Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
369411da17befc7eb16c2a8cabdb61e5_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
369411da17befc7eb16c2a8cabdb61e5_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
369411da17befc7eb16c2a8cabdb61e5_JaffaCakes118.html
-
Size
496B
-
MD5
369411da17befc7eb16c2a8cabdb61e5
-
SHA1
3d09477a6d03fe7c5395a37f57276e7f345ef572
-
SHA256
10d99af252bcfc67c98c590f56ce18193a4cadbcfc70bbd6c29ed4e1c6a22aef
-
SHA512
2eddf16d9a5e51355b9c3e91fc80dbe1e5f131c179c75eb884962964b42f3b4e19355ea9a96bade7384db0148084887a1fa2609708bf893115c73b866ea77054
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003236cf01643fa5c20c035e58f035f9d5e3d96be0d9197bc87950b6535c63fbb9000000000e80000000020000200000009759e520684e2da6285a515ae2f911d80c7f4c89fda24bf9f93d711bf0e3bd5c2000000022261f071d81413f34b54b471b7747e1773205d9b67bc6e0abdd7856ee21a961400000009022b5d86c008e765e06517403612d388872f841947ec36f973c2917f1ed3eb7c8b7dc7dbc45e4b6c244226cc4cbdfbde18390b661350e6b03fb865efd42e904 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001f5e1b86748b1f72016a0aa33877a6354bc3b25e09b7741230c92f93596bedf9000000000e80000000020000200000003461aebdbe8548cb3f9013cda2dcd4fe0654356e964c43ef0de0826d1502a17090000000a46e2cc84dee4e2cf7884bc66bb5044a51e3d5cc99dda5f6196f83a9134263811e7f0de87769cde319efb1d13b2cd100ece0e2b25e038cdb0560dba20e158cc0f5dd3563534749502bfc6bd02d6a1a5ef70b7374597e88d27c48521bc383270eb146be3e988f8fd6f30640d71e0759b0c7c1a252f814e1c420e31186cbc5811da2f412472b9ccf3b84d2aa3ca099650e40000000a03cbb2be4371586f00b242373d0ab123170f121ce5bcbaff01645c74eb5524fcf392d9b6f2ecb5aa9248b4b23866b80e4e9ab44aaa7886b7ddfd0cdd9e80482 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208d9c2fe8a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B264581-0FDB-11EF-8FD2-F6A6C85E5F4F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421623895" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2004 2916 iexplore.exe 28 PID 2916 wrote to memory of 2004 2916 iexplore.exe 28 PID 2916 wrote to memory of 2004 2916 iexplore.exe 28 PID 2916 wrote to memory of 2004 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\369411da17befc7eb16c2a8cabdb61e5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569e0586cff543d879b23159d959ea60a
SHA1e77f35be435e456acbfb43fac8491e52c576cc74
SHA256d5692eb974771fe1581cb170b7b08bd9779e02f14dfad41b7a834c48e16d69cb
SHA512ff7d6c5d57b7ea7f78f1bd12c041e56e9c78ce07b9bc01ed76efa172dd499a733a414fc212200b05384b180b50e8fca25b502a64669c29549af50e11a2abd2fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d85afda8cee9b68930f3003c4a269b0
SHA10e2b346e2a8a0ec3e1f0aae33c562fe25026e060
SHA256908887a1d2897c850ca8e8af7e699409500513787cd9c607e4ff9af0b270a0b9
SHA512d2f60117221e0a93fac3dd7dbf8e8da27c70ee4ebc167473246fda355ea53dc50c2e5e6e54e07d8733b30e4672813081d3819610ed8cf4dbbc36d470b6eda133
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580e60cd7477ff9d8c40d39aacc5eef61
SHA1757de766a5d802678b56fb894982c5da26f05e8f
SHA256bf1cd05132124c3e45e275275ca72fce2a165fb362521c8573cc0452d8dba334
SHA5124bd78368087fd105f24ab2cfed52ff975cf5747221a6847b020d73762cdfaa0ee8cea9afb1848970098f7c817e642d48cc350c6e2b662521f9ea916382a8499f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d85f01bfd13b6c2c483d99dad861961
SHA1ce0db9514026944a3f798a14be1899bed660bee4
SHA2561a141983c88562282ca1ed4f52257a82e8e8e8e31e816887e39119abac7506c9
SHA512f8d56661b4aeec09863af717bb867c31d4181a8181b116f76d5b62a7ba776c742fd973930b4f6bdf61c642e8c77934c5fa3e06542297f2071a9c4ac03ff00728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526b9616083cd6cf773b540558b4d73d4
SHA1a9a20283b04a943cc2bd6e6d7a9c7671dad91451
SHA256313c9b212d19ff6b2e71d270b8ef200171c75e7a769cce0bacba87a7bc6dc7ad
SHA512a9551865624d00c1ed24f723557a5c10b2d830265822dce671d3ef222901ff5d3a3ace1f665b1cbb2b32490a77480017429727211c233d319da4ad3eaa9d630e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dc774f6d1320e99b14dead8617b8e8a
SHA1ef1fbd48a1ceb18abb8a5ac6002639c38718a114
SHA256b4b3eefcfd06164f3d92dda4d79880e2b06a6f4b5ba2a29b3b95ae9320cec7fe
SHA512f0f13f73007b6d1a8f826c00d7cae0ba474b59edf4f58e4e1e11197e6585de3ccfbf86363bbc60c9ea763dd0f865b284d2ec568057f25c1d0a7eda6f3128805b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e816f1879eb1cd7eeccb90c7379e81bd
SHA16fe9049906d72f97f9023a010140602c5bc11370
SHA25678167b28cb1a0ff01440179ae1a93e806887d5d67f6714ee867551e6e5ed5bed
SHA51276b92c558eeeaa35dc649898cb1a4a641ed8a2d43d443c85e8c69697b2d42fd42de3b1d108afd4c2c3ee12eaaa07ffc381d368084e7d360bd774b84557df2c99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aba4bdbaf964ee67045263f2ad5e0417
SHA157a841dfe7ca41f76c4ac3e164698a4cb9e2890f
SHA256c0090f775a8f9ced2bec613624b4608ec677781a8c2f59379985469f789a721c
SHA512bbaaa6f51515c3deee3b7a45c39d3c073ce8184e53699ee9d968121efe3b462fbc79a29e5dc993d85067e1c86b171740cacabf84eab7342b797d7680dd7c7bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dafe2a23d45ab9a2ffd2a37a9ada39c
SHA18e5bc1914ecb98735c1a3669d9846c5db9f4496f
SHA256de0caf827b9a4979bdbd07967d358174c0543939380f46e311d44267892a0296
SHA51250b7bac6347cf399354a66f94eea06ebc47e222ae544231e71b9ad33b6c673df1ab63e9263523d0cdbe9624f62f808e1f14c509ebaf95aaa9a9ee631f4fa073f
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a