Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
3a5650b05236a202df50b4128caff3e3_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3a5650b05236a202df50b4128caff3e3_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3a5650b05236a202df50b4128caff3e3_JaffaCakes118.html
-
Size
226KB
-
MD5
3a5650b05236a202df50b4128caff3e3
-
SHA1
b1ed1e4c134ac04b3b8b179ca7880156366c78fe
-
SHA256
a1800455fd921ee36e819503e8da6e04c4fe7110244b7fc70c5a58b05a99f1f0
-
SHA512
1d5f837c7ee68c5f7602a55e37c36dce69510db6443ad1cdfe7876d7fe558a057097879ef1c71a6850bbd162f394c080633ab135d4333af04b377d4497d1951f
-
SSDEEP
3072:SZMyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SZxsMYod+X3oI+YLsMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e6df1bad1cdb01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434902611" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47446BD1-88A0-11EF-ABA3-46BBF83CD43C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000f81d77fa4367594b44edb90f95cc23eddb3c4f4ef0b7fb343074b850aa574b93000000000e800000000200002000000085acee79c65a46e73ec61e27930928d2113ff25dd5a0943da9b39a78f8b6b7ae20000000d0455e54c0744ffc568b7a4606f37b5ae966fe6eeab461920888f6feacab1264400000003d0073a90243ecf5438d56b3b2698976eb0bed8e8a12fc3e009408f8c7ca3c62dfb6e266c3fede0eda8bec3310a1f37852b4322af16cd9605ae7458ec7f1ca9b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000004d3cc99545aa9d990884796a1398356a3f5639e2b2444225e09c6f5654f87c66000000000e80000000020000200000007538fd5e0e0f3faf8bc3fab21f4127429558d77948fee4d760f995a6c2c72f9e900000004db4c9aa2307b1ef9867232b3f46057160f7471a86ed2d190e61f1b00284e22afe6f1beafc4f1cdd0877642b463b9d03b7f74fe5289736084942c1b84915710b42c2d8a3c3b30f525dda58ca5ac79170fa39614958adf7551314e4502a63a7ba6f58dca9ef1bac464bef3fc2c68f3961da21a39366771bf464f16d90a4485eb30d2f57ffaa36905531cb2482a780530e40000000e226c4e487307df4800488a828d487e8b024bd2c132dcb18c31239de206e7d261e194a7a5596f92be559d0c5cfe4d088ddbc9e27838d581593fe0c947b249f28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3064 2376 iexplore.exe 31 PID 2376 wrote to memory of 3064 2376 iexplore.exe 31 PID 2376 wrote to memory of 3064 2376 iexplore.exe 31 PID 2376 wrote to memory of 3064 2376 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a5650b05236a202df50b4128caff3e3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f39477c81ac72e96579ba52733233ab1
SHA12ee777cc492bafb6cb0101600d4fe7dd96f186f3
SHA25660b15a4c9805f8dd84ac58b15fc40d12c12a13b51214273e2a1b00d7768596bf
SHA5128a37cd4ee01cfc532dfddf1cc80a6771ea3fade38cdf19fe8a5329707fd0e4e767f45437fd4245e719053be0bc05dde9a1f76b221eb65c4f38a94ab86cee2a3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5536278314a4e18fb461b51f4524e4124
SHA18ec3dfc1c03be237ac22c043b6c47b670c6d223b
SHA2562a740ee5e2e67a7ca52532a0f368b8872204006fc0a7ef5948990b18c0120cf5
SHA512bcc78e3a48dab5a5f9df50926f12f02f3b27b364cc4606e53e3e0a627f5751230ec79bfe0e55051cd5d7cb87dbd90148cc1734611735cf2b846d553d1ae28800
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55991b1677c8556ac2bb3a7d82a6606b5
SHA1d368c0edab7e1b06c74bfdc342c3ef0dc5537f8e
SHA256e568ab96c00449458f33ccd0c2ded331583291845814c6d5f0d181a45034596a
SHA512e0f95f03dd7489cc0e871c8b566fc204660882d25898c2d006c5dc01072436614372c96cb3c55a0a2012251554e39ef4a3aafa4ae54216b97b6c770484159fe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a7db767eef0a90b0a1e1bf5e97e40bb
SHA1edf7def3b4acf498283b8ee14bf03bf2ee09ceac
SHA256792f2cefe4262c7e6226b52ac9be3db37c6a1664b8e53667b030bc15c4188bdf
SHA512226d149bf25c46b6cc9af929f24b900a063320a2137bbf6ac5f0e31a33560ef0d3a9eee434b6928be29ba84c2df14edf5b5029d7da5c60ae2715f4717268c5df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588783e8d010318bdb0b6cc61dd4539d8
SHA16c8d3fa9662e4adfc10e4389281f69391c7582d3
SHA2563bcf80a41f4e4cfe4651ba504b00cce8efda59b94dea9ebfaded0576e2c268d3
