Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 15:04
Static task
static1
Behavioral task
behavioral1
Sample
5273a193c050f17dfb060e5461ce6a7b_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5273a193c050f17dfb060e5461ce6a7b_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
5273a193c050f17dfb060e5461ce6a7b_JaffaCakes118.html
-
Size
6KB
-
MD5
5273a193c050f17dfb060e5461ce6a7b
-
SHA1
9eeab9fae6f0bd4cc02c1d7d202ead1db5859cef
-
SHA256
699cb28a434503b85570fd54a28ca8c1f8539df8848c1b91aa17234998898262
-
SHA512
cb69055d9acb96b4ac8ba62c9bddb4c6fb26a810e086b9963fcdee235bbe70b0b28bdb509d76a7ed2a39ab431831040e3e6c2e6e0378bff30ded85e78ac0c97e
-
SSDEEP
96:uzVs+ux75pLLY1k9o84d12ef7CSTUiZcEZ7ru7f:csz75pAYS/hb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000060859250afb970da042c4ccc46f90cb9826a4971a008a2fbca8ebda462665552000000000e8000000002000020000000136b22f4530ab74873e834ebd924d92fbc8cd862475d82d7a0f2c6324fc1cd8820000000cf40fa54316c0a9303ef02a8c5415c09371334648e72d9462a90e0ad171d57af40000000e1d62038857da3886d16441ee2ecbf5624975edb74e5d00882d915df11d7dfb572b0948542396a6be0b94784763f685767e6b58e83df38c497ae9df5c34a51d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435339316" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000009e6b3f6a96be75911a19bc42ac5b3dd42065ad0b66d10aa5036370d4b5fe1dc2000000000e800000000200002000000018e6a7c02f32f0bb39c56a9c8543517436e582cbc2ad274ce5fdf06a736c3aa790000000db43f97420e027f2ba325f59f58880d04b3bc36c809137d71350a57a06266befb2685c9e543c483f30d30e2b8b9d40148f20938d0ea82f604c2fc7af38567c5d140fb63beda81b2959532e6d95256e27725cb391f1daa0b18c62d9655cd574c247aa08fa80f8692685b1ff5c3835162000657d2166d536a19a9addc69f2fcb9fe5ee2f8216b3b5e67703561fe470079440000000f40f5e8657ea55de6f98ce3f098c257888852a0f915ea60364f04b50c0b6c51a1ca257f16788c02049bd808d318fc0d28f6b5d39fc3cd473952b79c43928507c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F242271-8C99-11EF-83AF-F2DF7204BD4F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b11ce4a520db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2432 iexplore.exe 2432 iexplore.exe 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2824 2432 iexplore.exe 31 PID 2432 wrote to memory of 2824 2432 iexplore.exe 31 PID 2432 wrote to memory of 2824 2432 iexplore.exe 31 PID 2432 wrote to memory of 2824 2432 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5273a193c050f17dfb060e5461ce6a7b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b533493bbd22bd4b8046a6a971d71547
SHA13d097ce91736eaee4644c7f79de7dbeafc4cdd77
SHA2560ed59a1ef9ef996f9d70639848675990a9949f67cb097462c84133f2115175b5
SHA512e73b73d256d79f0b9d87866f8b2bd496d406e10cfeb26840e3b6f117b982fb82087c2f32ff9f18ff373141b705bfc56436b0a6d704ba550cc690b6e86ac9d06f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5706e5b17cb334a2c560d3218c61c0985
SHA1590fddf5a6e04d80013f96b19c7210e6e10a1154
SHA256229ab0d541edfba8ad38b40bbbb80954067162ba8d73b862826260b03783104a
SHA51208534ce4caf7dd11c23a1683728de16af1df28376fe3c50c472c9d95a0c105911e2b379e779651b45a763dd0b757e24faa1a23d527d0e02e8b262387802a269d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522cdcceddde4a7f4e0deac83e993ed78
SHA1efb941076468b07db63a9f5627a333208b24fa96
SHA256a69479da328807ba70776e71ea7f426823c28ae56e23cd3543e3a20ba33f59c7
SHA5121d6ccbdc2ef9afe3358fce27c8877ced16e6c2a83febe537679b282335211583396dc9b6012eac4d9de096eeae26ffa9376d3988770a4a4f0506c307b3170626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dbec930ff1198e906e98790b8beb9ee
SHA11d2b9156d60fa52672738e58fa3d413ac6ec4285
SHA2564436e02ae785814532301f1e6102bcbd2853fe2d2e17b93a785947f8a977eefb
SHA51241d7a853f402160c77ee5a79d745eafff3009e5402f38ab5be8f85373924d56780455002ccbc4af5e265908e3ab58e5dba4de0ad1d045827cbc9b934678ad4bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5317f662ad9467375f9dfe8bd64d55ba4
SHA1bf814c8dfe326f56a9ae5897aeeb9e7a4d162097
SHA25661034ab9b881f5fb9c2c6ddf3651608381e4ae9cf6899c85007418c94eb31716
SHA512223d345cf9429b2e5470de0e09024fa4c91cb3eeab8247535ca540e915fe431a37dd0234a0ad153dd44dcd06fa239f541a56b8ce51a93b0f9938ef4c47f65bc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5174b72d593031b4d4413c460234e0943
SHA17899dc221dbac7ff02e1f94de76c8e9a9e6250df
