Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
2949a1917aad3f306de29f995cb842e3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2949a1917aad3f306de29f995cb842e3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2949a1917aad3f306de29f995cb842e3_JaffaCakes118.html
-
Size
18KB
-
MD5
2949a1917aad3f306de29f995cb842e3
-
SHA1
8faa5cda06fedc21db8b87427b680bfa40a6f3b6
-
SHA256
a54367ce34bc0c975b3e365e5aaa9fb260d6bb8d8384a7e499de21420d207159
-
SHA512
bcf9879a6b5651e8c02ad5448881a05a5dea36189b0e7ef59bb9838b018fb98ac3b051a8a8685f036a407a0355b54072ceab25cb68e763ba3e99ca811a4e84d2
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIX45zUnjBhT182qDB8:SIMd0I5nvHNsvTOxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421408219" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32379CC1-0DE5-11EF-A57D-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1196 iexplore.exe 1196 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2208 1196 iexplore.exe 28 PID 1196 wrote to memory of 2208 1196 iexplore.exe 28 PID 1196 wrote to memory of 2208 1196 iexplore.exe 28 PID 1196 wrote to memory of 2208 1196 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2949a1917aad3f306de29f995cb842e3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fbbd14137c61837e13b1e2c55231529
SHA1bdab5e2588852d7eae5e4dc308ff9627a81461e3
SHA2565d343ae76b70284437c505ca27747b21e9c8a58b93c604287d2e217d5324a8fa
SHA512ac59a235ebe088569ee81764f5ede30ebe90c5bc66943836883b90b6f50455db7a3cbb58b41e0d4b116cbcf43603dc529fb736c98d516c356a6d7956c96a1bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573e45b2a71904dfe095338ed027e993b
SHA17c26666e0d5ceffe71bbde3f3c1680907a0b2532
SHA25661386aea49a639902c2b97c066f8e2abc99f75b7def224ff1cbd2ecd96b764c2
SHA5121f31210cd7372b4fd04f47f3a28f7720bebdc8b754a19645317b317b13f4504511fb4f985859ecfa3e8f71d64900b6739b9ca76da9b6907befad32c254010d6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59088c4dff0b23cfe24e96c081dabb941
SHA10fd7cbb35c56b8a775ce8c8391dc06262cc483aa
SHA256086043d5711da56fba439a11396f8a7d4b5b5eed57d8416d3d00368b46f9f35a
SHA5127c91fc158573b8901b3cb347c82d485c571798a86f753e376ad3e6d563181b895774d0b94a5890b46d01d24559291647c52183b75ad1b745093d198e85c87836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b5e63eaa5a109a56bc3d6518973b44
SHA114431e7f71243c27873733faa8be9109d4412a38
SHA256cfc3e2b603767234cf22cb52a02e45c759e013a60f643a734e4d1bca07293d64
SHA5124cb19540052566eeb9d8110f9f19b2786b7072d76a8f99b93c98e68db28d55d1dc7f35a9ca2740a9ab0f13cdad9a37cd06e4cf098c112ddccd045afa2ababaf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2f6ecf3b9dfb769bf7fba25fb320d70
SHA1505f8f1b3b45ba95e8cf4086a9fcadc6552fcd1c
SHA2562ffd492e45c015df6c2edbe51bd311971bb2d469343660b4836bfdb73ea665de
SHA5129657782df4dfa04a3a772402e03ab1908849b78543c641bbfd26baddd68affbee5a662c5dc0380fbf5a5e4cc68bda4502bbae45d90948c8cbd2e2b3124cded2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dc5b9c2a882634c6806ed93db44bb81
SHA12e0691c950d6c16cf1cfdd96ab591591706be65f
SHA256d673b51e91e3ca4c836b932c4a33652c08f921546dcef4a252f822d32c36f1ac
SHA512e3500fe63f142ef002120649b808884eb49a9acca46e1b7dc387aec44fe148541bbc88972fcbdb5ddd79fb41214ffb1e32d576eaaebc944fdef1fb510b1d5225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d5257d3cfd8b1eb427180dac061e4f7
SHA149144e3ae9611f481a638e106939710a5a032756
SHA256ab87dfdb8a0a6c89a4aada6276962df250e3b8511c2f17765ed472862e422109
SHA5121b62194e1afdb30c0d5685e16ae111f424277cd63a5f897b42abb6918c215253cd56d2e93f1051a0eb676876f391f6b8393658be357ddcd46f85ea015d8abf0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba8f5cb509cab53d40a83c42a71f8362
SHA157eea9b0bdb8be8e9b2870d979c75349fe808ebe
SHA256cc6acd188eb25be183441416bedf49a232999b395103b1e29e20f475ef380b58
SHA5120c4344c426a8211a0259e83c5cd84989b76d7e7e752b791e88db3160777481818ba97ddae136fc1624fc34419b37c1ca61667f2fc57b834226e26974b30fc4c2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a