SHA5120f3849a9a18cffd4bb71bbdc5bb35030393d8493b5e6d094fec79d276c3932ac5291ae08c96e62056c4f4fc199f84cf12c50af42e84f44e7b926e8a9857ee83d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549b113d4075f86c8e2358a8b002d6ef3
SHA1951a60f5c4093203cfc69edaacb0d082482424f3
SHA2567adc64f30f13b1664f70d6a7ff2ccf73ca8dbf740930fea40abbd41665d7cbb3
SHA512233929c3572e7549893a0ded3d90decd50305e0072e297438a51a5b75a6af92e718d5877dc33948c56412380a5a345ce706a5202d63bd38efc5db121561b239f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce1667673a7554164710c755a5b057c3
SHA1f5f41f48a0e52bd3aab09ac8a31d30333c5858ee
SHA256410a9bbc379c5b2c9da121b3826013c3d4d34add71d2e9c5c0c11dac2d364ae2
SHA5129ccb4d5cb4e598ed8dc3effc73bbdf52d6388262faff388dc3bd51019e1ee4bc3c31f0f42ba8f35a139ba6c67bec9ecdf370b996f750c1e8c110e689742e57e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563daace442c8753eb4a9e99060bb4013
SHA1f295ef001be7e5fde067659ff0df1f0d8258bc5d
SHA256e2661aae208789b111107e58aec79fa98709bea50235478300c8e3b0cce4beff
SHA5122b12ca4c604957b6bf802325aeda29ed4b5772af11d1ed966e0e56d910358b11e7dfb9ae7db712117c17d2a11eb84bc809adee03ec3da980fa99ba56c262ffa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504defbb285a3a594d2450d7ee82fca87
SHA1afd1b6a0075004dc6ce27e269a21a372cc4374d7
SHA256e4076f6659c9af17e3cfbf1c17a96975b46c7441654a6a02e8f7b55819b473f7
SHA512fc10aa2eb6e3a006ab8c5e6aec8a05090e289bf1c6f2e3ff857885893cdc82228e85bc71fd472e13ce6e4819b1244dd84503b9801dccc9052fed0a88c736fea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515bfcdc705590b31b0a4d4a043bc9da2
SHA13cfbfb295916ef7ef264883b48b2d3a07d6377bd
SHA256d025b0896c7709534eed409871863b950a552977e356e789b5d916dd90287dc1
SHA5126923b954a36191bd5d2a22c6f07eaa767b6bf17912e1145b3f42725882d42c29d5992fa9f207727d5541abeee5f36211bfd6cda12632fe80dd5121c625118c89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7e47a960b10225ff73320df2babffeb
SHA1d9b6f4466c2f1e67b93fa0fff350d9c32927c4d6
SHA256656e7709066b331c00e4476d7f96188b73eeb4422e49d3f94bf41a0bd5fe4899
SHA5122eada42aca1f2d8a7d9f0fb7c52d1066ff7b3a5f39611779f821a83e26a475080f400e21f77ffa36b54ef5550dcbda96501e347ab5b5ee690820ddc89f6619dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d95320543420fb996d15c71017c34da6
SHA1698e27e7888d13069db06d3819058c5a9ec3ff4d
SHA2561cd6ac88cb8c222f048ba137f90c0f66ce29a0601edfbd8f3c3683f3b1af347a
SHA5125879ec8b66409bd5c46ecd93f598f90bf6b2eac666b92ffc29b2a4d024672a6eb132bcb6acca09a39cee1227b77fe663018afc3b5882e4be50a2a5d27ec303cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5340f7236f1799051f35a131581e2e534
SHA198aebc2163cee787db75a69e5d2ec73098720e19
SHA256255a0c8562ea7890d8d42939ff38360ce1c62ec4a12c46542def0f4cdd4866bc
SHA51255dd9c933ec8c910c4b454376f09c126eb1a7538227362bdc1674280486731abdc6e5dc922feebcfd809636716ba174a802b028c6e6f4a4bf7798a1e3f86c4c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a58fc57db0fae8f0a79dff16f8dd5f59
SHA10fc5271fc92f8ed07ca5cf39bab37821df5dca1d
SHA25615313f964a19a0f1b1b6b6579af9ee2034e4142b9773cc283bae4309b6f9e5e9
SHA512b4e9f93c894fda9b788701d9b8c55004ea2a29eb99572ab08fe4bd3dafd05ba6550ae43da40bfc5382767d200aadce68358fc03f3171d9fb5818e45521a1da9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4e6f02326fcc0a20d7a89ae482a012e
SHA1465264661311ee8088325cfeeb5c63512dcb092f
SHA25644f54ccd7c16d69d4756a1ee896139bcdccbfa2cff297a85f59c6fd35ebc9172
SHA512dea6f63009cb574c91dee0a163dd9c62713df44c9c8cad920bd8cc324739c5f9a92d9f4a3daec5bf742084b795ed20a02deae33077bf8623afe302ab43b0400c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd35e554e1690c1f1a973a4a8f6f07d7
SHA15733b34ebfd2303ccf1a12a3ac55f79a744bd3e6
SHA256bf056d32cee3988eb67f8b5ab880104cf654b4892a2bb4758d0cc8d88c7dece0
SHA512c64f09db22d4f3630185992caab2d5f6df14233b1e1745fbbf5877c6c2967b81e7c298d041413babfc7a4106e49e21d848268630e5e158536b500cf58a276ec2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b