Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
5777afc93644de97505424901c875728_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5777afc93644de97505424901c875728_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
5777afc93644de97505424901c875728_JaffaCakes118.html
-
Size
23KB
-
MD5
5777afc93644de97505424901c875728
-
SHA1
5e5994d7f694fd06fdff624b283f955ee29ac717
-
SHA256
1c476eba14acce076ddceac0f21810fa1f6cb1ca4f3806d4eb05fadc7d2cbf95
-
SHA512
5277fbb654ad7dc50ea1959159384cb7edba145adf582066259f97c11e664c42ec3bd358dca6fab13d1c0f829c509c3de27569db647b847fb69755914f516d9c
-
SSDEEP
192:3VVbJkMmzN2epeY8wHZYy2GSGvBTGRqDJyjXIRKDvo/nymbcGjcPdMyIGJeGK6VC:bbJ2TzA0DUFI1cPdX66NqLUDUFIo
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f8ef7ab23642874482d021fdcd0dc2b60000000002000000000010660000000100002000000003ff92e50fca91bdd6757e0158e533464c1c45dc734291903c682aba930ee836000000000e8000000002000020000000fd86777229fe5dce633bb87bbac45831868c4173bdf3d40c504cd4c3684e057c2000000028c1165281abb9b57ff9f0c9abd3309af8ca6fc7540d727ee0c67495bfae9498400000004be29712b4283f9448d9cfee66fbe2ab63b267e13bce3a5b187b7e0c08b741eccfd480fc35cc62ffa2b84b29904e8eaef5b5b22a438c1541f51aa35c86a6dd18 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05e9d525a21db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BF143B1-8D4D-11EF-8BBB-46D787DB8171} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435416810" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f8ef7ab23642874482d021fdcd0dc2b60000000002000000000010660000000100002000000041fe99c49298312b95c3efa6536a11aed8f62f8e04a51255ebe00bfd25297b5d000000000e80000000020000200000004b628bb49c8b5d57e7f58b3d32355e4d1df839868a8d979944b60e1df02234729000000034ca97c1960e1a417350ba4274b3d5444fd3bb053aa6a829e07a12794ed85171766cce62370695a30a030efca1bb918371cc5ae20ebc9c216b8d0a8538e044be4344c87a773b7c0d5d1c19d6f3406fff7a7bb54492714941771501a5900262882f96b05a4da7291d360e2bec47b6406aa01925850987ee23a6520153a63d07c9272ba914c850cd338c767a730d4f0d2f400000005fc112a2a276685f53686941f55423f68c354ffcbd4a7df5fbaebf391cb2957cc1132651cba6c11304b872d8c3195702cc0353e388a07500e477347df6fe31d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2328 2272 iexplore.exe 31 PID 2272 wrote to memory of 2328 2272 iexplore.exe 31 PID 2272 wrote to memory of 2328 2272 iexplore.exe 31 PID 2272 wrote to memory of 2328 2272 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5777afc93644de97505424901c875728_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5d9e26f32e1efd30328b390b183356dfd
SHA10a701bc530eed53acc9f1ec2ac07855618809bed
SHA256c5ba15532b545d177bf1fad72e65d232e4adee2a3a4afc327a04f0263d57157c
SHA512eba3ae898bfe752a508752258de1b505d316560d77995ddaa8f173b1e1b5684768920373ba6b460b6eeb6c83dc7439d3605364722afac43570bb9ef766903142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e604fa5d00952ffca135daf833a349dd
SHA1e9ce56f997e476002c6b614016d337b8bff81d41
SHA256a6f0bb1050f0bdacaf3d4c9295cfaeff54521856c5b850fa7ff6c7187d57a3a0
SHA512a5fb2bf4c3271da9ef6cf75492b59b0dc8f3824ce3e0b0d9a098aa6e5b75e2d13415703ec6742c2b962d1822e1cc9090c2224cf31d67f4cdcfb1dd0d833bdd80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52666532f1c9ad82c534bd9ab99e2db66
SHA1efefe9045cabc8a99d908e86462998952278a461
SHA2560f57ddc0b4f898c768cd853124a6414dcd2bfd60dd21c88e47dcb9b7d1405bcc
SHA5124364807d43c7c136062b13cc8b917b5dd74b3b54dff81f23e50f63a8107d8f868aa64e376e0201e11db5c9a34d66823d5c1c102c6d9203b2a94ece99edea23e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d84aff55f30af189fa0e4480de1dd46
SHA19f0d450cd112b568a41ebe1919c827910f01fa37
