Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
57780778e336c0ed74603b20d21a3df0_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
57780778e336c0ed74603b20d21a3df0_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
57780778e336c0ed74603b20d21a3df0_JaffaCakes118.html
-
Size
26KB
-
MD5
57780778e336c0ed74603b20d21a3df0
-
SHA1
e0d0e17e57863810f8da6643f55142a923624006
-
SHA256
65e50ddf844b1fe676a5d329c2ff1240309589d112ad232d3b7516a123a0e8fe
-
SHA512
fc0e6c07ee9a3b7ae6dd73d610706b9d8bf2f8cb73633e94c69b9b0970cdce65586f0b645d9b99f2db02c9d8dc91388ee7569be84252787da1e10e631d0c75d6
-
SSDEEP
768:S2utjq8tnQzkDneq4+nbb6rA0JcPlOLm4oPw8Zb:S2utjq8tnQzqneq4+nberA0JcPlOLm4o
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000009cfef19bc72499c85e4341e683ea1455b096197fc0ef8777418defa3d5ee2475000000000e8000000002000020000000920e67e901fd1b6c54c88223af47c7fd5658b81c8130999af6d28ce17f5e6037200000005865302c919ecf7ac4cfaa4fe2a73c4d858df602e2a0aed03ecf1164cd843d1d40000000d7b2e72f26cea909cf156c86be6a7f69119a2634c593062f583d9a5f2b900bbe5a4c8e3c885d7bf09dda72c2023128fe11f0e7fd845c76714b1c65156985c49e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a9c55d5a21db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000000eb52bbac5ecd61bcc16dd6df5be21655d453170ae880d66ea1530532437908c000000000e8000000002000020000000bc00ada0a19153e939386dbf93b149e3559ad38127e608a41f1b58022c92584e900000000ca1452f4507e8f6dba001163e650a7832a3b76cff3b55d313261913e4998cd69e30cdcfdb393253b8f838260e32c9fa191054d3db70841f047c7d2417c9e2984358e131da165a9d2d92206f5201b1fc8575d6f3f18463c901dabb8f037f64ee2ed219fff3e71a700e1c4b75ea94b658f3ae92ac8aa6955f7cf6811b86d9f22446ace283f89486a588c0af04abd17317400000004a495d2738a434fa0c16647d08cb99643ce7b1a386515c2d97ced61ed809c5127f5e4b68bc2c12053a573a35c9b703e73cb886952224d08af59dbf53c0fae697 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435416823" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83ABA871-8D4D-11EF-B2CD-FE6EB537C9A6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2560 iexplore.exe 2560 iexplore.exe 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2428 2560 iexplore.exe 30 PID 2560 wrote to memory of 2428 2560 iexplore.exe 30 PID 2560 wrote to memory of 2428 2560 iexplore.exe 30 PID 2560 wrote to memory of 2428 2560 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\57780778e336c0ed74603b20d21a3df0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50289caff5c599fa7f97ca9351915d5ae
SHA1ebc4e20693d76894d559f14189ea154ef5dc318e
SHA2560e15d846bba1db52a3ab5bdb527b40ff42bdd312de8a5d13f1e41fb914c2c7f4
SHA51223ce661a015663660dc66ced9dc0c69a0b6becb6b3be8131652676c9e723214d54398919ec1d6d63fad2aec836ff30ce283a45a0b47607e75047f1917a33bcdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5468e021ac909652cc9cbbbca67c28bed
SHA12e9d81f02207cba16f014618be33ac3050f195a7
SHA25667297c1d6ce47674c572e8790022bd9bba26a79f657dd20cf2908260d463b436
SHA512884c0e9dcde788900027ef0d5f070fe913b1d08cb83b52b35e620452757166a87c87b054ee78e321aaf022375da60846ae2daa325318770406549d2ff1c3a078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5933d0d2837295ccecbc7c54135c156d4
SHA19c10bb8b65e8217888bf061d247e2473388d820b
SHA256577a53f3f50307158d0795598d6375f577cac14a3b49fb3b12980d33f492582d
SHA512fab5111929d808663af99ea5bcaf2ef1867e0ee11cf10ffcf94ed2eafd14a60a5bfbae50d9fb683b72f92336c1a7ed824c3826096b2c7b5432c481a6233e94b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577a9ddf7582ad337085990d7dbeb373a
