Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
32bb2d6e2937abdbe4de69638d1c4bd1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
32bb2d6e2937abdbe4de69638d1c4bd1_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
32bb2d6e2937abdbe4de69638d1c4bd1_JaffaCakes118.html
-
Size
17KB
-
MD5
32bb2d6e2937abdbe4de69638d1c4bd1
-
SHA1
799cd8b92927feb0657ede109a7873d6287f9cb9
-
SHA256
2542dba0df75766c5c880863034d1ae2524a9d72d0833dbb0d45913c6b63bab0
-
SHA512
db53402bd2a6e50e03dbb4af97aa263c5c30cfa3b26a0e6fed2563875f069a37e8bf9b687491e73f8a7360e2c0044a3f1efa0861e4bc353ccc1d573223cab971
-
SSDEEP
384:SEuCs3/B0gw4mcukABSp9vfL7NqtnQFV9DdRDwHL6Cq+:SEuV3/B0gw4mcb7fHNK1c+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421563807" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73E56831-0F4F-11EF-9E38-E60682B688C9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2588 2244 iexplore.exe 28 PID 2244 wrote to memory of 2588 2244 iexplore.exe 28 PID 2244 wrote to memory of 2588 2244 iexplore.exe 28 PID 2244 wrote to memory of 2588 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32bb2d6e2937abdbe4de69638d1c4bd1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD57029611b106d19b84cc585e02eaa224c
SHA112a86a729b1d26f8db934dff36f0e21821cdc6cd
SHA2562163f083519198a742468ace5d20296b57c54a08af4abb8fd6b5ac1fabf11755
SHA512ccaabc8185170f78e79d66753480b3b14d2583574ee236165fe65df299e5fc94fe342af2fa71dc473e17aadab4db380aefc31363fef802169d495b43cb0d76fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5294716cd32c7bc2e452529a86ce63d3a
SHA1f0ce50c0db02b66cca223f0783bab65d1c70adfd
SHA256997772c2c6a05d33ec13d004cc014d35211bcff0138d1a19b91ff0f32931f62d
SHA512f9c4306f24308ef37ae13da373b9acf8cf7a455a8db6680cdf1326c1c0e16f58902b108929b4ff28fa48c20a6fbd5681de490e4295c535cdd67b6cc46d9d5fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525af8f45b60d9bc87d9bc01d5b2ac1da
SHA1c36852f522c63b54807dee328ec48940d9632dde
SHA256a4ba13fa0f1ec8d052cfe0d6bf636c48ec4ec97de336cb9bbe62509b069e8e64
SHA512bec5347e8253da84f6bfd22d016ec44e848ae9130d35fa1a005bde7731c76ed2112bd8381296444455733dededa96fb98fc30ec46b2781194f08cf647c1ad134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd8cb53e8aed39f0a7366aaf42231acd
SHA18da178a20bfe485325a877cc956c70f14f6183a8
SHA256bd596acfd081371b0ca4c48a0ab392db611d5246ba7ba77b9bfcf664e19579cd
SHA5122c8729dfc20ca2add20e2728a435f31bbbf50c8dc887c25981e440238c06661d581d9afaa0666b90c8f95a4d35218fa8d3075d3116759cbc18336624d264faff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5647bbe217936ba7a36632841e06a8aa9
SHA126805900918adf6a684724e93f17007f94b21902
SHA25618ca8e3955c3dae1a70e8e0290fe32cea6698edd3686dbdce8bbec5fcc056821
SHA5124b480b466ce8942de75391cc3f75f6d57f65142cc5558ecf9477098980b187477612657ad89669583e2363219a224d095904295fa7ae96cc7ebec31ae5d947aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d01d79e31507fc8f9e5b120971abe5f
SHA18abd809b82caca94a96d142efd0197f7873b9d83
SHA2561995bd2c32dd2d6d90971000543dd9fd4bc55998b01740bff2a5693c3a7f3e94
SHA51222d1de1d3833aa6eaffd2ecb9cf0bf92c26c3e27f20cc671a6d033063bbe0124d5788f3cbbf792be88de96adca702588927641ec27604ae9f1f7b2017d381b00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f0621fa4f70409849660fd6c276fe5f
SHA1226b43d6d803c250c807ef7ddfbdbf6744ff0acc
SHA2566093e2fa0268a448342e19b39627be9abd78e51932fd718fdb0d2b8822a17263
SHA512e8215b01b5766e8ee17130c39146a00df753b8b98c266b33e18502d7dde0300d8ea58305c331aeb8eaa4fe957d9ffa237dfa69e9cec3b5a67622e31ae7f45234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b483f1dc19d8dc5bc4cb227a01f1b66
SHA101f87670fbe111e461d52bea265d6f1cd25bee98
SHA25688f7716e6c0a77b36789a44d47ef080dded15b6c3bec1f8baa71d1c4c35482c5
SHA512654cc357eabc783189b13358e6692fb7b31e4ef507b1aa4c0d7875a91c934c543d9933b1b3d2db7ce972f241097e9013ce310b03fb8d8007ff6876d5c2466c93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51995fe528011a3834db27041b1e6b350
SHA1b8eb4fd2807a0d7e7da4d06398baa49ae31424c6
SHA2566ad3d1a483fbfaa74e2c5fe60ad9718ddc98e2eb354f2935ea9026814ea4696e
SHA512bbb9de5820bc9f7ded4ef005b7702fd0fa8d2239aeba2fcc100d62600c71de4f788ee70343529669a1d8b5fc0f78d64e13db653bb61d4095b8d48168b7278406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0d71d4831b5be282e99d574b0cd1cc2
SHA147fda4f083b8d6fad0a4f9051c51468640d6a641
SHA2564667bff4e6dc51315bb08d7500e38402cd8f0a984c4dcee0a9481a405db71451
SHA5122a600f4483a176e7eb93dc13a8960cc8b206280aac26685180514e8eabcb72d4db6b2e32a84f04172a1c3a2626587984de1fa7ea113489640460fef8ec061be2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546d2c8839178f4e662c30b51503a49cb
SHA1cee0723fc3619d5228794e9534d54e3bf08d0e9e
SHA2560f876a6b6f8006fb687fb8c61d068a02afdf12dbe0d83e2b879b24c7c16554ee
SHA5123878ac7c6e92dc526444cb1e5a501325a230efc5bacada28f71a49e0a7c41e4b20413a6cba639fb0b1d66677b85f62fe8c3e2532029ab7c30216616921e8ebef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52982234188dbee1d972731c8766512a3
SHA1469e68bbbb68efdb639e5b2989b49bce467571ec
SHA256ce6ceba8e0511bbaa90c6391465660064ce1f99f7df43a8b6bee23c2a9c0b320
SHA512a8840bd30f1b2ba179598ddd6e177d5be48e49f0ed27c4b0f58139593d30da6a4fa865f8bb2665c79a80db6d33f64c108a2e010a906b46b9b86cf287d63d5c7f
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a