Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
-
Size
20KB
-
MD5
2a1d237e3f18ee6304016562a8c4a209
-
SHA1
5a2788644c30d42e752ac461e88a77aa1117a642
-
SHA256
1d3867b3440afe3369b0a22dfabf68e61c688118bc14c59ada17a364620541ce
-
SHA512
4e51b1ea3271b2823a3bbbfa43a6685a0b21e8981235345dd254eaa89ee96b2f3c1e755b647590429a3e5e16e59fa3804346281926140089612fdcb703fcfc82
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI048zUnjBhga82qDB8:SIMd0I5nO9HZsvgZxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{983D6341-0E05-11EF-8962-7678A7DAE141} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421422134" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2604 2400 iexplore.exe 28 PID 2400 wrote to memory of 2604 2400 iexplore.exe 28 PID 2400 wrote to memory of 2604 2400 iexplore.exe 28 PID 2400 wrote to memory of 2604 2400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59eb796b189edae89619d070e98bd43c4
SHA1dee76bb792fe0c00c215d083c05dfb517eabbcf5
SHA256284212731d6de36ebaae166a7787d5650630508c28b294d90524517ec30abdc2
SHA512194833ac58fbdd23298d816f937c0395bd2f622377c1c91164a540ce02c61f8c16f1f2e0a11aba83513b76758608facb510ea9231a4259c1865c91771d1519c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d092798a094cf847c88d42a6abb393b
SHA135a61fdd34c8f28a4cebd8f3141a86db8a9a1835
SHA25695df4c93ded7269d4658c32aa714512a70d8245902a6966f6c99cd64ba2d67d2
SHA512b9e699c74fd857534a6c80c88b34a51058f0f66d278a2998a8843907873d3b4bf2245affbaa8bef4169acb17a9a9d93ac25e21941c1538e88311253ec8b78401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507f38cf83cd0acc32de36258a6e4f5c3
SHA1d7533f52e8233e4d31cd394a011aae07fb2be28d
SHA2566205c45c258a6f2b0f0ae71c39dbca60837aa71a730f7d92158b018cb70fd595
SHA512cedfe6af93b69c10027fc20d72033cb840b61bcc7bd23a8942cd9156da8067f332bbf33401b170e6a4edec2958e233359a6c563ee27c5efd3f80b1642f9e7ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56090ca0496bd7833fb815ae2d69debb7
SHA1286ed2f4b9df2da232b7dde779fd7f9d0e080164
SHA2566cdbff2e5b71dbf3439f4ee032c8dbe681bfed4a99dcc52bacb14688c05a6422
SHA512a90279152594689c7c3ff1b61587546cc7a8e96ba1e2a5eb385d629dde32b42d0cfda2ac17757c7c89119feb41df94350b29af27146636ed367c6245d9d30bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbd5e3b197315ccc124e592c74d2d699
SHA13920b8eb2d6e5c2691c45ecf4d98c80bb321402c
SHA2569fd432754d8d8c6666a2c1c98b5d9b25a573bf5fe179b44d6cdaa6660b644fc0
SHA512801a85365b5e6b4e2578e9c23d3d1596caf9266fdf91e785a3d924bb139d4ff9f002eab58492b7acc6e32d3b89f80d81606a0c4c147181e484f6992240202052
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcd7e7aad3269f20119f7884cbd304d4
SHA166de29e3b938647f03fd9501e02f80d2d7704bc5
SHA256e63e9377fc1eaa8295e737a3f6ff6ff307acee91848dfed425ce0a60cbb4b420
SHA5120ae21b3960eaa138d1dd9907dca7d802da429cf125c8ec0dcf6f7c4f5a619fd90d967ba5d4c0c8a93f370f58e51d376b988f6ed73ff6d3bfabf17f6110924e92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59df990dd2894d59ac5d41c1bfa181574
SHA17b5b34287c0d378977b27536010c13b6c966c75a
SHA25602c12089785f0c16d6bab7f2f0c7753f428b7b7e60246404412fcb3d5360e5f9
SHA5123ad48fc5728379b35ea795598031e93c5f24e5b4fa4782f75d7ed4336c94a144dd7f8bf944b79c4b7c5897d3a2a8f663007df691b85f60854929767b61803d3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561e8e457948901b2240572d6f04749b6
SHA1e29939d95c5b1908c04db7ade75ad15f8d1b4335
SHA2568a3b819568adceed48fa274e8efb0f40661b9d13b168dc3a3c3bc3d576f7bc88
SHA51280ce66ef068fe3878cf326191ddb9c16113a464ff7a569c1bbbcf49c8df434b3fde3a24626435ebe71892e143aae9021cf2850bfbadfc860db90e6d095a9926b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3fe3e0e47cad2fc999dcdfc4c30cfbd
SHA1e587764cee11c55dbaa2f044c4f9c735f2f0f35f
SHA2565bd365b107a9b8c554b1f4cec1aeb176f2a4a15c98238c3aeac79c8a78c1ae58
SHA512372172458f170c434775ace030d55d61531331e8130528efc2a4ff204d6abf7aa0b5f5ac33804274c1c62693f972ce39ddcad935b5e6751ddd94ae59ea90d990
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a