Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
28a4e236ce465b46a6c3eab1a0615702_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
28a4e236ce465b46a6c3eab1a0615702_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
28a4e236ce465b46a6c3eab1a0615702_JaffaCakes118.html
-
Size
53KB
-
MD5
28a4e236ce465b46a6c3eab1a0615702
-
SHA1
acf2c610064d754385014b68a7eecd7b630683ca
-
SHA256
7ebaec8b445c00627c1b25594deae9505733846487789e748cab6b1a1d0b2534
-
SHA512
1af5cfa5949c5eb0c3192e123bfc67724e81a5b68ab811410fb15e8b9547b5a0f4e81abb96e70dcf4cbb00dbacf24e7853d8e0e90eaa8be8d23cd26925432c7e
-
SSDEEP
1536:CkgUiIakTqGivi+PyUIrunlYW63Nj+q5VyvR0w2AzTICbbCov/t9M/dNwIUTDmDA:CkgUiIakTqGivi+PyUIrunlYW63Nj+qw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DE79E11-8620-11EF-9CBD-4625F4E6DDF6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003132192ac04e5a49a8ae8f32bdf5b527000000000200000000001066000000010000200000004b9ffc8072df752090de96b086808fa8aa10b1ea970c6c8d50711661ca597d6b000000000e8000000002000020000000ecf06fed263d203b9b2934bdf061d45732a99b03d8eb9d49318e3a7ed22d3c112000000088e48c5daf750fcdd13f5f20e9070ba4a7f98a80271df6d3427580166805de50400000006122e142d6bb5a5a31d5ecdf5c0290316af3ad2e204be7e7f160294d66124a8384cbf9ce2a45f0fbe27d3d8d10065116a88aef1a9cb01a662a0a653f64252372 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308baf432d1adb01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434627799" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003132192ac04e5a49a8ae8f32bdf5b5270000000002000000000010660000000100002000000014dbd1fc2dedeffc6af805b220d13c72e6ca4fa89323a5d93663ea3c54e46adf000000000e8000000002000020000000c6231d1520b8685087de492aac2d5df4eab1f86a93e99f0449bc92d80db650b890000000609953bf7051a6da726bd5035ab39b388e9557487c194482e70027cb10d83b7b638ec5c87a0d094252ff2d2671c21f5283fbb34e73586607e8aa37c1646d32f2e0111bfefdad51f313ad6e09d161666791a03362f4b5820594c1e88f7bbfc391db637bce77b261e0212fd623e2910f7a88bb31cd96430599e69354026e638f4f05f25f0ce4495d9f3e57fab6ac705e5140000000400c93b34071d9ddf970434eb7ebfc4b58f2ec1ee5f1a21f459aeb347e176dbb9571bf3d8b10c0e6797b697fd155fadd0ec865144c96b513d169d92eb632a05f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1628 iexplore.exe 1628 iexplore.exe 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1412 1628 iexplore.exe 30 PID 1628 wrote to memory of 1412 1628 iexplore.exe 30 PID 1628 wrote to memory of 1412 1628 iexplore.exe 30 PID 1628 wrote to memory of 1412 1628 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28a4e236ce465b46a6c3eab1a0615702_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d8ca3acb7b08e8ddc6cc8f8449738e3
SHA12cbbf1bba598359ab2138ee584b84a9d453890fd
SHA256e8c3e2dfb7fa082ed1bc426870bd11d5759778976e0795658ebe1bbe23f97e7d
SHA5124118fd6d27e5a1216f7ebad3d0a180f4098394602997c3a292cee7e8deff054582317c049e4f4bb7f86dbf70d3139cdc1c1cf2bc1d4b097b335260ec9dcf6401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d81abbaa31c68dbf166ffb0d175029b
SHA158a01ff0a977f89609acca71926e743e6f807bcf
SHA25656d82ed861909319837061b136e88d805cf656a95b0f77b74f5cabf5a81429bb
SHA512647bbf8409c270171f92294f9d81e95e7dcd5a56d8b58315162775f63311743c07732c487dd9352b1c82e0ec1972316e735e9bea24cb18f5b8db4c9d91f5ebae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5816941338d8917cbfb9d02e93b19346b
SHA1ccfe7fae69c61cbb95afa5ce742ba6af39b2aaee
SHA256dde3e32beb6701a92f7d5bc6879f0d19044ebb0ed4ff279865e97512fe7fb547
