Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
0413e446de965b3137fa5b126a5685eb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0413e446de965b3137fa5b126a5685eb_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0413e446de965b3137fa5b126a5685eb_JaffaCakes118.html
-
Size
19KB
-
MD5
0413e446de965b3137fa5b126a5685eb
-
SHA1
1adc3c8adaeb1a2b7c85e75eefed9d6da347fb86
-
SHA256
e7733dd80193ab273e1388aaa9907e8571d64e9dbdf35a11f11e6d340f666b61
-
SHA512
68a99792602e8e817929c0557d6a4fa25fee419885e8dceb3b2eafb54a8030c535639faec23af890f7f5a7f33569c1d111ac48fb74eb5a6d965b59e6883900dd
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI14bzUnjBhdn82qDB8:SIMd0I5nO9Hdsvd8xDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420429787" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B52A7A1-04FF-11EF-B2C4-6A55B5C6A64E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1952 iexplore.exe 1952 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1952 wrote to memory of 3052 1952 iexplore.exe 28 PID 1952 wrote to memory of 3052 1952 iexplore.exe 28 PID 1952 wrote to memory of 3052 1952 iexplore.exe 28 PID 1952 wrote to memory of 3052 1952 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0413e446de965b3137fa5b126a5685eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b95300e172fbb9e00acd26fcd457980
SHA1caee32783cc009e7ae1cd7562f21ef49bc6f0d62
SHA256cfe8f056b23a2941885ebee5a435d709ba350a2834e271ea82c8a66b22b75e06
SHA512d417cfc4698d86e6c968c4320b3ef81e8f1ea831218e1cebb263f36ce05b1e079c40e6a8cb0359af544af2640f6999517c0b7586772cf300065b2236d45f8d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541b44eb8e60c2713c5dbacce04e6f44e
SHA17bf41121d76479d27a4818ea07d467cf28f51e1c
SHA2564d7c88e2ca043cc83349fa3c58c84751e16b500fa5ea56b0647a3005bf3e32e1
SHA5128f157e2922c3130c86ecbaeb5143a8286a50c676ae4c46c7c94d4f1c77381fb0358585b05b9ce08343e0806037bba90e771c9b87960ca94138f3b87a5b7c1140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1420b893b27a631657153619a500fea
SHA14ffd6886d8a296b9f1f0a3000b0f659bae2ab479
SHA25614731eabfa997cca4aa696c24116b34a0fcccdb8d62c667dd5fa280841923a0f
SHA512798f1b0038c3489a3397b26cd49e54ea3a3f5fb19e2d1bda98c563c937a5c19f27af27f58d0d64c3f6bad3ebd5b82d70d028a02146b9585125b915cf3ad84436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5767de48497dfc9062e536885716677e3
SHA1364e6626d504d4cf4aa4efbf78795f8e199511fe
SHA256aced2076da212a6ac9aedf7d0d1a31e6cea9175fed1b8e403ca620f1418ec969
SHA512099c886cf877e65fa759d4fe2d01c3853ff3325e7c1cf56d57e9eabcdb6a69d3239b8042439a9e10a4a70605fcf8c86435a869fee978ca56bfc568847cc3c448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbeebef8c4b342cc57fc88b4336c89b1
SHA12ec2c8ff2a3ac2d4a634b4596441a7c9ac1d446e
SHA2563a3be67b57d502ba908537bdd7a82b183336ed664ab3e1b71c113882c517914b
SHA512798208777c4b01c6052ac3d4666408ce0159bdc66ce1adde4f79a0663c1827377bb5608a7e0e999c0cab845710406ad3c0a1398f24222c4fc6eb79e3af12851d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bd2a31b36e788255f945a51436db7a0
SHA1f65fac4facb0169b14d8907b40515ce0128ba6ad
SHA256fc6ffc8e5290c277e8ede8f516990e6cc4b14b30c670d54936bd7d226b71c2d8
SHA5126362fafd3f52c28f6931ebb76b91c796c7ab9abc6b7c76a114659cea34f5040ebf01d9c1fb8d1e6b8d8ac864625a60123e0c17a15a1fc70b9559090cabdd261e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d82d463f166297e0f7aaa5d496d27201
SHA1636e18bf83cceeb9b015a52c1f8b7c036a1f3b3e
SHA256c0d0ae149771da4e49a273c6d1fc6219d695a8e7b325c10517ba9c14945bd2de
SHA512cf557baeed43f21080e694d48be08e40ae58a139147f30629a2e142a62b77c08f99550e627394075bf6c7877984f500413b8b592d9dc8b024a0fd43e82816662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c85bf8c18fdea6e49a2efa2d7d218cc8
SHA175b219583c4a4ff377a66aea493a1afcdd12de1b
SHA25651a7f965331a35592f921b5063bbe1d85571aac08706f6a9ce8435b56ac6f7c9
SHA512d51022d20917d6cb786b42b504f07f8aaf3e83ee359545ea5895fa2152655518c1613d429627da9d99fa54ae35b2895f7178cda3fd98fd7225dc76b3a8d5fa3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d972bf86682e027548abdb04246db7ca
SHA1b6e1911646561a55b558702867cfe1576eb7b508
SHA2565c5b707208496dac4fcd3da7011395fad95327a780a03f0a019168cdeab9d8a7
SHA512122a2ab53ff140838b4c8cab1bffaf29377a40a6d5d520ed29e2f01ee396a55e19525044bcb9cfb399a8db3c5cfd4108cb49c41a175feb4352e91060edca6eca
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a