb6f01ae15dd2192294f207130ab89467cfe3bc92dce3ec3c7e141a9cfe9202bbb2236472c6a14e131944ea97e37adbf3420fb20c3198d9adf5947d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434621836" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00509771f1adb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000009e7469b567f7b15c664c5c15add2c4858720404ab0c62bc51bf5b2ee58e826dc000000000e8000000002000020000000cd28a7f02fb8c53b57103df183e82f438b8b0db30521a5dd6589df122bd717579000000079b393d6048f71259b7b08437aeeae3fbb94ea8eee622815c89eaf6562de74c5c6b2da04863d108e0729dae204b56b9562f148d82cb9cff8a6df1fdcfb05e70e3ec8aa6a9186089cd27e168ced0030ef57886370f957e6189eefa32a00e7270f3cc321b5121f72eca257fd9943ee831f25fa5b8cd3f34dd08258de4c5c76d04b710c46c51a2268b02fa027b0f2f3beb940000000ee3b3762fd0ca9c6c4a32e73036ca50847e2f7dcb29c1057f7f1393220150d923ad691e882a44867d87ef77b8c89308441c9de0a0aef8ecf7df172522d25c7cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2136 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2136 iexplore.exe 2136 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2384 2136 iexplore.exe 30 PID 2136 wrote to memory of 2384 2136 iexplore.exe 30 PID 2136 wrote to memory of 2384 2136 iexplore.exe 30 PID 2136 wrote to memory of 2384 2136 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27dbe21b336d41e50a812910025079b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50186b58eda880170b53f79c3b78b5f1b
SHA1717cf2967065d8376e0feee3dd373cae77d87774
SHA25696c45e2f37d8a511af6dab62bc18a3fd0230cc56d2f602c0d88ed60607d2c775
SHA512dc0ac6494781fa957a92900fe2b20493825d17728c67d606d9354681581d369ca694a181ac53e485bcc1f0b530162393671ca8a41e3339e2072bac821a891fb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d713d907d08e4310f2d6465b975f3478
SHA1187b7e6a8fd19c704e38f379148d11c1dfa586db
SHA2561be304ace18fe4eb0bb5c1ed3887510b1a349c78979df97e5633de9d304646d8
SHA512b846921f238a56415f685ae212cebcb64124521b816012946a5208d27a8a45b2fc6d2c3a38c134b34b91da9afd3a910e6a002c4caf95a4ca299a1bade23ef978
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bf6a5828fd6c785dbbde1abcecbf53b
SHA1fa45c01c17707409e8e2162770baff292a92aa17
SHA256d38c15a6b1e84e537b525c1c6f282fbfa41ab26477af2b3ddd144cc3ddd85751
SHA512c0d51507634bd8c12988489647ce0e8b7ad6f193d8eff8b4a710fb765e9f8d83456708fbce3b9e390f1c6889e56cca769585de62cc85876f6b82a1e80247339b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a94ec119fd188f571e1b5df2d03ccfe
SHA1abb71186a22a46f41c6f8796621be968b760ee06
SHA2563b431884ed0128ff83fbe9b5704ce9e82931e5b7233e46cd088c3eb912bc6ba8
SHA51221b24bf2ce82ac83196f50fe9334a90831c50819faeb5813c218c4fb5fb9bc4c50ee4068acfdb14a3ac5b7f22122c1bb94a21a03be564311976899883069f75a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55493c63ee8b0acde2edf23fd15ce57cb
SHA1e969356535817c047c77307d35df15d60817e32b
SHA256cfede72804d639de2c8036666ac2aaf7e8a253d81318e2c398d5b6d595176609
SHA5122457feed47ff729869f252d4993c1a353ad4bb2288dd52bfea93957c438bd9594d2f44bb0de24860a5cd3585671899df2a711affc4ee4ea0767f1909c0148ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa602ac43f1915ca2590bb95de86a79c
SHA1dc3978f1d581aa7db788053c664eac29fce78cdb
SHA256155e876c623a102ad14b100f42dd335a80e80fd508a012baef3cc8ac484caf17
SHA51275ade310288b23df543b98f8b1eb2afd871eb96c74d85613affdd4d04c471683c802ab7c7d423463613d5783be7fb6bb689d50b671797e4880d115be74780eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1d976f0824a178f0f76553eac7a11bb
SHA1e0847d28a417c8b91852afd07a0f4e43a01cf928
SHA256f7ab07e857fe6012c42e596b1c94400007af345ddd699b3b5487cfced0f92d21
SHA51290e464103f27405af9d240f47ef7a939402a201c27001769506c719fb57b0e3c074fdcc10ee853b58f58b40f818fe49f7cde929c03ed7ed861b93a8159b05336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578a6be43c081ee8910a2279b04249aab
