Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
2fca0a3a983833d52f90bd60f96841dc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fca0a3a983833d52f90bd60f96841dc_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2fca0a3a983833d52f90bd60f96841dc_JaffaCakes118.html
-
Size
9KB
-
MD5
2fca0a3a983833d52f90bd60f96841dc
-
SHA1
4922f9fbd5e4bd82424465670bb7ead7f9472d59
-
SHA256
4f557744b3145aff852692d30c0ec0d5e275cff51c9e381d8641f1e99b8fc7b1
-
SHA512
24e148a3ac544d320b93953b2c2bf39b58b6caa62a858e3de40ec7a03c75455b9e3d1faca2d029d48fb1a3139f784d9e87f23c64b76b2c2dd00e2a65863320d3
-
SSDEEP
192:MjifTAbzGx6pGLNGUl6WGWAGUFG4K6F0afMiTbbvQbTZ:7UbG666IEKk040B
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c74b36aa1adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000869d9bd9850d4e428f40170c06e7089800000000020000000000106600000001000020000000241e74a3d61359a46adaee587ac9cb710e1c6ec1dc8b680d140037f3e58f08de000000000e80000000020000200000007f61f0a16affcc97dac729d089c42ac429ac839926bd43b3f8f6542791fc184090000000ea30d88dd3ab216599f78a0bd3df9603f1b4c2da4e62a3e068c445d9245b5c633d467f6985a035da13787a1da9fcdfa8ac349a6dcaffc92ad8777a912e073c663f9af286371ea7b173c53ff67757b9f7e9d1bd72136481d5a41a959d542444483b70af096f70c9045ae7763379c8866a9e64d9d463c5e77706ecc7f4a9a9d793b3175d056c443c7a5927ea33ae10ca23400000004f0a680e62b8bd9bd420117b5c1daef5352ae0f932a9349baf2f2201cb2af6a47f69607e115575a8bff45f3dd488d902cc2ead835ee791720089f1b128d79be8 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000869d9bd9850d4e428f40170c06e7089800000000020000000000106600000001000020000000b7785a109a87a470beadab2e7930366b7eb51930c6eaa9650347b2ff15f7fd97000000000e80000000020000200000003fdd015d91899a320d0c9d5885c2919616e535b0710bd4f6e67fdbeb1663eac2200000001db4cf73965e770ae23d6e52b9edeced83a47383f7a3c3dee888147c9fd8ca3c40000000521eca39c2bbba6eb313bcbda689fc7da84d292c20c1d320d735dc9342ce4442578ac4477a9374ab4cdfb645a8a120e882ba8d58d651e13e5c29acf8859ca389 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434681463" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60220B31-869D-11EF-B33F-CE9644F3BBBD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2276 1976 iexplore.exe 31 PID 1976 wrote to memory of 2276 1976 iexplore.exe 31 PID 1976 wrote to memory of 2276 1976 iexplore.exe 31 PID 1976 wrote to memory of 2276 1976 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fca0a3a983833d52f90bd60f96841dc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573b2ce920ba0cccd19f04e8e13d0b4f8
SHA1c9b51be63eba8c119759f361b9e5d93976fd1380
SHA256f677da3a5997c3c46b10d60737168cb88a1dcf3cd008998fd6c7bf1021f2cf10
SHA512d3b57c73ea8c4e0a21ac10ab0dbf81ff7d553cee153d0868c6e428af5e28620ea4e0051076788ae1d99481bc00b3976b4e0de0879bc533f65da6646911157fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b58855ed54d8cbf2050e963a3a9f8a48
SHA1dad905b779d916b15246102270516b66958a9cd0
SHA2562c6c78cb1e8e581e27f488edb6da3e9417137528b255a6fdf4f6e04aea14c24a
SHA5126b6ef00fd3b9c2476ff678a5f35a6fd291533956c4d74902621739431cce0667214f4bc346939db994fd88cc0083a64b1b40687b17f8ef2225c8c097eb3c826b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58306a56765701e0d92dae98925e6c395
SHA1cbfe8ff56a343ab697274a1f8ae0958e7de73127
SHA256cc2085cbcc3df4f40ff7140a451128c5570d01699a916c2c44b59ec66e5991d7
SHA51210b55561404100e5497651ba1e8deff48aa35f919e3149cc7fd2f4d59a1c1a2a70089fcda06d18cc453e7ecc1ac09c18d12fa4d565cf25315dcf2d1d4a8f4bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5133a7185ef2b7b99d8b04bc89817cbff
SHA1a4b70abe331b0fed5d0b2c421dab17d04bfd40d8
SHA256bfa4a5d936e14f877b55f3c77fd4e0f409cb9d1c2223a8a95ef21ed5e3e6ea6c
SHA51272927b370e487ae69a835a1d02baa4b76be143519552921be799129d60533ee0ba2eae3450676ea1b37d78a8507fb8e05eeedfdc1b098b3f965f59dfe98ab087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563ced6d65ab547c13b341e8defc710ac
SHA10754a0ae2740e810958e85604fa2c641d163719e
SHA256490ae8ab3b7ad24622123521934336de490d4bdff24308273de0e9f29e5d351f
SHA512753a7bcd8d22dda6db8860e33a7fff95ce3089acc07d420a9be688705403b94aab4f57459e5cd7c75627de139d08018a243a9b2b58156f4c43e0d28d9d669b4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cae4a3707c94fe1a85e68702f995da1
