Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
407f8dbaced2ddf508cf68629a098578_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
407f8dbaced2ddf508cf68629a098578_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
407f8dbaced2ddf508cf68629a098578_JaffaCakes118.html
-
Size
41KB
-
MD5
407f8dbaced2ddf508cf68629a098578
-
SHA1
6fd08f9eae01b2d89e3cacac45d8b4a7120ea3c0
-
SHA256
ca6a4fc80124936adb7f4d3ef0eb7181d372a821608d530189fd76567da19f89
-
SHA512
0e34bcb1ac19e3193687dec91fa75fd376bd62c639e2063d496d6d49fa56619e1548e249cc4c9058fa10e37376eb37a643197d3f2af8514fbebb63a278c5dd6c
-
SSDEEP
768:vRR64WOmaPHDtJBrNs0V79E62POPsmofxsS7UEd03YYNy1VPvPWPdktEDORgk074:vRR64WOmaPHDtJBrNs0V79E62POPsmoT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D94C991-8973-11EF-B120-F245C6AC432F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000019fc599a1553241892398cec05e6367bd56233d88f35d22790b7646c486edd5e000000000e800000000200002000000019ff6aaa35391414308f0f57e4be2ac8be0e3813b82b5db29b094036fb8969c0900000005ebbd8400bd242cf2b124340af213fd63800ca6a7ea66e7560b53544f105a853a31a5e1d30b94c35beadfd59ecd48ee855c15628a98db53068a43086ec15d98e7d299c11c055e77c9080e0140df9bc4e622a5058ccdb534d2caf819335514d9c9ac09748d1d47aeac5348e1eef245354d7dd83dde9ea59a71f0a693dcd57d812f280b9a8226fa793cb9e3f1b0438417540000000da1100795203f63972909a3fb83f5860f24aead87dc946f535a3ac138cde85e32714d9a351c7f14e9f7078517cbe5e089252af1492cea85276b96ffc4fc6519d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434993326" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000003a26912fb2db0063a39cceaa2e2c5204b68a9781b18f0f3ef36f8f2178c1f3a2000000000e80000000020000200000002ced40071b2c6f8a1034e4aa100b148f7e2ba70370daff0acad87bd5b99860f620000000ce289078fe5b562cdd88caa3429c456a3f668efeddcd5309a18106ff098b760f4000000026e4c4026324ad9be6cf504de4b4a18dc2daa0540a7da83630969dd3c1182cb2dcf01355f7c2e6b04af1bd702be70e579a859bce736b77410e2e9c3e28143940 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e3de52801ddb01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2808 iexplore.exe 2808 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2736 2808 iexplore.exe 31 PID 2808 wrote to memory of 2736 2808 iexplore.exe 31 PID 2808 wrote to memory of 2736 2808 iexplore.exe 31 PID 2808 wrote to memory of 2736 2808 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\407f8dbaced2ddf508cf68629a098578_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b7eaa3220c8ea38b3e36b1f0cc2771d
SHA116b46dda242ee324623d0adb58589b9a45479a72
SHA256147e7b9aaf7e3fc590ac18d4aa8da74908829eb22d4421978ad5338599f10bfb
SHA51226858c8ee3b2e1e2d887a5e8b0c99eb0bec3f26880de305a17a118bdcc3af5a1fb98a76731a644efef94b30778f56a239da3868b6cdf9ed00be8b51b5e7445a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50174cd35770b7c8b3b6e19e84973e494
SHA13da35c4b285a071bcfdd4b87c07e43d4f87836b4
SHA256e3cd13aaf690193d72e345f3ce1abd624f57506d3a229c008f35d69c42fafc02
SHA512aeecd2d5ca6a9b2f4b427b8150a7199582f3c71446fa4fd80aabf4a43817cc06d02c3b4032523342eee5f4f80e13a7c81939c3cb764981f2dcfce0a9317c5433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f306bb606a495d6af20041dff199cb4
SHA18fd0ff3e9fa0d038fcd61afd4e16532409db9ec2
SHA256dfd3228b41fed8584159eeca542f569b36b5696e9d65cb7dd4861ca15d2186ed
SHA5128a14ca9d77a0cb5bc21d6ce6ae16e1af065995d9208fac37594551a17f0316326edd92abb3adde484788e52a5e4de20d6eebcc8ca1b8bd12d1e27fb6aebf4697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5935bfc413418b31ebd81113845b17e91
SHA1e145afa44a38fff75fb8fe71b1272846f1c37f55
SHA256372782a9340837568ab890bb1a8cab81c35239afffce9fec856490ece7e8e39c