SHA1135aee5f3d0b0581897c3918011df3dd58c2f259
SHA2565ec6a76f7eacc9d25d4d89e26d227b9d6fe6169b19cd48d734985877b8a4cd8a
SHA5121622dd1e357549a35dc9c623283a23f03ef945ad951f24ab98be0a350e9d917613ad504ee6ac81c8c0a9655cc4b1ec9783d5ec2b4bc53f671351b5628c9d6aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58064b774ce767f2f573cf0b8a4a7bdfc
SHA104b166c482409161c90a580880ee6c84762e0a4c
SHA256c534e2c643025b38deb0cc5bd381dd66aaf9aadb664deaeea6208ed90a93371c
SHA512389db4a61fca3c24455e227337a57e004e0425469615694245edc56a3f7d922f58469165222ebdfc12a49e390e4fa3951a86b04e5c17c1d0489d6d6e3ea26a27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc46f2f8cd00fc5f883239bfea6fc177
SHA12847c55fcf87ee9dc095e83b270ae1a3d8a59d6b
SHA2566ccb574f22a2118101837e996d915cba081ea0131e144168a5adc8dc629fd1ef
SHA5128808845e629c54df1213c6a7d3ca775e8c07dd14525df57502c68259ff6d8a509c9c92a23268e0a3a0d58ec558b79e3c0043568918cfd004f7d5009bcbcce2f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd8a7f3072895066e8a476d1ee45e3be
SHA1cb910eaddad9025cf2368675a3b8dc8e6a5611e0
SHA256984a589e72f8e59bff93d98ed9459fc7dd9aa330f6fbfd59c4ada92b16d6820b
SHA512ca01198fbb1bbd0c414e9771add565ece6fb4268e29eb3933a016d4962d3dce20905e5196b91e32f97235cd2f0f24e17744eb86cda11b4474de1230f2fb85c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5153d8d6bba99aab893b88dd4d08d670f
SHA168d49d93715c5013a0a969e0ce385225b8d92ac6
SHA256f624dcdbed4c0a4652951a703a5ff34688e8d5914168d755f6554d128bf7b4c7
SHA512bf2037f1503e491b529569edf37ccc618ea6dd6272eac6b826519582e03379829542421e14bbe844a506fb746954dbdb65aeac31efcf96f2656af7c174939491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bed9a0b223763fea7be4300676561f97
SHA1cba94fff9b882438aa4897a8840c6e557db7ba11
SHA256f52bdec590a1af38cdf150e24fed6f5b2e70c4c6c8a895bbf112eaa780723e14
SHA512bc63912f02e307e6ed79466adbd9a6017106838a58fdcc841ee048a83d2ba3b3f334d44381565d1cc1419c0b4a6fd07b3de069f29a795981b6c1f01d991eec84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514d11584bc3cb52ea76bace1e7714fe2
SHA156e8adb783a97fa07d1b801b5efb36eb31f5d30c
SHA2562d288ad90f722319faf2fb74cf4da4a9b5f1f9189bd9418fecd559e6ec1bbe37
SHA512c43cfaebe0f9201899eea56aeecbc1be21c2490fbb28000fb5f62e734a74e2c9b58be7117777ed0c0b688b78342302ed00cd41c894676761150f6b223ed5e7f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5690ea45df6af4669da1cfc61cf66c4dd
SHA19aa813e4f04dae31e28e380953650e025192b269
SHA2565e69cfd85c4e63a653b7be5f0706adddb91c863afde17383bb71ce320aedd3e9
SHA512a3351f59e76cdb86a9c27b3346592c64b168d505f9eca0d413f8b482b52c08328f7ae72d6905a6e2d6fab9e7c0bd0c5dc70c998398796e92c5ad911755bab775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b719f7e1e5bbe037d9bccc703cba7cfb
SHA1a48f3e20bb1da7551092a2122303edc155f9d578
SHA256b852d42e0334c15d62cee8aed6bbad146ceffd21374cc17459ab002f465317b3
SHA512ecb59d53e3ace9ae46d419658db68e908616bd76aaec182683dbc6fc05e4cb4e86460e195dc9efa1c9662084c1dbd67f5858e238c3e22afa81ca865de66a523b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eb0ceebd48112cfc482c4bd93cd14be
SHA147f4713ba68e31dea707c95b7bae803204445d6e
SHA2562f717db38a8388d9acc729790c3a546b89347d007dd308dac78322787c95b9f5
SHA512f54f2f0e6b7333c473140de07c56bef8a91c36e682f42081f4e33dd28b64167732145aabb83395934a8ad37b041f429fae4a03b97df253c731e6bfdddfb9ec16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8878c00bbe34a7f3463a0361cad8037
SHA16adb75b0bbaf55663ddc3a255088a405af71e0c7
SHA256ea81a84a7f4ba321b4bd260b8e0d7405cafde1fae7477615ccc6d90a94a944a0
SHA5122ecc3704a901abb535cc3d4adcfea29e54887925f88b9047331f1577edc1669f3f9b69e710820a4af42f077314105bddaca6343528fa72534c8b13dd0cf7e152
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b