Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
-
Size
139KB
-
MD5
4508c476c37c0b82a5fa3b4d22293668
-
SHA1
50f85d3e226cba3ba4eb2fcd580593093fa49417
-
SHA256
651d01b19ddb8155b57245798b93c996e7e9674dc9487e06cb61dbf5020d1c20
-
SHA512
cada4b9a531018ec7df6df8f4f544f4b4472a4f76ccf517b004f9d22a6e3a00bd844913fe037d2ce24aa356dfdaf7b2128b64a56a3d1ee65261f97dd85051495
-
SSDEEP
1536:SgNXdgqoFXQBgbbXICZlDWpyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP06:SginWpyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435115678" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000535709aafc10a5f4bc80902ff8c019b94da3300d8dd5a83bdef227054bec599e000000000e800000000200002000000050b02f7b2b8d855240295aef81d20fb5b0cd0e6f69018c50ee5b55768068849b900000006dc3991ba09c3a594072475e28cf213216fce5883604ecbf9c1e6e4d25246ff5964be5902b83c933f03b6a8fef58885f375e1609b2888e0ea7514f7639436dea2837c72802172d6d6c36808300c8587b64033d0c6cd36aafc38715ff2553da479a39d1a0180a33756a49ed6e7de6076fbb596fcc83caad7d6ae28a5a330767876ed725473ce57894102d5db65b0d6ec540000000b7b1f068c053aeb33c8ebaa056a7b0902a85c41cddc18ed0b122ae751d3db644f69c8da21c1603784595f385766b10e2f4db8ef1fffc610ce5f1d41d7b31bac0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59F2E121-8A90-11EF-96DD-F2BD923EC178} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000ba384dbe1450c415a8fd7c416c74e8655c5d2ca9832f499fc95980eeda5abab4000000000e8000000002000020000000a47328c4acfa418849f78f170d3b2b53105cf1c106458ee3c1c000990f7d65ae20000000fdfdeaf92fc11f696afc26a7687f38a2179b723c073e0bee1ed1b35bef8b9de44000000021514006f1fd7350692512476254dc1f70fe81192f3ecda8aad7aa94d7032f280cd859ed49f3a59c36556a938f23cd400ba642f7550c2d2cb366fd6ebbbc4133 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905533719d1edb01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2940 2164 iexplore.exe 29 PID 2164 wrote to memory of 2940 2164 iexplore.exe 29 PID 2164 wrote to memory of 2940 2164 iexplore.exe 29 PID 2164 wrote to memory of 2940 2164 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517cdfe741bf3e285099ffcfa66bbd7e0
SHA114e744b21071841f7298ccc813156e7edb21d23f
SHA256b572fba2f89bb7678408fd01f19de5ffb5483aac77b11117b262c7eac83c9901
SHA512eb2d705eec7238e90a5fdc11e61ca0529412e61be6b8181f9e17d58e2bafed4041410fdf275cb7f8b629bd935c05f8c7ed1a671be3864a79e595ef023d536e13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc01c6b4fa7721650745382c78be4385
SHA1a560910c6918eeff22d8208c875723b80323b118
SHA25674314dda7041382343bd089d1ddd51f92d23b2a5d39b61c4b1470ed3d7dca545
SHA5122d9ae2a83bc101d70dd15a347fb1cdfe51de0ec899771399ba4ec91dc913c2634fb33170c41ab4d646396e032f7f23263824a1439b8e255bc914585576e92dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4769637a8ee2572c73ad09dc38e3890
SHA1d5aaa87643ac092fc27c7d4ef19a1f179b6a4577
SHA25602c3ded38bb842d3fafdf22046bccbfdc7283b08cafd046090b1413ff9ab6663