SHA51239feb4d5d35708f97f76dc340ba26dcb20d5728949bbeb6404598c0e2ec22ae46511bb0f798a1bc8f3f058a2fd68a0b8a02f4b52c66518ff612f677041d2309a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560b2f7acc268853b3072b35593568e62
SHA1dab363a75fb4c559d334f77fdc1d8462ed18bee0
SHA256d9a49de77e63cd95cfd255e9e81f69648a601e22cbc6f3b51d5594696a6af126
SHA512e191a108a6c3fdb67356cd3294df38bd66404e428317947c6af9ba6821f3d51e61eb0f4cd0cc9a5416f6d3f79c9e290b69fd9c76551e8a5a68027264756bff9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541ee7a57c460018bf16e6f8f4d86adfd
SHA18e59c524c4c04b3e1f66ad1afc7629df44b96d64
SHA256b9f54be84588e6ecdc1c3316ee9b3b25ec431aae453e4e8870d95e935c78d1e1
SHA512c12e7b7f2f1bb3bb235b5536b62653ece6937124d2222c184baafcf210074195424cc147046ef4f199bbd584e3f3746e515db675a627bd51d87c014b12a35920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3be253380ce534d084cd9c0b558524a
SHA12215bfd84c9c0a4be8b28ee8f693b2745bcd6f4c
SHA256c42cd456e7c812486ff1453b0ab7fc7ffd586cf2d5ec9a150254157f5211864e
SHA512b671bb0fdeefe1b2bf3af1180ef9aacdd1b7a8b6883d3fe16c53b618ee5dd8a75e6c4acf8103f684832e97cf1e353141e4909e745a7dd98fe2981a3b1646631c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dac12aef46703633bd89560536a65ce
SHA1e8408d1580007b0d8661385d41080f364240f452
SHA25653e959da9a45079089a6f4c75369da3865ba3ae5d2472d34183dc9b0f60a35ff
SHA512d206b8fc2c47c639a8a9326539d1346c59e0d3dd173ddbff3191c6738e3912cb4ee9f9eb1ddaecf752554e986f3eea3f267591872dc9ae72fb7234b915cd593f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55435f6bf79f4258e466dc252ae4afce5
SHA19b7187efab618aef8a7690870b7e0154dbb9b4a4
SHA25675f5a08aa0201b32ffb01d1654451b468b67f19e6796b73a2988bc0e85b96fdf
SHA512da95f42b2fe7b37fb4bb1ce2176f2c10adea18138e8208a2d26b617fdd4937e55a1416faa811c2982dabcd8d48d8b1db556b7b65f55246a28d100e3b8f4a74b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e0c86b2d1177c66a13e5225784280c0
SHA17ec060d11485c0c6ee1feb8ef11c60434e4d4ef3
SHA256a9eb9820fcaa339cce8f6b91274220857dc1d6259cb4ffeac23018b400ba1344
SHA51229e28adaad85347b82b9057971d134324c59d48c14223ddf335d1b9851ce64f8820e30c000e3665b56190bdf67b6b10537151163fd342ae63ca796fc419b22de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d3f1c066426a8b26e0dea495982a30a
SHA1af48503e22cdba5090eb721c1ca6bc95d3754ed7
SHA256809441a5f4879481d57f520bd9c0ff459fef35d5ee0dc1afccc4e0c216537c7c
SHA512eb55a049ff1ba1580da2325a4ba8ad28a47c0467a20f6c0eca3c3ddbf22bd95b21b30242cdac9f5c529364c3cdd83ce83e52a1ef0c3565d0282846a04b9c6fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6ded08357778c769147125d1b8edf18
SHA16d11c2d5beaaec1a56eec8485d3adebfdf6b3b11
SHA25687f49275d2b74b119666b06488af8bef866291dfd792cdcbf4e9c15f9b45b099
SHA512a4be64380b260e1f58426099ceaf32d0faea5af6ac9f6e99e010b9edf8e6f67dc6d0b09c736440838bca06bb8353a6f949ef205040e29d6e9680278ab31af70d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d8ce1caa5e3912289163bea48758da2
SHA1f6cca632dc7d99fea325e71976a7a2c1c86ae7ac
SHA256a4e16b2583ca4b76d9c44b4c1a90db15eeea2e1673f7ed8b835711e22d920e86
SHA512234661683fb494950e09e921902d0c2e0fa75eb3ee7552e04096047572d59dba5ee0df404b6f8ae04969e2491caf50ae4237af282fcebe051738b840eb413b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ba46a16263456d624a4eb0604133d07
SHA1949d83dcd1f9bb2e90db294b1a9ecd862eb35ff6
SHA256dde30d6ac4a356a75757056f5b498faa3cf42edb0831d2b8723148b969eb12be
SHA512952f555a6653ec79605374f7cd258bb7216f96929132d938a1ac389d5e8e0d1f3d715640b8c466b0e60b2654bb51e79a0837acbfc3c18e3bd1b70419e4d495e6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b