Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
2cd940b12e43251fa10e18cbdec02578_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2cd940b12e43251fa10e18cbdec02578_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2cd940b12e43251fa10e18cbdec02578_JaffaCakes118.html
-
Size
58KB
-
MD5
2cd940b12e43251fa10e18cbdec02578
-
SHA1
196731fce29b5f76a26b3989fe3a725d3cc3e67e
-
SHA256
7aaa6a22c5a89d6bd1830bcf8d35ff53aa44f8702ba9cd9f8c691ec82121aa64
-
SHA512
adbac861e096bf27c620189cdf77655839509e4f7ddee0785fed1516af9a7455183e70982c5d4ddbfd7811bf5f88fd8fb6773bd737b82f495bb2ed65d7af1cda
-
SSDEEP
1536:gQZBCCOde0IxCN3SRf6fcf4f6fzfEfifFfhfzfTfXfkfcfAfRfXWfVfQfUfpfofF:gk2w0IxXi0gi7MKN5rrPsEYJO9IcRgpL
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000b4b38329424361e2f99b603344273347aacd2407e0bceb9c24e7e0985a73e1d0000000000e8000000002000020000000cf631ad176f37a2018135d3bc772cb90b4ab1774d3c53e3490816cfcdf9ee60c90000000d08aa956f557a67edd1b4540eebc13ef0100e14c6d203496839aea73e2904d47e8fa37e5059203fd6cb362e6f686d593c130bb5d1869c9e619552cc5964cb5aae2aa066b9511a358bc5dc6b0229b3ff19bf69dc32482a1f347ebd3f7811aaa8ca73f57e93c1979565a0f2ba7edf9797f54efd4e2b72f93f20a86377694f3fd2dd24e4a7988141c022ede42b05e745fc940000000ee8709bcf2ace12077705be391e17a0f9e3c4fc77437e6dcae67e7e18a31c0faaf9b4b5f5a982290357d2c94cd545f71027a4ea293673691e8a5e9a9b23a5cfe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEED4CA1-8668-11EF-833B-EE9D5ADBD8E3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f006cbd5751adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434658975" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000409c1b3776c05730e5ee6d66d12e2e667d0220cf6f037c107fd354ef5bf43fae000000000e80000000020000200000007033006c153f566aea68b03db09965adebdfdce36e36f3c83f7e5e81c1785077200000007a0f7e5bc6ca064c7bbab721f5bc61c1694c3a705ce27d2c4680bfe93cf7747a400000003e64c30439a3baaba5b32c06e0af2ef5b151b3d3ba9de6158104989e61133c750d19a5b9443aec706975bf5a04daceaf6f88e66203e381b5a0ef5111896526b7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2196 2216 iexplore.exe 30 PID 2216 wrote to memory of 2196 2216 iexplore.exe 30 PID 2216 wrote to memory of 2196 2216 iexplore.exe 30 PID 2216 wrote to memory of 2196 2216 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cd940b12e43251fa10e18cbdec02578_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c571f16babd548a055bc20502a4d1cc9
SHA1abbae4e1a1a63e9e91f07d25237a2990848dc4fa
SHA256419b515e6302b5a96b89d725599bf8e43ada1eff45c463e17769b6a4235336c7
SHA512cb7dd7e8e2ad3693fa3298cde1af33543e54b17c6e6dcc0e0f016bb5fa89390ba1c5ed7646847fe5d83a4ea3b7be4f8397d7223952284e2e4f8dc48d6928d602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8534a4987d6c5cd4d3af5639856cbfd
SHA199fa98637828718c37ab135dd4e38013857046d3
SHA2562479cd41382c752c0a4b890c1089471c08cf8b0331961b59ec82fb249cc279a6
SHA512ad332b418d570fd52af638f8aeb30a900a46c088e25fbe19d30da3dc5a9426229db02f6edc4c9d72e04a0f2b900b14296187e444be94db6888b976951184e0c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52003d5c841bc9fd56ce93b1b75d7bff2
SHA1ca14aa99cd04269971ef58f307c1d92d74364331
SHA2565cf30e80e29835cf577b394c8b2f5950624ed7be73e249298437c28499d480f1
SHA512bc1799a8e10da0174dca88160c8cbc50ee7f215180385841e00045b862daf8bc0e0ff619e1e0d343e83494fc5101344f94e8e100e61471b84eb628df96b00bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5160c839f44d62f936f7586f42f5c5ca2
SHA18e40ebcdeccba56c217e7504b4f2bd27c86e1d86
SHA2566a5cbf8b263a8226f7855202697b6305b97d98d5a101b8820b8aeed2a5c7d2ef
SHA5121196bb36c9b4e2e640b790754d635955cff6fc8e2b8f07bba70c3b529f9d743c208ee67867ec26a90cae9c394491801feac635b38d055bc88b487dcec1143826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50add0bdd10e9800a54a1676204fd6324
SHA165c9aa28e1fe260ae27bdc924f44c2537f290f5a
SHA256ab3d1f7872569247ff3c4c7a1cd372875efbcf16e5d56bef2d5886e6abbc2c2d
SHA51241a022aab98e45810520c4358342bc0360ff3d6da389ce24feb60dc2bcc8c3f21487920d3bdc7919b413cee63c6654f903e69991b3552f344d9a1c0bf2621e9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527f44316190f6ba2aa977b39a0f7e135
SHA1fc3eb17e89c4b2851ccfedd7257034e35d7245c0
SHA25654d49861af0bb5c63207acb5586ef2645179693186b856b5698e515e30ea2cc1
SHA51202ba5730202085563c012d7b11c6c39434b4893eb867555c9732c68a715b1ef0be07d3eb45e74659929112075b244a1a83db7f9cca65f5da6a543fbabdbbbdcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593b343e3a339875ed5690cee864b4658
SHA1edf44c99fec7a2b379eb99ea3a49616eec4d8e5a
SHA256f1e1a28533da975d6e8d567df67a43364c930aa51e3fa760e3f889c4a7785c59
SHA512c642acaa630c033ed8af372c7038d1ef6722da966a98268dd0a572df6027ea8934dbcec3a2062e23d78f4eb89614cc29447a783c7f4f19a072b6ee60981a6df4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d81fb0fa6e51215de9305667daa3f3fb
SHA15de6173d21d343c523e9a1ff37a9f4828c20abe0
SHA2564c84dc7e01f11b9c57a52870badc4dd79de3bbf2cf494448b454dc1c4816a1f5
SHA512094dda31b44e370843615b1e19d2b9aeac0240e4be2a588c168efb168de780f6e850f565625ab644f7272ff4f8d159a87f0d2240874f8fa6f1b312179defc62a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a973bf5e6a768efe95501e762e3770da
SHA18c1b3566bd1fe708626fd3701d544e774958a48f
SHA2569e8740c04748bd1a43327b00659d1759258458d65b4486ce4308962915a0f32e
SHA5124cf4e720254bcee6733852f5b29fc62ce51c2d80e2f2d783e308d2473419bcef83044bb197b8b319aa9f983c79bdd2bbebc15452cf2d07b08ec3c0ee16bb8145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD503810b4c2b4b7f81e8a730db128df7bb
SHA1b7d3d0c79e27b63e77c7a497bceef82c57dbc052
SHA256315cc6287509f00724a319797ed831be7fa0e04fd09970107820c4c525bd7a81
SHA5127ed4e031162c66164708de9747459c52c1c136a508494ee0a1feb0456435d4f22149298d23a9cfd2bc5e55544fdf41fab0998b0ccd404267ab39f679d6c648f3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b