SHA512f3574a6c10d70628a412a07afab51ef0fa71276a4a37f0de6c05fe01c1fcc4c7c0c85d55baf2b9638f6016e1745fc18f5d8e70b9d3be4f23d2b24cdbe81b514e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ca7ca37e81ed7da46a52bcc9d9791b0
SHA1f1a12eb83c06bf42244c6e8ab10e3ef7b3a9003a
SHA256ea93040d53269300c9503cb8bf5d9bbcc668594263ac3cbef6b042d08c3a0d8d
SHA51242a032807a4b933c0f14707e70b7ef5b7f1f89f485001db7ad7a64b76a136f8444f7c8ee4687759d5dac307d0d1fd3772b7fab5eb10235eff54252294d0ad781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb240c6dcd004bd72c355973681e17d8
SHA111a058ce475f07c1e6e27aa4019492535f5cc64e
SHA2568abfe6714a876701e25e952f99af175ba01af5b37e4da4259391e5cbdf9b4347
SHA51256b5536e42f04b3adaaf60cdab6d5a67a89972103cb41cdf0a7c78c7a0c340ed6ae65c7e7320633c14b94e8a74fe690ee9ca74ec235add864607425248a64228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e43bf02ab96ef31943b9ee2c30b18ab1
SHA111ef3420956f74c774d24b7b9562f568f44c91c2
SHA256a9aa794482bf92a930cc7edd76335e585fbdf795fe4f35faf860d4755b36bde6
SHA5129d81fd5157bb9e3c971997dbf54b08782d505efe73c39d2480dd526360c1dbf21023ef760f48b81f624b03eefa61c58de09b3b40468b3e523f7f01cb3e5101ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7bfa89d7d87a0a15cf1827bd4c4f76b
SHA1b93f3a902726140572c70ff6e25192f0046cc3e8
SHA2561cecc125c4c8a1d128555a42804dcfe04cfdfd202e18ea73349699a7bb40ffdc
SHA5124238a6479adcc406509857b88c0abe164b058c6942ff62bbdc4984f8f5dc78e20d6a87dbb1deff9c5f303d90c68c5d3242ae4d586e7aca5886b8b50caa5ca5e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1b0b01e06a7ba32fca03e15c3095c76
SHA183d559226d4ae7730026d7ef5077c670dca8b935
SHA25697789693f468930321adfea8c523da7fd924221156894bd7f82a07c1a8644f3e
SHA5123f6ddeb64d095220c87460c78a015c042b75c2602c108eb3c6b9148a2cb852ac6aca0cd1bb9ad5df41aa0ec981318df1b2b8c6c2f998d9e72c42b9392f7ccf9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53568c05b00fedb41b66480de13e084fe
SHA1d58a67eef07b207d07a86bade87a42e6191f9a80
SHA256cb219e12d0800aa04316e4fb3c8e912b7713cfb0d818a29dd73678bc0d433609
SHA512306e2f97ea1973884ebe9fd72f7ecb6cb4cfceb34bc756a5d509aeaf03e38b953e054e56f605cdbf74cb9d094ffbcf3c6fa903ee6816f537c39583024171f299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542d20d4d36f182b2f51c79d148d45d2c
SHA1da87776fd8743b45054646ab9d0ad677e5e34011
SHA256d69f12b060987a6fae540e6a77eeb470249a776752c5aa4f6fffe8d8a2d7ebce
SHA512c469134cda5ad5aa3c84868549d5d1abb4fd677017abcb7ce51408e4e4a9477af3e9c5cea1df3ef330625d2c7d1ed829cf48c0ebac1f43c9f09f60cd3fc57a11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a7b5171794ea0a93120016bf550d622
SHA16fc77fc2da855ece05efdc868708c48d2a8315bf
SHA256c9b65f9464322ef0ccacd5eef7508e3ec12a8ce733f7dc93d8b9a16c9214c1a9
SHA512b187132c75a22aab88334f4ae188ed523a6f3f14540acb99f50a4178eb76232120d3c6964b35989532a80c9618608a98fd122fd102cd43250fdbd4e606e1982e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b