Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html
-
Size
19KB
-
MD5
29f6f6cf047c5ed517135150c70557b1
-
SHA1
f34fc89417d837fe54d07d370110d8a03990e497
-
SHA256
1d87fd60573b166920a0c2b4660356e896275cd85c4ab090db01d484e6c2a9cc
-
SHA512
e3c5190d61c27f80c0ec0120b34442179cf2e82f2c0e0e7b3c59d14aa583b9b417f3e1515db28079a09e5bbe0b60b770cb70dadeac237dbd784242af5abefc4c
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIh4/zUnjBhhr82qDB8:SIMd0I5nvHZsvhQxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{557A4241-0DFF-11EF-B937-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421419445" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2780 1700 iexplore.exe 28 PID 1700 wrote to memory of 2780 1700 iexplore.exe 28 PID 1700 wrote to memory of 2780 1700 iexplore.exe 28 PID 1700 wrote to memory of 2780 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5075926808a76c424ef173859551e11d8
SHA1cd0aec3aef1b9299dca1498b59c86d758063ab8b
SHA256c8b08b59d5787018a4ff57eaf0b600e1a5126e10aa612fbb7f24ae8dbbd90a14
SHA5129a9cce24c39310ab12b58558940861231c472d105899304119dc21fdf866a6b9d09d9cdf23326a67fb3f67f8d93af559af877113a3673d8e91c6a6338030376d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e40a42851af27068a759f0c3a4d3c3c
SHA101dbd2763ebbdde9e41cf05d652b056a4203b120
SHA25656499dc5075c2edcea19987428dcea1e4d1c8e30e0d78c1eb27b951601ab75f9
SHA5121dcbdd8b5179df0e0b7ac01e8678e031c2df8d549350f25530257a9b6ccbaa434fabb6de3457aa8105fd0d50c269eaa9f35bdc2e7e1e8cdbc8c7bdb7d11b939e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e125d7c14ed01b2c84d69e96b0dfbf0d
SHA1313bd74e3b11e72f577e9dab303f19011723b6ab
SHA25606f41f662aba4e0c76e4677e2f4e5674c29f197135f85bb88f07b1272700b8e3
SHA51293cec5553fb34b54353533afe9e2cc93994589bb5af3f3ee9e53a9874a4b3708b03c7f0defa82cfd89882256034f87068145229f3851d56e11b20c0fc55b7983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53010b0ca37f7f0340c2d42b3d5a197e5
SHA1d331b8c2850c4e82a902938914010e3aa52e45dc
SHA2565d4b7d85852f42ce36b288ca2e320f4974a2c2b07524cf648da41d10270bacad
SHA5123e03f6ad558e4a8c9b5a803de56b54486867505320014249d36671e2a363072cb32eecd582cc71272ecbc9710615ffea742e0d6ca2ee6fecd2501099d2b39417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2fc7f2d76694ea3af420a9a99505de5
SHA1aa79418dd64da8eaa3e4e2da321383fbbc73625c
SHA2562e056b5d30a32a02d14548f4e3d217953cf814622ea89cbb072b96e096fd3a1f
SHA5128aae99ef0704791751990b09ad8277e9431b2f90d37d0a078befd2af6449b4a770d518085fa505865bf76e0039527f6b2787f80ab9d203bb4f57f9c131afc7e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef9b6b7db19d0a8dd42f5e306b27e767
SHA1de6ec8ff2ef271e667afd3111383841ed5771565
SHA256423d1baa98d92340e791e994ab3172a152ae837b7d14139c8d75faaf401d0568
SHA512f6a7360721f80dd5275fd8e566b9ea1bd1449a871df86fa5f8599dbd68f2c175a6261f87c7e9a9a64520a649a2c5e2a1f7d7a2d48105085994f990da42ce0719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ee5c7cc3234706f6ec1617625f21158
SHA1a968dd141d64846907a687c16d129a4651ad08ee
SHA2563fefe5fe70821749a1c0b8ad84024530c20919748f9c500d89e3b9842d4a50af
SHA5120fcacaf597b0331e9d4f61daa8ec553851b68339c50ff39baa27b8ab338dbee358ea804d1df9fbe741dfa91c1e43f51fbeaf1efcf08e30a81c388789237bae56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19e98ddb0659ee3c347a29dffef75b1
SHA1324bebe8089991972bbaa450d8da65b98a4d8f16
SHA25623f9eac1789f96b8e43e3afba10d3bfb054314b08f2bda08a028b1f58cfa44f2
SHA5122985e6df17a5b0ff46cb94b9269d34bbd71a7914c9648bb126fc7d7140d99a090197c2679065f7d440b4e325b3ae05d59cf82e404d98200b126d91b4bfe76ffa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a