Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 21:06
Static task
static1
Behavioral task
behavioral1
Sample
00138e9c83786cf7e940faf24a1d7cf3_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
00138e9c83786cf7e940faf24a1d7cf3_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
00138e9c83786cf7e940faf24a1d7cf3_JaffaCakes118.html
-
Size
2KB
-
MD5
00138e9c83786cf7e940faf24a1d7cf3
-
SHA1
e93deb25574783851c7e9178ab3c3f6878f05f9a
-
SHA256
bd014f1b499402654366249e83df0ab2920966b7a475f078a3c03a5b5b44fbaa
-
SHA512
7d9c82e35d1f264faa043782dc46d0067130ca6477695db71c8801dc8d6117e2f1b040ce5d192172db4147ba046e8767298e23458d659415d68ee5f44a26295b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1F1B7E1-0347-11EF-9DE9-520ACD40185F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d612758f5d2536fb839c563cfa8bad85f32858ebb5ebc650fd0b0d97b871894a000000000e8000000002000020000000c4d69d2f86e48efee1daf0d0204d77e8598a7f425a5f538dbbc4cd671444623b900000006b701209abecf5d2bf4892af4edeadf347ea8e00d74541064e925b25050c9853984a87054e160d28374d77265a354d07cfba1d18ac47bd6448065dc6899b09e6f48d7e3a608d4fd96e4798b6c3bfa8ca111cee4fc5a6367ea4eafa5278240ffba568ca5ffded441c65cd02b85b90d0aa89d037564b0a74ce6f27510a492c889d09f8c723643fd2c60edd5402f728f5af40000000d271a28dde1adc52d5fac3aa4f9b8665963e8025fae59a4403e3be0cc331db9f7a0a0f7cd1bf0b0acb930d2225681ef69a02c68212072b76371482d7d8ce40e3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420241088" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009b2190e020617fc3e33f7770e92008940fd66587069added1e23470ab2594ea1000000000e8000000002000020000000fbdd098cb207e6bf04e7f3c662ea1db903ee8e95d35886bd2b54f00a02f5b17d20000000a63a9dec71ab401dffea7ed12c96be0691b7b47db49b98b493e540424a2f45a64000000010443b453a726bc7f6c90df027fa245e60e4df4ac97b66923a98fb4fb823ec7d7a90be7331022558c7f3cdcc1325254aee89ffb6d183fc177cccac9b4aeb9872 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002b80965497da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2760 2956 iexplore.exe 28 PID 2956 wrote to memory of 2760 2956 iexplore.exe 28 PID 2956 wrote to memory of 2760 2956 iexplore.exe 28 PID 2956 wrote to memory of 2760 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00138e9c83786cf7e940faf24a1d7cf3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fd0dad801f57d824086243f01ed6dd0
SHA1dc5e48afe1b61b3ca0b74356c277b22816d896d8
SHA2568c542ebe2b2ad99c80335f48191882d23b87471943f928ee77c2fabcec8b1243
SHA512936af8e6a473c0b15941e471879d41d90f4d5b799a5a91b7c03f6ca4989262745f2528c3f2c34d7824d5b3245c6b0b9442cb046c73303775131e1e21d7e4aa39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba91a1d1b3d935265a678d49e95a964e
SHA1c225ef99f52cb5ee34e10f87f53d073afd8ff7f1
SHA25690d6f202679d1ea1b7c32a0b156f09434d73df4fc8321109a1aa7b3615e4d372
SHA512432175b1c46a14716ee6d627c237eeaa08d7c502a33ddae159498aa35fd35b4e25d5c4e01abfd0d89201fd239d50e412058207c02113f8f9a42ebc59a9317b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6e4a7c054e44fb6ed080d3df2db0525
