Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
27b3eafc235fc35a269a2ae96fcdcddb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
27b3eafc235fc35a269a2ae96fcdcddb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
27b3eafc235fc35a269a2ae96fcdcddb_JaffaCakes118.html
-
Size
214KB
-
MD5
27b3eafc235fc35a269a2ae96fcdcddb
-
SHA1
80c02ba6662a38c2173fa19712fa0e1863f35880
-
SHA256
0177c1d5debc3efb7b1a3222e2064af5696eb6c6ee62ee156d3d1bee0f7b8072
-
SHA512
32d9831367b38fbf1662db45630cb439480fc662b2978e956551ec9f9a10bc0426ffd2ff9b40cab22629855525dbd232976b8c66308baa448638081ff88bb912
-
SSDEEP
3072:8rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ3:kz9VxLY7iAVLTBQJl3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421380972" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE662991-0DA5-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2584 1368 iexplore.exe 28 PID 1368 wrote to memory of 2584 1368 iexplore.exe 28 PID 1368 wrote to memory of 2584 1368 iexplore.exe 28 PID 1368 wrote to memory of 2584 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27b3eafc235fc35a269a2ae96fcdcddb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5852304c71b1ddf1de1d0ba62864d3275
SHA1bc5461951e59c60ba7a4cb7b6b84c9816dc6f75a
SHA256e30584dd2b9ed9878b29b603771462efa6128658aed1d1dd6b9bbce0769bec0c
SHA5124c02f9fea77ad38733e434f6e8f99bc08519b91fc31269c80d05b7886389fbceebc87e81071478680b55bbf209de40c9ee647644a233757e185ae6cdfa217f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d04d46a2b027c1e067cccef13254191d
SHA1cf26f744892f2e551b17de4842133c7d59b0dd67
SHA2563f2ed900a0acde5ddb682f00843b0a6c9ce5dfa9f56b5ba73d85e36704f165a7
SHA5127ba21bd544b844d96a82ee645933940571cc70408b483ed210f14b5b5bec8e1ceab2df147a0ea1704c73ce5765bbf3707fb105d82a5b72d86af9651be815e9f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcfe5fc3554f3217cbe205b7a72dd6ea
SHA183e81f44168345ed6cbe0822e3e847ac8adf3382
SHA256ff8d5e32e85eddef222374ff970f4c3c39fa81a1e02b70496d81eb9aa2a780e1
SHA5126d4d23fd8c7010b46ee149efc5889d932fc50c8fa45a619cf7fe30594ef4f4aa2bc91201e710fd4285848143f231297df12cf977f9bc17f8ed874fbfc7aaa8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ae87a8c52202b3cbeb5190d1a471661
SHA125586ee71490ef2d7639278164669840500740e5
SHA25642fac59a25afcef0435fdd55b0d383b51dad8dc11c69bdee299a6d0d1140b0f7
SHA512141333a6147d4f450a417c9fde69676cd5434181f13d4bde9742796c18f1c9e8a45b3856ec351c6c015d4c078cdd4eb45fbd128d554d0bbc69616ec07e988e53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52183a4ea98a72b822e74167717afacd9
SHA105002c6751e9b40e017c5c6165103beda1b72d34
SHA25659caa9105673f040c871af133528dcde404edb2e1dbbf3658b6fefac15b6d2fe
SHA512bf0581e36317bd1809430e0914b5ef02c51f9ee6b4a90586631198319cea10c5d38842a71821ec19512a0d1756b0cc489d0de3b6380d714f3dec4a451072c837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52030b170d49ac3124daf9375ce441b96
SHA15dc4a4cf29aed631b0a7b357f3b5c48e9f743d6c
SHA256c64f248da984182955a357c6972a938d6b875d7b4477922bfaa80a667d341408
SHA512227f9efa2763b802fcbcb847fefe1908d04407afe62863db2dc96d75dd8e7e00181559ac8653cc15f5bc2e7e2b8b89416da8d14149f8fa2c06cdb94901452a19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f56076396a6a761438b98dd868585c22
SHA1345d011bd06a2b93cd91bcd88adec9c847fac407
SHA256a99f07544742c9a455775ed9d3ee94958d4ffb2f579983349221a162663b2b23
SHA5125968b220c045bbaf860e6f498d19392076d6b2494475c102396211d5e6685cbb7806b508f8e12d9c308cfa2fb472f375622edb34ae8c33ed509f1052f20b66e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5358675c89776dfccd9171a7f96674137
SHA188862f63117a20dbf9ffb81bfd84b7e2495ea783
SHA256a0c02ab677274d0d792c8c002fc4c183d8816a4c2304ce47f12af29bfa8feb89
SHA51292e1eec428403ae4ac654e127054146c462e31911ba0f1eed2b6c286dffa7141df60a651ea9c278b5660ee21fa1f54193c114f6c23440c39777c89eddc3a92da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc400de3d8a124ce4447ff23aa5dc501
SHA18e6c786bd3e787064c779fc9562046f6d74d2fb5
SHA2565a2f8a9e93460318f517493a70b392c5b39374f8ecb46c775982f31a901d69d8
SHA51287c7f5ae91d637bf9d89eeccfb1d9884ee895001b489a1a32045f4604bdedae822931d599727c86f36b78c62a3cbdc859297615f6b1fd4befc8d11d6247eae0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cc77fc8d97a3f09570d3ff9ad3d3475
SHA1028ede1c15e82f6d5fceeeb0a85c89e49445b3b5
SHA25682b57a3ea830b3edb2eb4715bbb84932d8421602c2b473edf2051dc75145e956
SHA51268cac6ce0903bd5b078d0f3bf50a3baf91dc4c786eaa11a4e23fa2f8294944267e145e3f2fe3026bc809807a48e299517510931ac9de844df799af8623685b31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57787f93b3239b881e7be99069a57ee9f
SHA13a762678943da17eb6890170e35d91f2c1d799ce
SHA2560825b0724a25a4027616099b89c55763a692d5cd77bc81b5c08aa37062b09b1c
SHA512de9923bf9f07b07ab417ad8882134f93087ac3a5d336adbf5e32be51a8dd9ed7e6def25a0b725a4b89c3474bae54ae476928a9b8453a34a9aad6644bd403cdeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dfd0c5080acac42ae04cb293e497cad
SHA1c7530fbc5d121b675457b75748d2770bf423849a
SHA2563a243c2eb4d729fb2506cc89c6d52b8f5bd8b5c6f37a536967f68116510dc376
SHA512eaad083738d3df9ebe9373d1c487c26b7132b5674d983a098b669e478fadf50098cdb9b83ba61d33f9b72ef73721c9fa8f19c3b066a14b4e9d916828570bd2f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a94ee7a3603e9873338d2efb74a8598
SHA19d9c7ddc4bfb663370b48de84c4cb992cc164167
SHA256a0eb162361d6b7eacc5a79f135b52bef90aa283ee3a60de5c276bddfead56069
SHA512b6637c922e248161f6e7a469eea709eda546c53f6c1504e33c3452518b1eaa62a8342e5f5fab102b5757236f94ddc7dbdfa0a8a71afd409dc79b4e6a72fe2641
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a