SHA256c30348d50dc8f3866ab94e5b1090a64eab07cae793accdae89f1401b057d6a47
SHA5129fb5ab75aea663d50d435d7af682d577cff0e454cc959b1ce9b328d946a36a89ec47f9e604f93b8252291586f60fae613d86100b9abe93d3aa7127f25bb27357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d0ceea1383907c67d7842839a91b246
SHA1104a091cd6bb50d02e0e932f5c69093f92ee9560
SHA2567550a905bfccc853e885b93c16b5cd49a1f6a6d78cce7aeb15cb5b4a5f5427a9
SHA512a120f58ab6fa2e488dce4115d05245f4b9759b8faf5d17328d5db9c699de47414a9058cf581f24b3a4fd5478fa63b1a3a34042a6e76bb83656f891fcaaa05b95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b8171643bcba674dee8dd506b694b38
SHA1e411d3c87e41a668990484c6c6b7bb428c6ddeda
SHA256c0183aef64da54f2e25ca5c781009e013bbb9c66f8d0b211b78b30583bfaec2c
SHA512298faeaa651b74b47152b8455d0a0b8cda96836f517d4dbb25a64f7c609142d2d3489f9ba93d212cbd8e12ae85490e092ad72f5b071130f5714ff5a66e5756ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f995e240ab93ebab5a5e3f5bb9bbec02
SHA10c8e1cfc88dddfa910815c14bd0b5f45a75dfc33
SHA2564aeacd8438e046737ccb75f86dd795c370e7cf95a58a571564de7c6950aea36c
SHA512a1f00ca3badf39f9ae131defd560cbd6fd4d7f52b14ca399ddcfc893f7b3491345017d5c91859f06f48a179d7728ca5946d88871ddc7fa3cdb6c1015ab4820ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e907796eab1b28ee3630f9606a1987cd
SHA1fc3b4c55440d9fccfbc18ed7202c41d8d3f18443
SHA2566b400a5c223db1f5b1ffbfd0430f838ede5086481e51b3b4e71caffc41477998
SHA512ba22f39e7d2c48fba163dbed0328305a2c161249a9217ec4aae1a4dd8f3287efe1b220347beac0a03e081d26a839baabb1b21b5fe0136371db2e42400ccc0908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58052b13f775d70474d05d2a761618259
SHA18226916dc5b33911ed9a0630d0fab85040e8bf36
SHA2560a6383c13e4687f49d468f87955c95adb0154a20572647363109079edc268a7f
SHA512b64fdc7007d4e3684f509835ee2f51b10e204f1a1187f225728083b382b9aff2e54408c84020e154810455bc87d798e5ed0bee2b8954c3108ab0d97de60ff762
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f9d5c02def433108c15f92b4d1ab484
SHA1c65b1f57674144edebc680a9295bbcf1a9491d20
SHA2569575f6bd8cdc974d970db36890f397a510e5673b534c48ee4ad2b4190ed86c76
SHA512a80d852d413c0ab9bc552be082e6eac03c88614d6507347bcc027b732e7defd568e36ab7b429d11e72d2184374dabf89457a83361285ba0bd09d2eded97bcc87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542e84dbc3726be6aed8eafb6b373e8ae
SHA13dd0588c1762f36d695f00cd5f84941fd1007900
SHA2562f652409d6b1632a13ab97ae3a3405ca3228f077e84f8bb1f5941c39de4d5510
SHA512917c4ab9edee05bc3c12e8b59093568e98139a3b14df584ef0dc262cd0e79ef663445a32085539d0a7b7e133524cfad1f1d04e9f0a66424feecfe36453e44c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59aa345227eeeef7be4baa4fce3235c60
SHA1e9d4706e66041dabf177fde10365cfca56e953c1
SHA25654c4fd38f0e86b0fd4d1ae8f3c0f056c576a8a3d4efc64b5bbd84072bc7d599d
SHA5122dfe1dad7b0d71c33b95d07155fcaf261971a111241401a6426bea8bead2a672dad6de8822f3a7fed9d133ecf59ac93f9ff7a74cacb5330c8ee9e39bf78e00a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559f9a65ba50cee193723216afa7f04ec
SHA1496aea99c971fc39d8691d88967c4623be8006e3
SHA2569021d8ffa0f11db553ef3f5effc4ebecd1345eee6f9711e18c8e91e64f440cd2
SHA5121d5417eea76cce689090955bb972548798390d727b2d181121f2fd1b684eb3735f1df4e0110f6e9a156f276d2c620e457d77976291c1eac88c2acba1b65202d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD507aa958085ee6586ae077cd4d4aa7240
SHA1f9294087553463777b0756c8360eb639a5815497
SHA2561b5b7bdd81656be8bdae80d6a26f31a446009636d3fef83068f04e8fb8799b1b
SHA512b558e382349377833f57c06d46744e39b7bde9916b4889c9a7576cdbca39fe0f2abde6cbaa945351bf989d3353d73629ceb296368268969156039136a0e3afa5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b