Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
28807973d9e72cde3df0bf4c3ff3d050_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28807973d9e72cde3df0bf4c3ff3d050_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
28807973d9e72cde3df0bf4c3ff3d050_JaffaCakes118.html
-
Size
20KB
-
MD5
28807973d9e72cde3df0bf4c3ff3d050
-
SHA1
227c0909d0d03ba301ed8ff661b90930f1e086c1
-
SHA256
6c9b9a4c0a5d86bd902705a2a8c7bb104214d1b5fb0ea2fe7b979de82725f258
-
SHA512
bd2084683551236eb1ffa29aa3335efa0b71a505190a0d5f9ea258c2443b3b019b588783181a3aa05a3185fb4a80d1e2f4d331d17b038a2aa939de7d8850a70e
-
SSDEEP
384:K+KKZUZ2XfT0/eU/hSo3S0Osd8Fru23L543O08gMWKX+Gk+eJNAeHmN9v+:qKCs02qhr6aL7ieHmN9v+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4030fc36291adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000fd9bcf16c2b94cf47c97bb92b6a7fa6c3e73af4dbd58415a58d35909366f606a000000000e8000000002000020000000c4d941f13d895d9e7919d3dcdb79bc5e0fb52632691c501bde835539746b057a900000000dff654ac31bd11a51752f6cb754510bc80aea4bf96932207ea66077eb4ae609bf97081f638d0c21548267066b2a1eed15886b14644170c46abbcbc78da437b26c3a232e1b36b31e627b190dc7e4582fd09517ec4310682daef41e226b20ab81e4369e60992b6257c573d48a009237d3ffcb69fc6296f1ea730807297d748cf767565e3250500d1fcc07364d9764fd6d40000000ac86a96bfa9df8e4216bd511f9e790a2b9f3565d05589ab31b6b61ba5dbc5d563eb736115e5c59f664ac2d8d8ca5eb4478950f0b6eee74c72fc6e89306077ee6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000d9092996e4b0780d9d61b1e9549c992357fa1f7081d4e822f5788927582603c5000000000e8000000002000020000000cfa51aa541811a19ac22cdd6c0b775e7d6442e2022cbc758c2349b4750e11ee4200000001885dec0d9cfd849ff9bd6d20cf6d0e2184e468ce36944ac572bd70cdaf771d1400000007acb5e45adef61680073b2db13ee4f4d8169773e103d867c886506e4bda27ed1585155f8c76c0f5f7e0adc8053842b92f5983bff1218e1a2875cfd766952da39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434626056" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F9FC071-861C-11EF-A094-FE6EB537C9A6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1416 iexplore.exe 1416 iexplore.exe 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE 1188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1416 wrote to memory of 1188 1416 iexplore.exe 31 PID 1416 wrote to memory of 1188 1416 iexplore.exe 31 PID 1416 wrote to memory of 1188 1416 iexplore.exe 31 PID 1416 wrote to memory of 1188 1416 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28807973d9e72cde3df0bf4c3ff3d050_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1416 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ecff0ce6208f1638ba102d66f2f4ce1
SHA1e899ce2a6221629a8be4d1ad598bda3e537c5ffe
SHA2568016e13c1af6f0878a905915a0b717cdf3d16072b3b5e2419e11eb7a85e4dd5c
SHA512bc5b600076246057b02261275fda929642b32f63c11835ea16943e60ceca3b44b979ee05e40cf38f9c656e169be58457d678a4f6755874a0b6b020372bd8bfcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553042b16641b98a8426ed8c129ba9eee
SHA1b6826f40d7ed7977977b69f9627ab94a2812e678
SHA25603d5ccf70a8b6d57fc06d2945001d67f862889d024023eee663251d560f3a786
SHA512c9d3e1ac7c5ec1ae8715daa4cbf8f87ed5eb8273158c58cdb418abd3d5964c56a7cb5c4abb4998556f6455515ecf46a1ff6dd30ceb0afa8f2a47bd9c69b94bab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c38da0bd3818642bd9220fadca99182
SHA1484a464fdfbbd1f2f9266c552678f0c5b391b452
SHA2567c89711e5bdc238f9e25ae896432e39cb76eec1fb955a9c68edb0f798af13403
SHA512fd18bbf491cf4178a21dd98c51421ce988539bf7acf6993a4c953c2957f65ed1c7f55454573929edbacd8d54a8c2051ae9545bbc45eec4a9178cb4d9e369812a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e89624f541a6028a820e140cd63f0793
SHA1302a94d6657597cc077c47d8934c14aab8c8d850
SHA25691050efeadb4cd4c9e848a5a799c6cb0c31f8824451c933e0715772d994cf1d8
SHA512b12da9c46d48a09596053a1c2094cd5bc597c328e441e2cf414ac13748b03cb32eae4d5e4b62a792916cb476f10055a903cba8b998af42d83f3fa730864daa9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bed930fa88770e663f251f98dda410f
SHA13362838831043eea0602fbf97e44e3cef12e7ffd
SHA2569cc16d4c73b4699a9721338f1f8c38a248c06eceafc1a0c3136cf6ffb1b5052f
SHA51277cca55c7c44b08d2edcd2402a60a16ed98cd5a064c813d56ef6c1ba6bb9b31875b675d987fdf1a81a89a2d8145ea3d0cad6c11abede42d864fa774be48eba88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509c6820d2260413209332a80284c189c
SHA14127d2090af8f30fcd37a9406d0bf6a09ab43e69
