Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
28d14245c44b7bf28893883c698eb8d2_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
28d14245c44b7bf28893883c698eb8d2_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
28d14245c44b7bf28893883c698eb8d2_JaffaCakes118.html
-
Size
53KB
-
MD5
28d14245c44b7bf28893883c698eb8d2
-
SHA1
f5a76ab2d6dec7e723afdf87f231aecd41f9a5e5
-
SHA256
62a00dbc9d4631aec0348d5947f7d4ceb76eabe233f1544097c32f3db2334683
-
SHA512
ae32a39c62de21e429a5455aee775ff345f7eaab1661cc8c8c73fbf0dc8d252c0c1794fb936e7e80a16f146ba71577890a3703dfec57ac68f70db3eb26bdec51
-
SSDEEP
1536:CkgUiIakTqGivi+PyUcrunlYj63Nj+q5VyvR0w2AzTICbbvo4/t9M/dNwIUTDmDt:CkgUiIakTqGivi+PyUcrunlYj63Nj+qD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1864CA21-8621-11EF-B5D6-4625F4E6DDF6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90fcb8ef2d1adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000da61b3a95ba6d64ba6f2d18f18d544ab00000000020000000000106600000001000020000000e0e05e54350ca9a765d8d9c37d6738321aecc2e662b18d490321d0e6cbf3adfa000000000e800000000200002000000055a575bc185e746905b9f475d5bb3ffd86ce2097fcc14c3d11f89922dc74f23f20000000f5f14fea40e84ebe032c01ae0e2ab1c15787f47e6af48606e036360d482b5c8a400000009338d36281ba411a2b80da7000cbaff70fa2d1e412713fc46a1da03828d6e634091d568106dd4d25dde0ecf1f259311ff989d37b411ecd25b76da7b56c819269 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434628091" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000da61b3a95ba6d64ba6f2d18f18d544ab00000000020000000000106600000001000020000000ec0220ab5f990c327491313790d4691d5699d918de2c400c0994912988fa6506000000000e80000000020000200000004f9dfbef23d405719521312f309ffc08c743dc9ac9002270f37f4f033112e3bd900000000e2a5d11eebcee77fd13a1d0b1f4a2a4a624e1489daf6b706398e595919e9fbc0e3481768a350cb649e8e11f0697807558a61ac8dd7e2ad07d6169ed564bd4d1c108b95cebcc61e67805114166757127f9cf09d6c3e0b520c8616452400c3767754ff4e6575304b53a935177471300e97f5abd7ac7e924164ac51d425dfc9891830cd085b02c8f1d4f041a901ffc670e40000000df52e5d9a9aaa2b68c37fd876467995735385989374782e2cbad4bb7342a9fdd1dcafc29e7c04f0a7c330a988334f886047befc7d9100b42f7b869f62a711c67 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 336 IEXPLORE.EXE 336 IEXPLORE.EXE 336 IEXPLORE.EXE 336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 336 2296 iexplore.exe 28 PID 2296 wrote to memory of 336 2296 iexplore.exe 28 PID 2296 wrote to memory of 336 2296 iexplore.exe 28 PID 2296 wrote to memory of 336 2296 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28d14245c44b7bf28893883c698eb8d2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f3db5450a667a12003bf7c40e0c355d
SHA1a1257dbb6b7e5cbed11ee0727af8e49aa224758c
SHA25619bafe53f46af888b33dda7ce898c39d48493ace2728925118caeef5def4f86d
SHA512b7b8f172865fe8f307efb134a52fd311c31e31b2122f9e7192b20e92a3e1739d0384081424286441db04c7dcdb847f857cf31aa920421407a01576fc77472bda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1d6fef4f6da2b706ea9b23853187a09
SHA18d8a2c054f82a4706ffbc391e2d2c97e5649c684
SHA256927c2a33cc47ce6b635f7bc9b172509e9dcd2fd08f2441a2623feaf1ef094a0b
SHA512c312b203c133c85ccddfbc4ecea3896d1c8263bc2f3983c85b3c78506a714ded75d6725aa0dd58c44cb8ed025467841d33682f5e477d3127e7c647e9c3cca7a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564f8a17e6cbf41e7ad92c5743bd981e6
SHA10337a3ca7f6cef81fc08ef4cdbce22323085a2f5
SHA2567fec1f52b0d36da0644147e435f74bb275db5e11f5f8af850dfccfb7d8bf3522
SHA512339ebcf802ea698b4d46b47a56915d58fdeb09a2f20f1f11b79959f4df4653e95541d6a83d84dfb43a1a2464dc18674c7baef1156d983a521a56aaeab07f7645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d01bdcee30fe3aecc60dc109df03b84
SHA15519388ed4da49e59e51f9bcb74a1d127a9d3ee6
SHA256fc80101bf197c8ae0425e14b98a6ae5ad757e7d8b39c66d871c38c2672995dc3
SHA51285bfa6edb9dd4c41a7c24b7d87738b7910e25d9f1b065e465499c494d18028b482f27caf96cf61800371f1e9e18683fd730e3bbbd27982444edac9e5fed7754c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fdb499166c4b2bfd0ed54b91db81536
SHA1c9cfc703a07e17324034756caf7c71e72440e9a1
SHA2561f75282c17001ca625e9f21762bb6330c0c85643b081819a17c712cb194e3283
