Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
0e24423c4382ad46c407ec06e3a607a2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e24423c4382ad46c407ec06e3a607a2_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0e24423c4382ad46c407ec06e3a607a2_JaffaCakes118.html
-
Size
18KB
-
MD5
0e24423c4382ad46c407ec06e3a607a2
-
SHA1
fc877a7969787a88acc17951309d2c3471e81fe8
-
SHA256
20e58130717752dc27fb01ade896b192c0b47e329d8e82dbf4d07c074851d60b
-
SHA512
329bab10c5aa10d44ce71cf14755d9081612069153b1a01b8f9e54d2e2e5bddd64fb90e5b1d0bbf9b6a49f380174c561a1ef4f08965d5611367d254ebf8cc549
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIM4QzUnjBh0O82qDB8:SIMd0I5nO9Htsv09xDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9569E6F1-0867-11EF-92F7-4AE872E97954} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420804513" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2864 iexplore.exe 2864 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2380 2864 iexplore.exe 28 PID 2864 wrote to memory of 2380 2864 iexplore.exe 28 PID 2864 wrote to memory of 2380 2864 iexplore.exe 28 PID 2864 wrote to memory of 2380 2864 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e24423c4382ad46c407ec06e3a607a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520ca816f469ef54f0f54517b1196d851
SHA1d11a70005c9305e282e15ced5b319514ba62c8fe
SHA256545bd73dd95409b1f8366502df5c3114e3187127e74182b71dfa626e4d2e8182
SHA512acf36b331a383eabe622b634bf9a5d342d100fd2838ce133008e6c3be2ff0dd88806486b762192bdcda196ae739b40c41ca2ea5386fd6cb0a8f883ce7687fcca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594419ca5a172f07c6dfd883072986fb1
SHA18981870dfd29bcb6f204fee0bdb260395e549218
SHA25675aa8f2d5e6686b4e4b48fd49cfe2931c65b1b9655e683078be19541f55d882e
SHA5125b2e5b9367e7c281cd7a583ec320bd7c298f7bf980e4258b1ab23d98641e8cc6d8c8f087a9eb5c1a4300171b26a6639ea568d54f8e7a6f31031cec2e39a6b10d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d280daf01dd50ec645cc3b18e4dc793b
SHA1c217be2b0366460f55fdc70922ced9e93685953a
SHA256262f02e71e2c919aadaa62cf85eac04a54f3222d7af71c339a6ec1b31fa4d723
SHA51248e914774472b8247517f1da712cda44e8bb2e232074982a32ada88d319ef3cb44f9c8378fccfac2a8bee52c3a85d3b0097119bfda3526fad24c1d76578ae896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58adf6e9b1fd4af42a6e52eff9705f180
SHA1de6464466a004f5a03c84e0106248165492cafa4
SHA256bf9e3f77f3fd20031b2ce8e9864d5f22816d22db838796f76b42c179faf327b0
SHA512a2421145930faaeb42ab8c23a0802a6fcfae235132cfa6b8bdf83c14a09564e866f65bae416475f7b9e06906e483c83055834294277d29514567c2a2c7a0df6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b9ad75b99d15cc973e2ae60cbdbf9de
SHA19c19c4faf650dcb229210c168a94b10bf4e34c0d
SHA256e9b72fe7409d8087ede88efe57dc265709497d6650c891917887f4e963fcd7a8
SHA5126dcdd3f75ee9263bce5341798537a8e8c9d26e3fae8eae251a92b2900070721f5222f0dd271c2385e22305f465964463f8a7f15fe857ad840332b88442eb5fe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a254793c928079ff254b6f586a3eedd
SHA11f7832f218ec7ff634c6693f985725e611c06f37
SHA2560172c43bbf706af29b92f5179a4235988ef83dbb7ed5c5254225e8113edbf2fe
SHA512a51ab5956aefd13f0fc96d77b335c7c3964ad2f1b62cdeeb7c956ae065c4c9bd62444584578b9cbe1c305a4a7c5a0278f2c62667380d6772103ab352e84f180b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55775dac81f6bba0e06806d404ed68cd1
SHA1a62d529904fb51a519c0a100fac7e1285aece115
SHA2569fc6c2001fae4b4bb3453eaf27592766979cb1a1453605da7f32efbb2452d2ed
SHA5123f3a0cd0f4ef063cbfbe1f603b97a4259218ce849347d09b24460c1037de3530ca74143b41dff37fd928c342128c653dcbcf05948742b09620e88f1b3b9718ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9e615c7124cfb11b3afb7abe9bb79b2
SHA15531b8240e71408e993ad484f88b8d2f99f8015d
SHA2561835bd745b956ab8e70f5b9860ea594a65bb2f41e521ba4c59352e7b70ffe025
SHA512f0eb12eea11067902151bbf495f5e55b1c43435e15b125a0a8e0a5b16e8cf6eb65bce945dd30778825e79b6a21e4e3d7c1e4d525703666301a719b8b948e5540
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b55af8d6f9cdd6f02ae3e14adabd9016
SHA1737a5120b86882a063b586c241621a30a5067148
SHA256e624b8572d387b2cd1f726e848f3f9c2575e4c26ef0f5efe2a4118779499d3d4
SHA51297adcfbe79ba88d6f981217a44e0e8074564aabecd211e2aaa79982aa86bb01c015b9afa919a3ab8599253f7aa3eefbcf3306651c3148acdfb4c5a99ab4cff2e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a