Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
31118d2bedd362e7895f5952736df653_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
31118d2bedd362e7895f5952736df653_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
31118d2bedd362e7895f5952736df653_JaffaCakes118.html
-
Size
141KB
-
MD5
31118d2bedd362e7895f5952736df653
-
SHA1
79f87babae0e2c4c69b9f1f8328848c4a038a978
-
SHA256
d83d70c48f0a4f4ee30210f3769a5f4fc7841f703ac02d2acd27757d1e104992
-
SHA512
b87b4a512cc7b9bafc41e9c1048a3903307ba023c495690ff55dabfbc7b2b58f2d2ae2441212cb8451742899dcd1e9721ffb9118de39d4a871ec4b4a79f510b0
-
SSDEEP
3072:S4+nlhjx7dyfkMY+BES09JXAnyrZalI+YQ:S4+lVx7osMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434742887" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{631C2B61-872C-11EF-A364-FA59FB4FA467} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1632 iexplore.exe 1632 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2548 1632 iexplore.exe 30 PID 1632 wrote to memory of 2548 1632 iexplore.exe 30 PID 1632 wrote to memory of 2548 1632 iexplore.exe 30 PID 1632 wrote to memory of 2548 1632 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31118d2bedd362e7895f5952736df653_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f262c3b4edd227f7ac0d63eaf26e022
SHA1741552bf7946f619734a30b24a032bdff9fb21ff
SHA2569af40866cec1f2dd82a36bec6aa0372ab07ac6fc8b33463a5a898f4e29f97558
SHA512a28b3b56b52268f63a0dca93e87667b65ba7874b5905ec97b8675b67586cc2c155fb9850a9192bf26a156b5e5765b83cdc7e0e09d0665a49a88db874a1c4bf41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ade2d4875dc2331896f254e30cc44bb
SHA1759fb78927aed7a842cf5db1b39a4fc4de68e2fb
SHA2565dd19f09c06cb9d94079b1edb03f8428d9ee703aa76b13fef1b039268c5f0eef
SHA5126b6d0c59f1ae63d8f339673a61f198124220cf71e05bf1196648494c48fe5b9792c7aad7d899f06325917b870a50ea42647a7b09a909b253fc3f098dec01b253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580ef7bf06f9cbd144a42a3a5ea571eda
SHA14c4f4f34e218698dc17b4e82d606be1b8bfa6633
SHA256b5e760aba47abc13a021434a9870209ae344e975557d28d65110476291345436
SHA51243056abdaf41f1628e30528c1c0ba68c2df4be003277bd1c8afbfafc734c58e7203ea50886e3a171fbee70b2a6dd1057b3f013171018e13e93b04d5ae2557f0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5518559286427f07ade6aa18d78e7b4ef
SHA1e9c73dc369e37daf56357c3fc40f8b2921e91ca7
SHA256052309edd1345f6200c03fb285cbad81c0853d631970f0946842e3d61c72c630
SHA512ed0f350aa4fbcabb063619c85e8492bdff8433087b3a77351839b3ecc2cc98b24b9bd8c4d4041525f2e3a38d49bc50b363772d729695586996f5dc2cf7b0d1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561f571e466ce98ee1d04bbd389a0d059
SHA12d462b1f1feb92720afdb26a1ce2d6b95aa19be6
SHA25638f6a8052cbb3b16c2c1ea2b1d6ea1e4edb31015aa515a9b3e525f75650f5f3d
SHA512852054a4cdb20a840bb12bcd20c9b25a851c6b7bb3a71fcd794a42e3ed8622f55a43bb3b6c1763ca2eaf061b9128d953b3f92db9254eb68a356696f044a8a61b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c9487e798fa7e5e371d3b86df360291
SHA1caf36de3f0a8d800141e1827d4da6dec1fea5801
SHA256a56b2a34e7b1ee64a60b99ab2d781f7b1627c340bcd971f0eedbbbf8e03cb9f7
SHA512cb732b09c23fe06d643f0136985e6a1dfd39c3b489364c34a635e7aaba774b624abf65c50b54c54c8edc6acefc9f7867ccded4f71f9242e4603cbeffaa2d2e24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c6e5d56e9de5e0af83f20c7d46d0ec6
SHA17f8da43276bc9051b6a74325106d0f62dc07c10c
SHA25645022430ee3dbb2f0be2dcafe505c9343d01271e61fcfb0d65ee77d0dfab5600
SHA51271a7312baa97aebfc1537b4f1bb18788a54bd9a764b701d077ba5c77897cb8742d05f85a538f50c922f427019c0a53177315c5c29d8adc3159840ef2f385304d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56300a6f1fb9d7dc8186638aa8b05dc6d
SHA1aaead09a3a74b053887d3ea4e0ee6d1fad7935ed
SHA256e1e5d86cab314610a01dd2847e9a2ce21aa48ed88d70afaca46f5b1f9a09a5be
SHA51200a359a54a6d6184dd67b2af0bc88d32700d97eacd053e59336737e8df964f76325cb8200bcb473c0dee4b53f5ae07bbad2d3fbe29bb63b8cd2f135dfe3ef5f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545a1008f86d18668efb5a1cb77b90659
SHA1e72f927030d1cbd7d3067635c131be3e50e1c08a
SHA2563cca6ff14a3e0da19cfa7cfd1fc7b094a0d5ffa300e1e05fc6fcb06ad632dd60
SHA51251451f240dfccd16882500bccb6cd28b44cb5c65a1f4d2234ac5390cef0a7cd2fdc2fd9a9407336968e36bdec142cb44628de3a34e332bbb99ac0be0c9a69543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaf0e68ce2fffa30048ef7e308afb9c5
SHA1f47f5fef932bd5afd2f22be48b4c31c9ac94f6d9
SHA256f226e74950ce82d3b1e943fac0f62b78bdf978caa5fd57e12d2f1fd8d1b5e676
SHA512e74cfa246789190543b10816ef4c22e3be19001846a0ea4526fbcf629b42b5876c36ae1159cdd74f4a9f5d4a7895adb99b1c67ed3b16ad8df089ab18a93b8a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578c2d373c957a7bd4d923bab33fd4dff
SHA12e49ccfffe9d28fcb64fec0da0dcc7cc67139ad3
SHA25677de9eb8fdf2a408e5dd6e6d0a768ac144f520ccd524f92b6fa32195cc7354b7
SHA5123edad553551112b5f11f6c1bf49f25c6f0d69381b0eb0643308c8db41137260d141a2feeeb071f019b952bbbd4813325836dca6deabb43357ad9ec54bcda7e88
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b