SHA1799e13bf47f80bc0d00e66d68d31b118b982c6bd
SHA256d8e6084284002c0c3886dadb008c798c6772cc11a604ec8deb91d9dfcaae1d60
SHA512a832aa3a9dd31695a1620ef75b785c52411abc4263d76388b07088e9c0ab268da6336e14c7da2c49b9168048c8af8838bdd146a169060e621bc1735035abcaf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdea4ea6fc1e07d00b0fa726759274b6
SHA1334cc4d4f7cd3e6363e9f0394eb06077d0fb6e86
SHA256ac869e7d82923de8b2acc4c19bc59d3f5d6f30489c92eb0ff4525cc24b813676
SHA51292f13a9ffb0c4cb17ba5b1b64f388f8b5703ee065189426f4e0a31ce80fb181ae248ed4ae6cd6303d581e4cec2a111c10236231ea60120b94ea64d5e31da410d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e8da9399d41a93b90401cbc305d9e14
SHA118293c766d80d8990270532f32dc8fb1a0950ffa
SHA256de75dbdbda256c8a542c91fcd36a18d5cfa0e00c90efde25e7e228649d8abfd5
SHA5129e8049b87e7d3751c841f75065fd59a5f01393fe9cde8500c02f2f7c63996f4656ecb055ce88523dba6b2102adddd2234d6b268817c065fcb7bad4efcd476938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a63b380096fc98257f98fcc80403601
SHA1b735f987a6159c671c6aa0ff80a0fec23b46c42c
SHA25618c78442a9a75721cc681a7d097fad0629e76b11fe0216f6708170330212c73b
SHA512dd510f4abd071f02151e6fbab891af6279961e597980b760296a03ee1dcc7c020fc2e13c190ff7e2dee9792dbeaba4898c5aafd716aef919c0fd37a292572162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a73bcdb66d3ca929aa40bbc851c71ab
SHA15c96b5eef158ea770701d3b4b8ebbc195f4b0fc5
SHA256067236c3a0fd6dc24b79936133397f72296c797c21595426858870c49f2d3ba1
SHA512d5808c332d565ec0f95da1faecf787e84c68bfbcc97e1e4ff77cc39f341075b84a7e1c574510c1e9f8383f9eb5a722670bec60b1560d666fea2c08aa39088910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55200553f31443310bb93edf0893a8f79
SHA19f4124ab4651c305f8f07bae4139d59b02df0a81
SHA25628461ead5fcedd4ec3af4a6bc5709febd09d9f9fcaa8684334e562fea673f6c2
SHA512ff2068af4e75a0a8f7f042f2dbe028818f66e986e1cefcfb933f3b407170f0bea6fecfa63f93cefb94914ec2b7fceb22dd475b5db4d727cce9eabe728c9c5309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544a5c49ebf986df3e9101585ec10f20d
SHA17f390332f3b0cfaca5f64655bd4beffea66bb5fe
SHA2560a6a502a0ccddfffed24bc5ff2043ecb298167d29c90d34c42498625188298ba
SHA5128a0921a3da0262071dd723c08a41e7d38dbfeabb47911f29000547cab3c08827eb39a01a3aec5fb1ade7a3305b3b0feef5a2c7f0e0e50043bbf4c50f968fd74c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5332f550a816d0cfbc53aef5f58afa22b
SHA1bf954be278c877df78cdbc583291b1956934dddd
SHA256018df1be88abe7c55c7349db658f12f03280fc9ca349d782fcf94ef52c74a168
SHA51217098625fb3fd98525ce121b45683a4a56961df8c6d7d78f85657354c821b812229872c07e5037663964db4393bf547dda68a86b2286393ff85b18d9eaabc4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556c11feefe28046623565737fc36af12
SHA11e37daf6d04c9678d4dbdb31040102cefa318a72
SHA25683db2874b76a9a6ae77f628968a0b80a8438df223080e0013e0a4795fa225cb5
SHA512872563839def8f9982fceb1c370c33a343b2e338be62fbdd534cf74e02d7c2eef15d44b8518b13772ef5794b97345750e59fc726402bf9cee041b867e9926a16
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a