Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
41c9f68d75e7decd7af077b56cb4b1eb_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41c9f68d75e7decd7af077b56cb4b1eb_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
41c9f68d75e7decd7af077b56cb4b1eb_JaffaCakes118.html
-
Size
138KB
-
MD5
41c9f68d75e7decd7af077b56cb4b1eb
-
SHA1
5610bdddaf37b5bc2e3146c384c4c094831842be
-
SHA256
f9ea8aa2fb4a47766ea4023cba546e38e16d2c4a4193e8f122e5421dfa56de5c
-
SHA512
df96d82eac6997da00cd23a81d90bd48b2acafbfcb75575dd6c661caa4dee8597f14e1b7ac549882e0cc8f2cc48bb36542fe452ef072249403de8fec2a9ab4aa
-
SSDEEP
1536:SPfOxemlPDkyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SPtcDkyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000c03e840745123c7c8f1f69732b9cc09f7ba4c2f7e5e81d33650a6e04ffcafdb2000000000e800000000200002000000092af57e70e2dcd5be13ebaeaa13586dfae22e8a06a87031dd319cd379f952a0390000000dada3457764caa52b7179623452d147aeb99b73a5f95ac26b9c06c0c72ddb53a988db6bad27c25e69bbc702feac57abdc3a7db7b40d333e4ceca8f9ea4f19e5cf74d26fd470c9ffc13f672e5f49f0f8582e0270590ae098843b9ee2f28a17b77e029c1ee38335f5ea9bea563e8ae65247dcf801f1f044f910d2719a606ee9c3f0131c3d97affd90cf715109602ef18ec400000005def87e59592b86ca974323ff2dde13951a6e79b9b50dfd230d70faffd7f454fc4a1dcf8dc02fbea5681ebb6f955cffa7c0d6abdf52cbd59cc39b5bc790f1092 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b5d967873880280d20b02a2a3e07fcaa29a8cfc45eed32e85d678d9304e97b83000000000e8000000002000020000000d67d4a5e8679ce0ca8dc24bb3b21e99e579e21daa5c00b9b41e843f2736e80272000000000910e7b03e1b9f711fb735f16f285ff4787ebe58a8bdfd3980dc8ebdc803ba240000000b5e2bcbab81834307631e7c7ce916f76229448f6b5b67048d8a6b5c193914d94d55d4920269dd165097e73c48179e8f169db7aeab9e17dcefa40172350ba1bbf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53592A71-899D-11EF-B686-FA59FB4FA467} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435011299" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201e9069aa1ddb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2780 2384 iexplore.exe 30 PID 2384 wrote to memory of 2780 2384 iexplore.exe 30 PID 2384 wrote to memory of 2780 2384 iexplore.exe 30 PID 2384 wrote to memory of 2780 2384 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41c9f68d75e7decd7af077b56cb4b1eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f73b558852ef9c1962a8b2c5f926d9ef
SHA19752bcd812660c10ad8536334a43fc2644cdfd10
SHA256a7171213a0157fae543d9121acb83397fc80efdb399ace9ef0a5dc2dfef72b56
SHA512b481b1b8d7070b0f55b9dbe2e9ef63dc507a601bfcdef100bf797c7e935a70181f83fe76db08b37272ba5c3014d5cea7eedcacc00297d70ec874debbc93a0158
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0688f377241aaff12c5f97ab4dc7331
SHA1f8f2dadc07d1efa664b650d722c0922c19259caa
SHA2565cf1c1624717ccb650c6b910f6e35f76eed184ec7648879c1ae18a856d94f85a
SHA51205062f9e60dff15004e128dbf73c4703cdd6a6670e1a0cd4fd528a447313e6d533362496652c2b50d37c5c876b2376fcacac5a7d5948a4e6f467912bac2e9097
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5885e0a6ccabb8c9c75eb1c71b1ef1f96
SHA1f397289bf6a86ed5113fefc9adf6901d458e5fc6
SHA256bcced816e53ce7d22381cab309fc7c2df86249584601078e83c4714a4a9c38d3
SHA512f29fc5834a7401d883554112c163d4a73b05121a0da71a248a5e1ccf9e52a0e2af969b88383e8964b5cf4741272e2fa67ff4562549debc4916e26ab58c590de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eede8110b3b67190df5d5d5aa25a94ff