SHA2562db0f1c54bf039bd8f4ff53ef814b2efe084bbcb7bd35b343459c0c88b6fb256
SHA512e243c135302821b5082429906fd5ca9518876d85d3f13138ef3c8e96695e41c0160ec9129d2305cf3c95788a43f186e18c2025dd5214009cf78f668a8bb14b9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef321cbe3467c22ebbe60396f82d294b
SHA1c2b40da6d2f9adfa5f910b1a426cf0cb24f3acb5
SHA256252d184ef74c57cb6ae4ebf1641895ccf0f962ebf51c7a6b5462adfe20f845f0
SHA51204c83923e36de79fa043c0add4dfd93e67d6dde6d9bd8eadd552c29a2d081d86801ed802ba465f2f42e0db17a6a16a91a893fa8a567150fd7fc14977cec7face
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d88788bfd34c7aa18e076be80e4d317
SHA114b8eb682c7c7092097cfda216b0b7d059a9fe7b
SHA256375eb5bf8c2f30a43de9367318648a043d49a0d65a2f51f3dd2a67e91a2f3bb3
SHA512768f07a1802805eb72dfca6da55b36cd32ec300f4354db5bcd01c2c4f31af9f96c3f73f640afe4aeea273e1485c195aa3f57c8508f25406e680f962267b8b0da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb26b89a7e739c70acae0315aee03a5b
SHA1277b4a970b2d051b070775fdde7c20f0e9ccb82c
SHA256a159db940c1c670e09d4ec5b5970cd748828b246820dcab47e6713f67ca3991f
SHA512bcc44328bd43c53ff790927264796e7829228855e134a0f457c6ee98931f38e9e27517ab1d069ed58d58af42226eb6b89ffaeb7f2dfac6c73ee788fd44f605ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558caae7d234cea0f4555bf8cfbf79cb9
SHA1d25d2a2a1b60dde54a3796d419560244ea8ec0e5
SHA25635cf0a5bb21e2261e54867c244aa4aab1c307aa93afb3184835a3bef00b122c0
SHA5121cc04e58484031d02268bcafe7d1531f1c04a146c48a9b7c7489e711a9e73b4bca7d974eab140a7f4c19f37334ea30f49c1d78a72e735e38363a74f2ad0d786c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5016ea341e63b84a924244b74754b7c82
SHA1f09d759ca1164a5268d94e6a81dfe02d1e9c7b67
SHA256de0e22d2f322316e36abb92c813c531fc3f1ee68abf3b865f0eb13637790b86f
SHA5124b5949e4b9b0db1448ddb1c2a596921da44acc5aff6110c5627766026830071cb9be3cd4e58985e017fcd4310bd1b6e65f794acc65d87c17df9589f94fe00f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5020d07669a7085fb4b88c9ba7e1e4018
SHA1e16ca606f103b0ccbd44f6596131be870127b18d
SHA2566610f345d8842bd985b22b832311ba1a0bd2c01ff51db5d505c223ee095f8b32
SHA51200f00f83d58f6e5603c3d68d0376d400d53e8d8aa2616f769fba1c923286bebcb4277322d1006b16e88fa5b6df2cebea1f7c301496e3ad6c383f97612ed7e4c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c4e09e012f489772df04b35114c9005
SHA1caa95e1a22f8630b66e130f9c2076b3c499cf95f
SHA256c582ba88a56504a8de76e12f643eb22c400a6059c6d856353d14008f2c57ae27
SHA5120bae8750580c4bc3950ab64ef8dc42e4bc6e7cb1c0aad24f8eafa186bffe79e5841633bdb21c9cb7b49e4ed90e3332b33329b27bf25ed2671b633385fdc89747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545a5b3a2facb702eeda91e23b3af9dd0
SHA12e8630c1619122e1d9a9a7db300ef05f7924b90c
SHA256cc8fa7677a8722911966eba30e53a41d815e4e4cc4e93bc16c5136a96d8c489e
SHA51288655b29152de4e8f4f551438b1968b042d26aca09cbb3ee5094d3f3dd6432a531ff46c9973216f3c2bb5f4f3bc9322dba546efc336d1306240e53911630a25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54134c98ac167a37a375b09bf3dc2f474
SHA1177bbc21c483597db0c2b2657c9bcc9670613334
SHA256ff6e4ae39499248a0d633c517e07f4fabb63862bf9509046ee7b135ed686fa18
SHA512544c201b8f9e70cf00f798e0230bf2b616ce32779aeb3311567c4365856e0f0b7b46db334e7ccb99a6090ca9abf6b533152249ca2fcc75a8fd20befe5b54661e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c85619eec441af144dacedd7ac65640
SHA126aa35aee1c58b7867e487bb9420c483559b3afd
SHA25625010397f507313083b8a93a73a19da3da08f3c7650ed5ceda63ac2816337192
SHA512e3cf7921d5d3ff5117bd72a5dd20a06a66a6b75b5ef29d8d519faf2c2308d28cce1f6da5aef61e14a946fa3716db630aabf91f085822ed30f99c077d0a4ed0aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5834e3bf43d9e1bdb51ad4bbe179f6831
SHA179f39f64fee6671d383d81afa6fd76fdd8630e53
SHA25623e85a1e1fcf6d01d07d25da7b8c33acc629f1537676b0c51459e59e75c12ea5
SHA512db8ae2bbcec637997637fa19c39d0937fc3cdc81594ba7adf57b1499e24edd5d80f99e977aa9e4cdfba1a1a721bfc3e2bce9abd3954b12c71378c2075ef540c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2bd268672d5ea31ba4315a08b434d28
SHA14a7da33d055af8824cea89c8cb41f4d03e73c47d
SHA2560329cf409c57c6270c9f1221a61fee5b64e4efd96b91c8682fa1f6f7e5dfc77e
SHA512671422baad17998bb886d9a6c15037aecc6ddf079a0ba7dce33ab84bc4ab24a9ff844581b8969b89fcc963d86a04e2f4e426c4303bed2e119873809169f13f17
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b