SHA136a68340bb38eab7b3684b57c8cef3bd9046d0e9
SHA256cb114258d3942f5cb95507e070e06353d0eb1ff3066ba11d27ab71fb33fc2524
SHA51230646b2862e26f97d0d4f267211c435704dd68e2e98da40a4cc9276e4f6824aff993df847da39a61c928def7f4736b03ceb7674430258fb522da9cb789cf7e13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5597e3720e21e28906477b485cb4cc075
SHA163c557a7aac7ca2c180bf8489d7f5faa97b8edc4
SHA25697f5d716d01d96f7e9111dfa28c2d25cf257900fb4eb2a826ad464761eb4152c
SHA512b07f2f611a4a775386fa2f09407b01a6b7e79b568e21c5e809f45258a3f42b9d72018af7b33ae1332c8a85f76009896959a892be8a1ff5c3b7fce263b848d3c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510c2b93ebbea74f7309a7fe9fadb03a9
SHA10ccd017998c2adad52c29a3d57453ad6ebd104ed
SHA256edf210184fb864469e8101bc0bfa60670939210a218d2d50aaeb084c31cd602a
SHA5124adf2f7629a7c26737f4e6b4396856f0c98d73d2a813e1a73dfaacc6a5c8b25cd4abd5697d1ad4d5a63a8e1dc4d530a714eca0950ca7876e0cd0f846c02ec855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5158443a3904344686209297cce1574ea
SHA19e9020f7c1a4caa55ba3f1eb70e78ace86897364
SHA256c1296ea574c74735f900d81c52dc5bc8a677630cb224fad19fcdb4034788c13b
SHA512111c2d26a401119cca27948653622f6ada01c17a88d45338692c6d09fe18bce9f8d788111a372b7e6169ad01b0c86b7a2d8ab05cd298b3772d0e55befce378e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577ad371ddedeb9dee18723a3ad99ef33
SHA1d982615c71aac44488147105c22eb3028e91e548
SHA2568cddc04c9ac0570c263788cd9b87c7308a761f1202ceb2ba9187cc2a8899ff84
SHA51299b44ad24f83ea456b04a912d13ecff1032f19a7121b2d6bff78f041555641e97e472ad55d1971f275f47b892efcc36b5151b919c413ee4a0440d4d72619225f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7297716a3b07e800ad7c0b012add04f
SHA1e404cd2fa0f49ae3244871fbcda20740a45a7fd4
SHA25624bce94dc7b69784f634c7d4b408d035fa000a6ddfa6bec6afcce22839c59dc3
SHA512676043f287bd2e774830c6419ede67fc58e55ca5004732b4ce33455c4aa7355be1d3d687f29ad4f4ab184a152a528c8b37ce7914fd20c54e8b8b1b1e132b6298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572ffed80d2f99ad390aa1d5e4098be86
SHA1ed04c6ad8c6961ffbf14ee11f9c5c23ed2ebdd74
SHA256174b5af27a45d38218809c0290a7b96b687a422b38294abffcc991be2a0c529d
SHA512cddc159240106daf34997cc9bf4e87e14b39e722388742ac3bdf695c82d05a80c821b79b8c574373344cbe191dd10ac33472586dd6ee072ce2f4814fe8e3f1ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da2b91c63e5513a1002b7a215f4e5bef
SHA1212ea32146ba081b0f91b1b92c4e9fb582fac5f9
SHA25674d00a76d9e686da52ba6687b8aff4d01190707f18e4d60e8898a98be6e75369
SHA512345918bc076c6b1e3b27bfe1f812d17dea1a13815770d11775a60e3c18eb6c1b07c04b34ea3233c46f183ba7b915ea22ffed4d2055be265ab5eb4bc0abcd8531
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5937008b024c68d4ebba74b4bc7bda4aa
SHA1fec53aa3e7299ca6027086a812a69ce5a398e6f2
SHA256d6f98510e2aeae707618355e6a04369b340890e8e5bcb16c31796a6b8bcdf394
SHA51224e814590f7181fc54c6cd945e74f25d2339f8d2ad209ab4e44d7cc07b6a23024651d5b2b59668b1bacdffc1db545a6e4c495903cbf9e29ad9b8a34e2ec806cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e28de7dc77fd011398918ed7b83d2c0f
SHA120ef35d6bbaf419a3dc955753b1086bceae05e0c
SHA2564ae1808aae19ce93479889f24586dc14497583f37e8b617fa90c10ffe4d10f06
SHA51249c89f57169814d933d5c8f2cc1ac587a577ac27b36716bc84644392c85a013076ef9a3027425cb8b38c1878425266cda19e1cd374a652e1c2174f75809a25aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b