Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
-
Size
241KB
-
MD5
3b3b26573ae736ae332159230cf81aed
-
SHA1
ae55ee818e4ac5748c3950cef1fce860ecfe2ffe
-
SHA256
2af8ad47656ce30dd686299e3a3b4df5992fc6f0fbaf32a294e5d96a9d2a13ec
-
SHA512
a4b2c7f729645b7e69bbf722b2c023b3304e988ffd5af1adc750e88c24788392108158950f39a295b4cef9fff8ca3dc67a9e651a123b3132b57de9adc9dd1365
-
SSDEEP
1536:hdYkmBB2wP+KGtNc6a1I3Z8V+Q6yPr6vTQRGXRKeEWDnuoSfWVM0VIcJMvNg7fsQ:hdYJPxYapMCSRSJkM4NhsZBKt6Keju
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C29B1BC1-1083-11EF-9486-4AD8236FB259} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421696223" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2760 2208 iexplore.exe 28 PID 2208 wrote to memory of 2760 2208 iexplore.exe 28 PID 2208 wrote to memory of 2760 2208 iexplore.exe 28 PID 2208 wrote to memory of 2760 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa4fc16c085cf91607a0276388e7f4e
SHA19c111a150935963cf4e573e93651b42d3b91c017
SHA256579173f4a0287baa2534ac0b9ce9c21b4c155a6f2327d74896ba0ec5988eeaf0
SHA51205fc7fe4c18ad8d91ec715532ee24e46bc7d43fb34074c1babb01fd50efe38dbbf4613ac188fb92ba3e5bfee92c015ea6faea0dc2ac3d750dcfcef408afed592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548c2074ca370719409979c85d680c436
SHA15d4e9032ae61c04c9dab6134371e64e9145e98d1
SHA256f8566913e368d47f33b8fe601bc1acad5875c721315f92a012ea323fbc409bd4
SHA512fcb7c99fc582c35c53b3cd26553b34ad2054ec4ad988045bf209158c6c3281bf18369f0bfcd6c1972098163f08e2c5705a8f25076c00e52b98c836e37c738a7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516192193d623dd0004323f2e35546c4f
SHA15b36d5025ca0e06104e8346afcf2a4a345d8ab45
SHA25642949ad35c51c4f5175fe29c5aea8af8123e90a51ed0a400f4998569f0a1e292
SHA512c5c7e2aa09619315523fdd6297ab4cedfe3b58fc288ae828bda39167bdc492bfddf0fee8f5f4149dc7f2071ca6f7ecd1e5c303ac7e61cfc50bc19ad2ddf6dd3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506479b6926663a9331a35eaa3ee3d11b
SHA1e16c79d2d582a386b6545f93b419c0480ea93c7c
SHA2564552b5fc93d99505285604293a4740f08d0ff9ec173cd05a2378b1ede0066b5e
SHA51297a46287498f4f94977ad5c333843ff9b9a9564aba43946d111ea02102ba1a779f8597ce5560c5c93deafd5c6bbf70b8425ec59d95577795135a74b74c8eb78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56205e27eee77220c6da066b87a183743
SHA1b588380c680b8c430548a98e730c48a7e6b13892
SHA25625b42b2932407001f4697fe7a0cfda32928892026b582ade716fbd84a455caff
SHA512b1cab3b62b1ee8fab74ae077b0168776344b428d4b8e23979f65db0b562ccdef7ae8b1ce8cc7f4a211ed64298303744b88fc3841cdf011081df033e901c32ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eee4ffbe8ba57f88c2a04dc9a0b5cd2
SHA171549b11f3c0b9ba7500d7461886caae774b3d1c
SHA2564d890c429c93e2eb92b050d1ed03d58fd15c421a3cd52c7c9cab096ea75ab5c8
SHA512cf7b33170073c31b056fd4f388ee485fc20b47aed2ec4e8ee0dbcc546e49f71f309e9ec0bc78287c59131d8469f9a00550a19405c9348172814d3d24e1d6f274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bcfa3a73113981788e38d49c88bcb0a
SHA136eedb95ae99582503b5e3bd112d41451eb0529e
SHA256f5ac9da0743967a678373f1cb65e613895068b4354711c6bfc3179de4aa169d0
SHA5129597cc0c12ce7b70cd8d5a9ae6f290b58d0bb9b46162098e300f3582a1004fee3f6673219df4750f092af86af10378092225c9ce38711ba24f19092607f70a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500780352ba29f40ea67113f651499adf
SHA1987977a16d9e2715154e42fa46b99b109c118986
SHA256783aa643e28faf05dd266cf901d295ec7f430e75fe242bd9c171c11548bda6a8
SHA5129d854f3f0654fd1564dc2cac08d5fc7c1096e2c76b54ceb61dca6f3d9cfeabf585d063c28a7b1b48e895d35996465fb4d0db0982bd8b4e42383636cf1040d989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f81f344a74bf1d612e578690bbb10ff
SHA1c291cb185d52ab030f3ab2f4be29795c113dbe86
SHA256b5e56d558a788f0cc757ae8e65c45f8b3d16fa470c0f5351cb80a4dc3d472f0f
SHA51230fb57dedf9c20dd8bdf8d9b2eb4aa0867fa6b047df679bca5fbb2106cc388724023ae27a563aa002361bb7791f8b281a707dcf6d2cd9befec877eff9a205440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b674a8a52f9af8b4301ca287047181c4
SHA1f48a2d72624e8868f905acefa825c98df0a9b069
SHA256010a7b28f79d45b5f42a9897db614c85e6e7a326ce39ff90d6eaef1d5ef88262
SHA512cbdcdaf26c0c8bc15dfdc2a8bd9009c0b692552ef3f36211abed06bbc8315cd6f8b49dbfeabd6eb6d64d714f910d0aad18b1f05b6bd747d1a9989e308f479e7f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\b[5].htm
Filesize178B
MD5cd2e0e43980a00fb6a2742d3afd803b8
SHA181ffbd1712afe8cdf138b570c0fc9934742c33c1
SHA256bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
SHA5120344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a