SHA19a786eecfeb6f8c84823e61bb865cc514ad89ce1
SHA25679e4576f04924256757b1abcd9a06ebc65e1119a13e3f5501b792d19382bf49c
SHA51251d55cb0feff1a3225917f76013d0be273bde94c0fadd14f3c6e4f0d54903d418e2562abef84a1ffb4dd7be3cf165369db22ccbfa3d020f01f5b82e29285f10b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ba10dce0c1bc25d637ab25e43fc09b3
SHA139e287739e32107e75c67f153ccd873ea4475686
SHA25602c43fdef1e2cfe3751c5c816feca788e65d2640d228b330d628ef23c0464dcb
SHA512ea291b11a2272f6f3c4ab2a306df9d1d537618fbdd0e6c7ce4b2408e4076461d2e4186f878416d3ae3cc8f104431a9001f367ce746e638a3926f91b766f97c7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546c9ae67393fef81186156ffe9c88ba4
SHA1d6720932ada76e34332bc2f2102d5aa9ba52c335
SHA2560a58ba0ab9dfc1c82e0153d6b931400f604f08a4f1c82d47555fdfd69932960e
SHA512ab65ddadafc1b6819ed8faa05d02b9ddf0e8ce1d3aca2ec99452e416f4b84d2637097e552750aa8748e179f1a06da7d9a646c6e09a924dc33ce12707c13b16cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f997ed943e2a90652517706f65eaf621
SHA1125de7fbb65a04c959dc29b4fea49ad47dacb9f2
SHA256e00d48699506cf029cf93460294a63b90615901c76ed12094243104bb7373da1
SHA512d7418a8eb321a80b64d4767e3a3dd640cc7bfcda83fa8c6813660c495fbf5eba5a15c63d6eb68235b3b5579ddc14605e1c44d80590c821471c22b1bad501fc57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5671a715c4a4cee3ebc25858c9b0af04c
SHA15c02ae98291102825540a87ac0038d4c68798752
SHA256051b9a1ec0973edfd1fd1089b9eec67228f6a8f28915ac517732cdf6eaecde8a
SHA5122173698fd387a57f39e26775621f28a00e2edf367cacda71e82bf4d7e4d5dc10eee543446a499ab88903ce6d29dbdfa983236179127f959b55d71525a4790493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500482002fe75adff778d67f2a435b207
SHA1c6e8a9715dadb6e5546d495f137952c0437f4f0d
SHA25637ee670943f4d870a2d8277e997722dd54bacec03c7e48ba7173ea0cb623c346
SHA512349116bdf80b80244be7887e2a44769c218f07d89cd95d9f8658d1be0e9118bf4a11ea1be131e998c44c11daf17dd903e0fc8757a7cc5bf410ed7e60f54af473
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bb97aa12fe2a0f2a1172e00004591d7
SHA16411b3823a84063a7ceb60c12c2ed30a024af331
SHA2560941526bf990073950bc395826f1e8ac9822ed0c90dc14c8dc5fc01008094982
SHA512cc56e6a35b4a1a3a0865a9015e4e50af0670e17109e7044971e4dcf7c5902c01c7dac6cc0dfee3c8471395b04666be54c55d04dd769896c53c237472abe0ddf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e3d19693549fad06eef0af5ac2c0294
SHA147c4ce8bc1d3d09e988192973fc77b9e14e0a1d2
SHA25641e9bbe37a2f706908041b596edb81ac1ebe75cb79966b4a4b561f0b0a9abf34
SHA5126b1e2048298b6444ca1d27c98ad74cf25aaaa671d3e914b8f6bd206b40fb60b87c78b31f324e2923ff9c8c6c10ba2bf8e2230cf81b3c19ea4a0a59dd49db1baf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f2b15fe20e9ba084dd13fdebb57a6e8
SHA1011528fdd90f3d6b7c19c251a8a8075594987a9e
SHA256f3555471f62d5cff78aff4698ab879c68dade2cca2c233743477460dee68d5fd
SHA51269e515bbffcf02491bea6b2f1dba45de04cd1bc06e34bb7f97f406af8844b5bf054fcc3ed2671e76468614e68e1777c2c3dae0be9bb40f0c985f5f4d51684a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524b55bd2d16df41b550e31c527b165b6
SHA122006dd27b1feed52ebeddf2482c6085f29ee6b7
SHA2565d66cc8439cc2d38caef75d405a61f89403a2f5965a98d92799833407d80951e
SHA5122c34ca959a4f23444853bfb69fe624ed8ecaa2a6797e8eb0abfbefbfab0cd8f22290a6ca9a52623c036905fdf823e729b234b46b1b478b46f827ddc4d53721df
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b