Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_56979e6edd5099eade8957e709cd4a93.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_56979e6edd5099eade8957e709cd4a93.html
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_56979e6edd5099eade8957e709cd4a93.html
-
Size
53KB
-
MD5
56979e6edd5099eade8957e709cd4a93
-
SHA1
926c6b11c6c60a71dad54bc9b5022b94a1f3cdda
-
SHA256
02b3de34d4aeffe1aac481ff33f8d998bc08aa389f93bfdc119dbc84a923eb91
-
SHA512
a14da94682d3bf39f8abd9ff967e620275b09259615ad1fcf6874ba9edfbeb832a157d031ac6ecc3288bfe41dc35ea6599c7533255eace9b00e4858931a33b7b
-
SSDEEP
768:LpGhKRcghp1Np18hKSVdNVPOMXdRl3oFv+Hm6KDssMtle8D:1vp1318ISV7VGMNsWHm6KwsMtleY
Malware Config
Signatures
-
flow pid Process 62 2376 IEXPLORE.EXE 63 2376 IEXPLORE.EXE -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 40 sites.google.com 47 sites.google.com 48 sites.google.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C16E9D1-DE38-11EF-A364-FA59FB4FA467} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444313834" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2428 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2428 iexplore.exe 2428 iexplore.exe 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2376 2428 iexplore.exe 30 PID 2428 wrote to memory of 2376 2428 iexplore.exe 30 PID 2428 wrote to memory of 2376 2428 iexplore.exe 30 PID 2428 wrote to memory of 2376 2428 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_56979e6edd5099eade8957e709cd4a93.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:22⤵
- Detected google phishing page
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5bd2f268a579a59b9da92bdc8f21bc938
SHA1cdc180a32260e66475a2285d82ca42fe119624bc
SHA256bcf985332ebf6e1defdddb870f497c6630b18d8590daf1b59c7ac917c88f31a7
SHA512082b0243abad7fa3ee0d4a4d9b360456b1a5ecde813938838213fd039982a636ccb625a9815c6789169943c837ec0b96f4cb2536648c54ac3e4d22d6786a9f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a2c39ba4e0914b81d07157ab01f488a
SHA195055da5a77d4cfae6edc00695183dbdd389f64c
SHA256e6c81a2860f4c117817582f440aee132688a507d63d28d5a50e01423670382b3
SHA5126b4c6d9f2f1fa9b340d490642def25c6c283e2a493ec9b2e28aaa36d85a0ad40cb5d3ef6b49256558386a955ff7b101428bfb6612f4a5725d1716bfa909c7ca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b2d434c579060e48f9b6541e44207e4
SHA1522d55333b975d98f45c8f588832ea651c52d569
SHA256b5667404e2cdfc7382ba8d24528cb9bcdf4aa0a8de24a0c25d5353ed33b473cc
SHA512c25588208b0eaeebe8d040f9c8373811c5d7d0c23f8159d1e82b2c65b4c4f97d1e070a3c3323a596bdf39cf53f39c19dd6df7d35a510d5499d0165bc605ca778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ea4a620e3ba3b39ff4af8f9031adea5
SHA11b9d994253be38a04d70b0afd064fec693a9cb80
SHA256add16e0c2f1819e96916970f2008e60c8f93a432e844be036a5f12f3641c6ef7
SHA512ab167cd955b70408db04e0439a2f6e38c4972c5411de13bedf407f5508c6e7ad27198bafe204a79080b309a33e6b40b0a0806cb3e40f44a6110ebd7c87c3d3e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf1878c6f51f4561c004aabf14355f67
SHA189befc7d2baa0b5f7465f15b644f800cd8dbe85e
SHA25625269e10e3b341dd49fde5d1c14861c94eb9cde8c3c5108c2529b48bb8859b6a
SHA512bf7f992116fc03e6bc62c00e64462e089975db374c68e998f07ba90e474bd5527ca5f4a23ca4d40a0567745089e8c74a3d6a53bfd6ece9b379002b5c62e7b09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566854e0a818ac16111c098d7cd07ba8e
SHA10e23e5620a8c565e804ff4b62c42ee6ef6cb058f
SHA2560526f180709635ff8be3faae5eaeda4f26eab684bcba2cff6571d63a270c99db
SHA5128ccafd7cb078c27535816be95e0f346b96a0b4661bdca749d11ea5569d8621ae85563bc8e0738d75c55c7c4168bc8ba7b50f139c8efc449b5c192a0079e4cb28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1667ef940e62ef23211cf23e3eee649
SHA1f4bc2af399d124e2f24e68b317e2a2b428c0ddd6
SHA2561875714b6fa335e774b371e28f5f6c7f9cca122e925600d54dd0c68036668758
SHA512a185ce37891bda31cffd4100bfb5dad5f29c442ecf7ca3eb614a98d0dd5fb2447316f21829cd1b1b946238c43859e4682aa03d0fb1b477fefdbf17b735fe6349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6e8741053a3122fe34888b5ce35e7fd
SHA16b78de16a90c24b07f3c63037430e216768f45e9
SHA256917ccc2776710c4a89a2367c31dfd159c263e8c900ac72cbdadbfd0ee8cb3456
SHA512e68d6cbbc4eca2056b6824ac4f4db48313d7680c265bb72569d5c600a431c18edb991153f70fd7784f81b42d6b76b38b6602f05b570705a4fd2e9940c8223149
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d55e9e77573292a3ec2a5fdd75e57621
SHA192522f05619dff51da1c4d754703ff7e5b5e63b2
SHA256602d7d9e4f38e8f11b2c22982893c9562d17aa10cf0facd8d88fa21655908a3e
SHA51217238dea7f18da8e725b896b9f3c59b356dab163697d9242c1866d8ecd7157d3520ffe1f3368b278749e7d91a36c3febeb9366504556f40fdd1f27616ad187ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c51d1853bb447851144997d79436d129
SHA1a8f9a24a42973a38062f18bd3ddc64d0bd83a2cd
SHA256d6ead7ddfa711d1e5badf1c2a7ea938b366f460c1e7607242c0f37b1985e8ed7
SHA512a0b68eee5fdf71d783edbd833a301193712aef080b8e14823c57058726bc73b7ce8abd90f18d414056b70bd43b06c40f212c45f8559a06e3cdd73f1e3f6f0abe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5502bf87b17d6fdd5f3544fca04bb9926
SHA10aa4d59415731f39d8a1a386c26f5a58e8e97e8c
SHA256f59023f5511a534d3b3362b1e1c53a54246f682465411a202203dae46f4b18b5
SHA512a323662f835a2e7b6f82d929346b58cd89a32b762fe6becce5faa235ebb331a9e40d311c308fc5e1deed3e66daf27b5d5e1d43ac67f8d1b21ae51fc6230f9001
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\f[1].txt
Filesize43KB
MD5bbeaebc9c1f690ac2e612522faae46b3
SHA13dc75a098e5bbbccedb8aec45a5f4637ac4d2535
SHA2566daef9161d53d15e11ce56c0986b6830ba8ca47361744f86a30814f27e6c7583
SHA51240063acdc1af96e230640dbf714e02edda1752108a61ced98a25abd43b01476c401cd188c7c328c4adf621e9395b6cadf5c4bd8deffc05368ba98b2f980bca6a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b