Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
06742dff208eed6738f4402ccb3fb170_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
06742dff208eed6738f4402ccb3fb170_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
06742dff208eed6738f4402ccb3fb170_JaffaCakes118.html
-
Size
359KB
-
MD5
06742dff208eed6738f4402ccb3fb170
-
SHA1
e98429efd713f5f3084d677949a9e6e0649a8ad1
-
SHA256
ea87942b26f09d7420247712f574f3308721ed44507a75fccda27bfb69586308
-
SHA512
4ae6ceaacf4f822b5321b801c94fdb8b91edf0841c4a2bf82934ce1cfab6eeb6026b9cb59c3ed1c29c0c76363d6fcb3175bd8e734b1ad9706e297ba72a782e00
-
SSDEEP
6144:WDsMYod+X3oI+YvsMYod+X3oI+YjsMYod+X3oI+Yg:k5d+X3t5d+X3V5d+X36
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8A3D431-05C2-11EF-922B-6E6327E9C5D7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420513776" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2380 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2380 iexplore.exe 2380 iexplore.exe 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2320 2380 iexplore.exe 28 PID 2380 wrote to memory of 2320 2380 iexplore.exe 28 PID 2380 wrote to memory of 2320 2380 iexplore.exe 28 PID 2380 wrote to memory of 2320 2380 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06742dff208eed6738f4402ccb3fb170_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bfb68129509db050ed6eb858f2a4fe6
SHA137373fab46670b16470115d6da7698e0cd4cf3fc
SHA2569e33ecec95324249f3959a695637fc6969f7262ac67bc6ddcff3ef73f8ba0db2
SHA512ed5f96582a3b9f19415ce0705a6fc931a001b535a11693970cbaec9556f26136df10e745e962d9ad379767bcd7e448288aa455380fc3df6093e720b21f920a4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b313b0958a3d14821dbe5f5d59761dd5
SHA12cb275bb87c7550f02af033d07109b37dec33d91
SHA25606308a9e1d402333a85d523f994a6674c8e95cfddcc0d213c741aa702bd3d5fd
SHA512f6d8811213d19823198c6cb3ca51c44fbf2368d78b25a79d8e660b44d0e1f86cbdadbf828b3af680256d9a837f13809392532a44a361f6e7b924579a42be3b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b2a6f4ab48a187b1cbfc19646952f12
SHA1c9c08a9ce53d69c4ebc94bcbca07f18fe41f5161
SHA25657e0fba4bf0f88a75ab66670ae0d982d9871a3784f80abaab779e3f131c4b094
SHA5120afab65dd4c6d89459f2e233d10ed501b8f39c5f0d35e494697b0c47ad00eddb04957ae13e7def2a797bf6620ae3b4ebba47132ae9cb41e9c0e829c967c04789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4e31b2e827b868919b02a8fa4943e85
SHA12df75557bda82f4662208a5e9d846aa1d02e2d29
SHA256cadf8ba13d3f7bfa61484fad7ed4a444c7654aa6b07b89b3e61b1d1bb870692a
SHA512dd32c9cbbb1a86c91e51cd555dad6c09103fcd5368faa692da0849f279180eae6c04f08f1b3cb5ef0ef24137cb19c340e25d42245ab9cdef540475a6ebd9c45f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf40d5523deb49d5107a14ab5254df24
SHA1719d09291b91f696ebb56222738fc15fbd02f031
SHA2561f7bee481eb11554ee44a1e9bbc6871d7d693439b45d89a8bb1fcf01ed927328
SHA5125010de8c049c679b0b1b095955c32859bbef5665db8dd14d413211df682b82b61a16b9baa05dec826917e4f531b1bd60346369236b30f043ae40751801dcffaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe5bb117f17f4813c06ecd05ac12ab3d
SHA147773c24cc818cdcbb19e681e1c6f4f9006e7528
SHA2567c4331193680fa4d8e7f58ec43c4d2ad476b36a1f9a9ecac5a97e133fb6419a8
SHA5127f62ef90355a84219129cd71209f952601fa0acb101e3a91f0da47bf1931011cf578686bcf6c2eed4a04f8fd878cc4254fa69e219494c8c6efd7fa1d520b805b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524a11b55f126fea90c474bd6e0558c78
SHA16d02ab2ffc2c7ea5ad74385144fe669314916f94
SHA256165f8af8795764dfe193855ec3b3a59010a5c02e97ecb1b29cf48462f6b8464f
SHA512d0a1f1d77f940bc9e1b22563bf052c26fe4653f7d8f195c5fcdfe49d0847c61596019c1ba07ae6d0894f76f25cd0e4680ab02f17777e1dcc6fa957a1e0e92237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ced6d52dadba67806bb9bd7c62fe23f4
SHA17febb51e4fd1f2a72f24bb01c6c8fbee2d5c6552
SHA256a69d276253e906fa44931ebce9629c37f1dd2c5c751221922a0041ea7e7bb9f8
SHA512c60db1f095b96507565e0dc806b515767126ce00990e7a351908a9dcc9b6023d442f464d0bf3385bfd7549b86f73cd2254f982fde2938d27e342008845b013bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ef2a44cd9fcddcd63f3dc1fa9d0f469
SHA1f9c542e5dac8c2cf1860351585d5499233ec7d9b
SHA256c6aeb98d502884636890e3d252e72f415019d8465be595273b39d102e0b2ab40
SHA512b153285c6e58287871aa91fb305180210ea5dc3e48bf58c19ff6566e4716548031eaf59566afb6fddccfa34458dc9f1120808fa240a90e253331dd9753aeb188
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a