SHA12eac9ecc7a3284b103b63da38d3de0632a3fbeea
SHA256a19266e483ba7794e84bae6bd1439105e98ab2c21f16547d8fc0df465eac18fa
SHA512c8fd3b1d68ac959bd4d07a98dcc622fe7678ba4e8ac8f51d48e7e1947d8f9527ac9029effa93d517b07bed604f7a0c47c2f9aa19b60f7bd59f78da13a46c8a00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c10cebaa6a58b7fd33e8513b45d0c01
SHA1c44634447372c46a9561653e7399203b78d068c8
SHA25661b52cd39d5315f8a420c842ce2462800994e897f1c6f9c56ec8fe7f12904958
SHA512264b38d3e9f1d8fe26aa488a898520847ee349b4d08f282b458ef2c9036dc187cb9fe320d3fc24d22cdd68192028d585781dd2f970cdeeafe54d6d0133879262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aea18c242d16b0240ed497a9a9bd06f3
SHA13d99be7539c57652d5b97c009443042e840ab02e
SHA25663bfdd9e0f1899df449c36e4df219cda39b6c95e7000b5218d7d0509de433f68
SHA5120054eeb1df156f8dbdeb617c503387fcfde298164d62c451cd263b05931f45ea4786a93238222da4a9fee25ceb805e93209c9ef7fc70546e545e127380a616ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523fcb0dfccbfe9a9ad5d22dbc2080c50
SHA1ce658ada945e53d977c72473af68ea5ec7ba87b5
SHA25653e4e3cddb7676d2417675f45a20081e1c446947bacdd4321a0938899553dfd6
SHA51233d86fed8f227f27a240871b79c82132b8ba1e75365bbf2d184a7faeb0faab84086a18f9b60fa89740eb7037f6a9204e1cc186c6e45b083ac64354a5831b393b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daf82a03b60589398dc186e4eeee2790
SHA13a550a120d4ca418fa7c25fff0d68d6638bbe0c9
SHA256097169d6252630b2005e829457253462b6eb69e94b1f61f5dcd8cdf4744f9285
SHA51291a05ed2f74ba73a367897f4bc00f10206dc2e1d57d4d65623654f3e9f2e578380596c64adfa0f9e84e578d051d9ddb276a57a854f141d13840367b3c93411c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1bae38437dce1ac948468c29604d62c
SHA1ea6e0dbba4720c4fb971a7fb0b9e643a77c520f9
SHA2565a2c825c823bcbbdfb32bace9684c39fc7a202cab2abe40cc88b43a92a71f003
SHA512774194942f10e6453cf3c6878d2ceae1a6356384df6c272cd05d05be754508ac631eb7d7ac25bbfeae2c90beee00176b4574cbdfd029383b2bd2cd0d7c05e278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580cc75ad057277021b6868c5e370a8f9
SHA184ebff3b208a6b67c9ad30f573b6e3c9bd3e39f2
SHA2567e2f11b2a80269f88e7c59452445d04c779a4458d867421b624c56a8e2ba379b
SHA512d1ae9c49647c2845b577a6998bb8e41437d0b1aed64e4e5acec65d17cccfed1211acd5464b046d5b7337434cc3cff5d16774e066c096e465676f9db59a049edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53574ab0d2af212cac7a01a57e834cd0e
SHA167a00932649ab2ca9970b36a56c14c3051a457ac
SHA256cb2ae662c4c474f355444cabc4bd09659e814075d708d22c0953f80cfd73b846
SHA512214d4dfb81bba1e6ca582adc59dea8dcc3819c36560f0a87a052b586f86bc73686e149b3e22f18cd6db85a4688943e201920a95fc6f30d26b224f3b3428f03ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abffc8bd692707a9c2669eb43907cc1a
SHA1c7249b9ccd7f1d106efa35e33b2ae0fa43f5a118
SHA2566738b04528680ad07a9fc5ab091cc4634fce4446c2a04e8e56586a0145504e53
SHA512039f2150be393ce9c5cf4509755fe3e0a8e12ca2d841b83bd8c683e9fc47b9817730e99d882ba55a9d77b4f996f4025e10155e7619ee1ebb24934f60699f3a96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e4a7c647b06f41fb1e345ae622696a0
SHA1ab6a47498432236d226881de7b53577e6d2d2d95
SHA25649a404b566558367b13b8be2fdbf2306409df20de5e2028f8f39373e6b97b3fc
SHA5124b7b003baaca1e5a0bbf4da678b95230ee2c18572ad7726fc3c03e6712f7aac00f9da20f9f0150de0c78bb9a78e4254eae199de4f5f494e3b7213e50223b4d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5368a03c051a236b7a0c182d43005cb4d
SHA1145fbfa2f2aa2e4bb31cd383094effea886c7568
SHA2569ea923c4a9207292ee65d2962dcda331aa5a1e0872d9c0914d89535182bafbbf
SHA512e0bbaa870454e0e61c134900322c73131d8ce01dba337ed3dffbef20a56da704f97b9017573ff469c6a6f8203ee0530e6d06e6e321d870321506c5bbf87b5049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50af82c7f3c610e21cfaf67c3786973b1
SHA1b217babac8bd9e823d08a57c36eae9389af29431
SHA256ef4e5ec8f388c0e3def83bafa1038b84b9cc29186f72cbd320146ad012c5d32f
SHA51218b1ec640832c9ea9b4dc02cc6c50d30814a28513f5b39edf2064f168dc68cb2a5b7c78cd2a0b09c0ce722dc6145774900b3ad069196079a654d15d6a7e1711a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b