SHA5127af6d90c72ed9a98abdb27d1f292d96e60c8aa1e71681655952d90b69e2923cdbbe238271517988d07031e5e847d184291204e57d3169edb51fca170cd2d797f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8b17d144f205fdca9c5b59a599cdebf
SHA17954ae635a755b65a820533c3d526bf743e4266e
SHA256e695780394c6f3851f537f79018f7eed66410a511c8e4f557f6bc05936462e76
SHA512806b8f66afb586f82bbd8904aaaa27b57d102a76fd0deeefed3e0424493d9f3f22b89c3fb68f7aa5ba5a56c9ff806bf25541927351652c80a619e56bcb003f89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590f2068dc70b5674a4e5703b940cc367
SHA19efe01d7a81b86e8704228493404ca2fa01d9aff
SHA256bdd754938f5e662acdadaad187b0d1faa81c280f8bf2a880caf93aac752ce076
SHA512cc13b50feb1facfd7814037634d6c00c52dfd8166fbb7e1b9da7b82d34f83b5d5e526d0615014754433eb2df4b196c3becf2de20b119cbc16572b31249ea20fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57107b9c582d4b7ce6038c4cb2e865409
SHA14d5e2d09a9f9f28dbf7f7e383224ff76af52d259
SHA2560e85dc46971219d9eb81db57305c03a12f942c93f3d980824ceda9e915a858af
SHA51291193d9f6c43f2fb02acf6bb65e96da354525b5334d2aff23564f3b8e379fbd525c13507e2740c29197a0ac543581431332461d8f59893c2ad36aa07bcf760b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5993dbd3b4615bc17189493962043bb
SHA12d4ae64b7c2ec582063f3b4c2897b441d237380d
SHA25626b5591bae5b32b798c80b414ba785c4756bd583188ea263d2a844e92dfbd251
SHA5126765dce7db772c2f6abb89c4d3c7088d3f622da5d624445ad51a35700aeaf267950c94771a5e5aed58eefc1b642ea524cc2925a33f0cb893af815b9042ca741b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea81e653dcc052fb9a523e79830af656
SHA10cee8e0a1a3915a93febbdb5a3113b800b971de0
SHA25642d9b6dc467d2111efe22b9f75205463a44dc81a2dbb2b2de7b7b4abbdb62e53
SHA5126924fcf19afafd6f829f59e9848f50ec6d362b67921c6a6617bbdd2e1e8c846213fc5e228d3a0ffc93c6f4cd3610fbd9129378b700090725bcc16904d6705bac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503841966fbd5602c28d536ff9ab41c0a
SHA1b675e02261af8ddc633e8f727ca751eea36a9d1f
SHA256e778a2e105bb6892f2c00528208fb4ba68bcf3bd7ed4de167dcf15f81c6a93a6
SHA51295c24fcf11f1de850334974d28f29215ed57de076ca02842f438803789b67d851a9bf3ea26d63c118b9a3ef3e305d5a5d7edc2d8271826042858dab988b33a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbe32442a963c7f62dc7eb20d5f7050c
SHA1f5216ac990a5457515a65b1838c2f302898fea94
SHA256b995dc67ef7d5b21bae3a1bfc6ff9a1659e30b8f656c3ab39bf63172ba93875c
SHA5121229779f9b4a94006566a10975c049c0a21417ebb41e6b20f6552bfcc6cb36b441b99c47f444b278d9c00d9e460a139c4ae1014dadd0696b42d84353aa6456ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52477d0159854a483c690a6aa2c75bef9
SHA1cae5520e7c049bb653b3bbc7bf32ac4c705290a0
SHA256a8ea89fd009f146b09d933cefec13d13ef57d4b3f4bd285923d529753ab61422
SHA51290d9bd10bfa58bdc10bab402461ff7ac7964a73dfbb5f989bc9a53d51e4d0700eface0efed5228bd1bbf8b016479344b19e30835fff6ce237561c442dc1326a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569a76c5fcdda52955816fdca4acf9efb
SHA112f5b65b2630f893f7e7e8631fb08424addf13f5
SHA256d237d90b242f3e168261731de095d23a4571f9c2fae3c1aea7e6c5608fea7367
SHA512f36c03fdc10ecf0feb06808c6a2103d98e1c768b4a3e64c195cb1bee4a064f7aa7744c442c4344e0c5975f772fb0bf8fa9930621d292a70cb840f734c52300c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c65a07cb5689fe7631e4443c115c0ac8
SHA1ca4cd90e3271e4f77a9b30985af42cb210c9d7de
SHA256c47dcb38e5c153427f9627e343ba29235d4d418a90861c0f0034afc2d06e692d
SHA5120eb214fcb929c786163994646a09cf99aaa078c5b6be24fbeb0de4332250bd756ba09bbec0814d81308884e802c7043e8eb469824562ad19b78f1040bdd3bc40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed33e12a77916d5d05d150a00d684888
SHA1cf39991c6fa9a26c87f962c1fc9efbac1a955228
SHA2560b51e10f9bb5c6b986bc8a2a741e5d60d8d1434d1c2e17282cd2cc725a00a455
SHA51282bdf9c2bbb486d6ca3b30779c175860cdde5980e6bfbc7d23ad9ed0ebc603146ec51093d71d3df4f4a4c02c39b244a7630106b8aaf36a20fdcfcbe329d61c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7cce120262b6768d7ff3168ceff70c7
SHA1ec23930adbcbda8c3d2fa38e894a8d473be58e97
SHA256f4a139efc95207893d7dcdbd3e8f403e60f5bf97af0c7d9f9ea4ffdc56f9d1a8
SHA51287fbb515408cf9704ca665d585387e70c32a824d3c99ce4bbc5e67a70e72701750039b8e47eedc888d84156c7d4f7968b5bb5d49797bb3fca8c4ca4fbc6de5be
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\wt-logo[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b