SHA51218756ce98004b82e91cb8fbb1d84c7f10c0e0152f3408faacb193e83ff0f184ec4ea69020b8f43f8a31975d05f06ec2614a81f9569222dd2f79e2f5a4a11af5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d41f619adfca5714cfd2d2ca166225b4
SHA13e834b6ab0d582305869545b5cec1afc6385ca91
SHA256004778bcc2e12b4329138eadcd57a87cf5efaa0bc4f72310f11c60c9f1dec38a
SHA512cbcd6fd83352b224d4391e9d8b1b1251db11cd217b497421889029e574818355fda0eadf8962b1359f360de2a5c3b4b6228d683e7955360ab50011afaf86ac43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fba38155a4a64c81ad2b37d529965ef6
SHA11621afbcda2fca11531e2563da8a86314c4cb90b
SHA256e20ba4b58be11cd2a1411ba2a6d2e903f63c97c1736eb695a9499fc3cda92f2a
SHA51211b660938ceaebc0692137ce3c1535edb85a6c570d28b9f810eb57c530c8034e1fc66b6143657661c6b093b85e9046a2d889685418e8383c9a19cc336b25c3c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef239231e1468af99b22cdb25310a011
SHA17328673612b80400aa491b50812e6da7dc275b00
SHA256beef200f24782a0e8487d93df19b4b7e237d25f280a761031d25c9c88ebf557c
SHA512d0ed4b3ce0ab43df8e7e1be6ec9c0331bcf95823836963f13203a929e9b1d1a8ec59104e901edecf4288e83bb3e9427e10ab774fb84e1cfd5af979a0de64b9ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cca2a484d2f5aadbeb2edabd2b448fcb
SHA1a1aae29c97710862daef9e7c0e32484e1b431d4f
SHA256b974b84bdcb24222ab8b3224890b0e33a7babaa99d8e6c26c8cdef450d8930c7
SHA51229759afb4a00057cc82ccc7523244a484536576f43cee2c8b59d2211f07dbce1bc58c465e3d4237f70343870e5c9c2fa5583163077a4fb04901a8ea31e5c7de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ede03210f78d99db8906a8e90d460991
SHA1920294f8e33d9cb9db517b362970d2a9c79def24
SHA25648ba673caf0e43ca11a564bf0890fb3cf51d5ed86a3b48fba11cc45662d9617b
SHA5129b91a126d78ed4a4f59dd8fab5e41a067b63e4fc0b2bc44a3db52786febfdca9e979545045397ca44cfe1ea51791eda044ba57b46eacae7be43b2a9f427b4b25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b03af19dba51e2fc7242d5f3fa3fa17
SHA127f898a625dd2a5c6d44d343977279b2fa53bd03
SHA25656647c4f99a68a86dc9ef64ae09f19ba63e3890e619464b8c947b7c7719c2ef3
SHA512387d128fbcb427720baf07bea3b8921bad82150cf1eb520bf0a176c59103c49b54ef7a1075b54839c148d70e9cc6f96a68eb36e47d91e53239f58b6bdeb21ea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58129865525f1e244b88660a981a628a8
SHA1885842105b1c7581a82f50e40e65c8c0a9075d41
SHA2563a0ff5cf43bccbac27daa5067703528024c0ffab2c1a71e92fa380c753c73e55
SHA512091bb116a709aeb0632689ccd1bb45418a8eb597650bb9cf8f4de972ff0d1c495427d03d1394e6d8d5ae6a9defdcd8957888305c5a720d1f2b2b1100b8508b41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dac7306498ee8c8a314f138815f1ae1d
SHA1fa3db6e91cf2aef29f1700a7cc8e26d5f71a9cc5
SHA2565b90f0479e4f235e594fe665eaca518ac57e07a0cf727aa9be8551d53e9943c3
SHA5127699f100e32848bc79ffdb6c11d5838d90a194f7bca6ef0f7121c7bad7559c84e16839b26d6f61775e58ca88ca308130feab71bfcc54b4bd40fff685da1c4a61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e28b20f35fe1b6f9bfef49bd67fdc72
SHA10d0e296fdfc3c20243fd5426b36f364788bf5f8c
SHA2560d22fb80d071dac7d268071857fcb90d656b7beff557317a098cd1e1e9ee777a
SHA51231bf7a71b75dd686717fb90b92d60b167b241c37d552c3451c3b73ff34e40c1fbd5333870215d63d5c4d096150f6b59859ae2e09c9b7df36c24a615f6b8a30a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5150ccf604d643fa589507469ba5f0c7c
SHA1245fbed69f008f571d2b03eeb81e490cc50d7a59
SHA256f35a3e048b4532fa97fbaf7c59ca846977cfaa2df302658d480989b35ea3a054
SHA51201e7d27650f9d7494d6de45134db3801a7d8569c324ee910d8aa6c2ceb77b73b35fe87ef11d36c96d2cf520d7c4dfe3f43e18e58a31e69fa3187c661f4d9f99d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\upshrink[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b