Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe
-
Size
586KB
-
MD5
e760d9b22a18d4d1a60bca43adeb7b67
-
SHA1
5a92dc9012402adaeb858583bd1ce535e5a424a7
-
SHA256
130fa1c54405ffd54f83ccb8e95a67a4a190a784802a80635d09e8a338eab77a
-
SHA512
f8fc1eed46df8484149e74089f48d1b47bfb9ebdef489756960cf0a1c518d4f3c2cb60aa9d5fc4b5d1e074f4b94a56fe03bfada2fa53cb7756fa4e405609079b
-
SSDEEP
12288:JRCPOgBpF5PKvWqh09pEkF3Z4mxxVoLZGx5Yejd:/CNSThEQmXVoFw5Y8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2616 Internat Explorer.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Internat Explorer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Internat Explorer.exe e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe File opened for modification C:\Windows\Internat Explorer.exe e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe -
Modifies data under HKEY_USERS 33 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Internat Explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A9EBCCD2-F12B-41E6-8854-C5ABD48924FD} Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Internat Explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A9EBCCD2-F12B-41E6-8854-C5ABD48924FD}\WpadNetworkName = "Network 3" Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A9EBCCD2-F12B-41E6-8854-C5ABD48924FD}\aa-72-07-a6-f3-75 Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A9EBCCD2-F12B-41E6-8854-C5ABD48924FD}\WpadDecisionReason = "1" Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-72-07-a6-f3-75 Internat Explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\System Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A9EBCCD2-F12B-41E6-8854-C5ABD48924FD}\WpadDecision = "0" Internat Explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-72-07-a6-f3-75\WpadDecisionTime = c08fab9aa989da01 Internat Explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet Internat Explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1" Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-72-07-a6-f3-75\WpadDecision = "0" Internat Explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Internat Explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Internat Explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A9EBCCD2-F12B-41E6-8854-C5ABD48924FD}\WpadDecisionTime = c08fab9aa989da01 Internat Explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-72-07-a6-f3-75\WpadDecisionReason = "1" Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control Internat Explorer.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties Internat Explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2616 Internat Explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2684 2616 Internat Explorer.exe 29 PID 2616 wrote to memory of 2684 2616 Internat Explorer.exe 29 PID 2616 wrote to memory of 2684 2616 Internat Explorer.exe 29 PID 2616 wrote to memory of 2684 2616 Internat Explorer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e760d9b22a18d4d1a60bca43adeb7b67_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
PID:1980
-
C:\Windows\Internat Explorer.exe"C:\Windows\Internat Explorer.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:2684
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
586KB
MD5e760d9b22a18d4d1a60bca43adeb7b67
SHA15a92dc9012402adaeb858583bd1ce535e5a424a7
SHA256130fa1c54405ffd54f83ccb8e95a67a4a190a784802a80635d09e8a338eab77a
SHA512f8fc1eed46df8484149e74089f48d1b47bfb9ebdef489756960cf0a1c518d4f3c2cb60aa9d5fc4b5d1e074f4b94a56fe03bfada2fa53cb7756fa4e405609079b