SHA256b2eb122a83e01e4bd77ac9a7bb9a8b564041bd7688255ef59acbc620e655a51a
SHA51204f5211bd062558880ca97a4c54c1e307d4cd3805e5416f9d83634b16d47237c9f9536135248372578cf2c2ef34f1260f0d84764a36a8b34d2d3915e488b94ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5473d541fab36eb2c5baa248a01dd7949
SHA17e5dcdf7843f41e8a235836b832ebcda32a13536
SHA2560d3d95ef01f04c4718738e8359275a7698607a08d64c2df6a038c4a4ee192e4f
SHA5122f26c8510b864cba1d11a179761bd774404596e8b10bb605040b426065bb95a52739788ca47b89d8c6cfdd48f639e67c5eb940c227d8aaaad85de28fe05429bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5488f858f60de63177a56f1f4404df8ec
SHA1c54ac132939857195dd0953b2f8622c889ccc5c3
SHA256580df426006ae5855b5d96d37d7463f2dbbfbefbe7f0802590037384878e17ee
SHA51272529b5684c515dded40b682a74461d0511fb7244bb8800f570170615521e81b31a7d3c526379022d90eb2e7477d57e5c694efadec9d55ae98be0d69e8e8f2b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f834e3e771e8004fda0157f109d46fd7
SHA1e91e31cd7be2142a0264d27c0a84eb263f152866
SHA256b8bfaa375735264ba3af9bb51dfdf99f92e6f302798986c0a32e6d3933c1023e
SHA51227a1c3910d4e39d9de18e53414a7066de1405823cb69e83de1327ac259d75cfc0a6543a13e8e29305cd7b82462f87561d39d13edd8329b1babde76a15be146fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dd727f7ca6a3e4b85cc7905bef95a2d
SHA1e746e1312e7419823c2969918b1d6fdf48223f15
SHA256caa2d9ae5630e8e6b862d38f5c15131cc07058cecf849c3cb32d67455f4c7cd0
SHA512038a56d2aa6f735b0f958f9a3ddbbee5e9652da28f4f10dc1630c85b98087ce83e2a4d35e6da35304deb0ff2001426998c0e5b3178be21290d3cad68a0136285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5575928b85eab78fb31e9f0e89bedd10c
SHA1aa4e59574f4a77a92df1f5cdc83a67e17c96d810
SHA256da5e27fb0fcfd1a69e5b509ec13a13af8d2fa1c41134cc20b7a88b22bfea8f06
SHA512a03cc75c007a24617c64e6f5c820556ee82d4d0f87bf9522c41f2bed1d0b8ec78ae6fe0d208ee909b552afbc5dc4c0e7d49aa1f069fa514f500acb1df9a38e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557480d5777d5f999b4886bc563600872
SHA18bcad9399ef4c9a04f29a85e30d7dd174150c02a
SHA25667bb8cb98dbf92541b5659bad442b252b3fa4eb5a7db87b5b408e03be65e5d26
SHA512212d5278d5874ce78246efa512bd78b4be9d803bf0dff285c7a761b55621c5d0e4009699384d9eeb77fc207527a8f46f83850c47abc1ba840f0df1f2d7e9610c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8a763a9c85371afab0e76333d78e4c1
SHA104b8b7563af18709cef7a6f02ad68cc45c2d820d
SHA256099ed8301b221fddbfff3257c210ae23f0d4b3da66fecf3d1d5aec4105ac36de
SHA512facaf3288e6ba83c44d0a9467a47b515e5608b435a2e5b1701a9e3c98b51275eb5f697d4b069996d4c498f6a99059129bbf750b94c23e6ddc32234e185861cdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d99126cbbb911cf24a7bc04622d66268
SHA1da6b043099f791a57146ec943b205140fec60ac0
SHA25687b9058b2fd5cbc8ef13eaa1e084b81b9e86b721d2423eca168be39e9f1e3f31
SHA512618c9e7589e6de9714e4857e1f4e24275494c0099bb37f0dbb02535095aa23150b4a5461953709fe4487e5135e3399338e8d09d1c5eaa4ffcd648be359521e88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501541ac890ae00aa9f5b8b9084de4797
SHA16daf8e137c1e6f4a4f4c68182163712e833ea888
SHA256406e0db6fe7ede21ed21ae9f5825f82c9ccbd6b3ab5a9a45f33e2a5976074c73
SHA51290844d7f8b9b55872c44290dbb730f9d14127f095e85017ab52a6b8f50d72a5984297116f9d5175c1c1623163caca9cceaa10e4241fd9ef4fd82d1e5c81796c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3916a700d4846c000fa2eb91184d8c7
SHA1568e3612776c4ed4f7af46f0157ad4dd64cddaaf
SHA25649c363351b38508b9e555d50fa7b7f6fe18972eb6834bd4d308115e60b285580
SHA51266dd8d92bbbafa8d3e47e4009e4d47eedaca909b68b61c9efc98bb05c836504a25ebd2306ca3dfa54f8026cc8eb74a56d7ae8b215b5676bb1bdec5c183e7f5c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c177b931f12f7e2e38b3e2ebab5e502
SHA1c784774fe1a385f86369d662ced5ee4b2ac4ef29
SHA256532b435aea20f98d965561de5a19332e773bc29ff1b54f5d0bbe5ae485bba6df
SHA512f8aad252b2850cc07c53317458ddac80591827ec99a401bfe10e05f0968a974d4cb6309f117fa5a3fdbd427a86887d71d494d143b4d7eb10e5d9102563988c9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5440464d75e0d15d64eaecc6c58c51c09
SHA19032f600253899226f3e712aeeeb2edd9ddddd87
SHA256ab131814b1aa9b9d1b232e4bd0954d4e9dca185d8fb856f58cba6c714205fded
SHA512655ee754e9039c372904a81989b9de3efe18c8a7faaeddf711ca17f1ff4ffb9d98a379da93693e35e5fd128e11182d544bade38a9d8c034c24c46554a4549a4d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b