Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
287b43986f2be995c3bd10c5d7e77cd6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
287b43986f2be995c3bd10c5d7e77cd6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
287b43986f2be995c3bd10c5d7e77cd6_JaffaCakes118.html
-
Size
143KB
-
MD5
287b43986f2be995c3bd10c5d7e77cd6
-
SHA1
64fdd954a8e48fa670b323c82bcdf9d41eed89e5
-
SHA256
e0a813ad74da5780ba58aaa3f25daf5338ca363b97b32513cab00469c98eaa04
-
SHA512
f9fc5d4ce2def7051f1f8aa8bcb6346388d68aa2a8dfb733a5d296c2f9fd6059a0ae67889139af441f958b3722210385ec7fea0d0350380b3d60c1bc57a6ebbc
-
SSDEEP
3072:Su0tw2GPx7dyfkMY+BES09JXAnyrZalI+YQ:Su0tlGPx7osMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74A02491-0DC4-11EF-8DB2-F2F7F00EEB0D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421394156" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2408 iexplore.exe 2408 iexplore.exe 1400 IEXPLORE.EXE 1400 IEXPLORE.EXE 1400 IEXPLORE.EXE 1400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1400 2408 iexplore.exe 28 PID 2408 wrote to memory of 1400 2408 iexplore.exe 28 PID 2408 wrote to memory of 1400 2408 iexplore.exe 28 PID 2408 wrote to memory of 1400 2408 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\287b43986f2be995c3bd10c5d7e77cd6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd1bfe076815eb84553f7a67a644b35a
SHA125741eae1b4ac6601900fa731ca8b058c9658a9c
SHA25647146d36aa741beaed8ada54c29cff060f9320f31a73de4c60b2685b7edbc85d
SHA5124e260de24bcfd04eafc05a41fd35b75dbf414cede5ecd015554bcf5aa5711ce21b0c4a76272d101fde4bfe6ec7167f83929df8e17cb11b00fb2861e52970e1f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec40098772e86f2becccd1586fe05dc8
SHA1a4d5b867b491e6ce9b0a4772e37adebf1f7d4993
SHA2560f797be61ef18174d8b43087c5c3d2337fc318a4939b4d27b59207e47e08caa1
SHA5121e4dfba74a1a92275f5cc23a35c14ef550be1a7ea3776a1bc0ffad8dcf5b945e0532c14e6fcc352cb4c69a820cb1a26dbb9a976ac51a0b1050499374508143a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c9b7d9bf8b55f89da8764f2ca5f95df
SHA123cb099d421c6ea16e5ff7bd3f13de2a1640c6af
SHA25667f421faeea99c194622f5f348647410ac165dd2e9a3e9d6ca89ba1d43c2d9be
SHA51211d33dd10087ce6eaa40e977c1f5b1f0609a4b2c4a87f438e587f9d188ddfece1d7cf9efa2d1d6b7b86df67de591574ded02af32639d21e6cdc85e523924fc43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576f83587c6e39b1284f0bc4fbc284050
SHA15b977d3933ae4129a4805e398c5e196d7ecce780
SHA2567613497fceedd940a69c24423d028fe9b45ada31355a9a837f5ae90d44f36304
SHA512b7ec7cc9d8a3a0bef9e1677954de961efece9150b3c94a0640a7f57b1454d319b41a648210172d9c5ee81757e64f68c8cd342ab4ee53332e035b26e4dd0661c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570f2086107f7f82b454a02e5917a602e
SHA16a16f28e11625b3fdb497b659cb0bae091d04817
SHA25669ef0acc94d9b676885af93ef9f7376265a2fb8a684b742a688df8d17d91f0ea
SHA5129bf82aff81b311912d525effcfd6251255b9769a8bb717fa3f6484cca7b68195bdc4bf890bec5373f0e8360263689e22bfbd4920e408e377cee0b94a7de5ab69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bba64cb1464a99f4f026f65b377387e4
SHA1547c5c959a4cd88fb7101825b4e25177c31f6998
SHA2561f4301f85559ffae53bf2ae48a13dc4cd771d52386ef97ed1c6da452f3e3a4a5
SHA512f3cc902122955915ad6425bb36223ee34631888936bac8e872fa6669e375a9e60c5b13462e4a7ea96e0e7bb6779c46aca0eb94d5fd27b741ec945eeab9bc9f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecda38d5113d68324ef1c7f58f5dd151
SHA11d97cdb46499f5dbd9c4b4cbed5d89bd18620cdf
SHA2565106f3e17096b06968cf3471c8a4c57df7e79cadd18cf0261c08b07edf960e4f
SHA5124a9770116d7af0f7b945aeaad286827019880140a58ab30dd612bf4793d8da98ea37852166919bbec3aa8247f82296d72bfebe8fdaa3fd5a791ad68bf92d7267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ba51ea5c776b3aafb523ade948ee87b
SHA11461e699b5febd6ff554f5117042a4a19421c993
SHA2564595f1bc3482aeaf38278285df65660410ccacfff346e2efc3e464ae07385d6e
SHA512c3f4d596075a987e1365465f0fe19b7e7a4ec8aacb7201a9cdc217e7a85df7c4c087b4ca0a83099637aaf0c2616b2f929103dd687f7e96206188222c9ea195af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c62a68c91c518b8eb1d23488205c8445
SHA1c17128ec6151b36f21b8f34a210021de4a4aa115
SHA2569ec2915d773a479a93d6af134fb857ce3e2594ffa7167ef0b26f75b0cb893a00
SHA51231d596b978b552b73bab729ed3d1ac88ec18b5856993cf1d462ee57e8d520d136b1de97dd2e3e53e667bdb1ae4401c46abf435d3d218c7565cc04d59c64b4e50
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a