Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
3bf2749d1d08582a605c3cfb21f63777_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3bf2749d1d08582a605c3cfb21f63777_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3bf2749d1d08582a605c3cfb21f63777_JaffaCakes118.html
-
Size
24KB
-
MD5
3bf2749d1d08582a605c3cfb21f63777
-
SHA1
642ea6f9757f9de0b4f7a9e0ce7ac59560d58b84
-
SHA256
df8082971300028b65d1a7a7049b1fdc2c2604fc17760c523c5079d7106e61d5
-
SHA512
bb696d520318747d26c2b0339a26ac0e70d44c233e898ec729b1a93e78025bdb93cea0a1919b51d3f94abd7accc911cf05c3581c9f7d47de6e4db3cf53343a52
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIa48zUnjBhQa82qDB8:SIMd0I5nvHvsvQZxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421707994" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A15C911-109F-11EF-B781-461900256DFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2080 3000 iexplore.exe 28 PID 3000 wrote to memory of 2080 3000 iexplore.exe 28 PID 3000 wrote to memory of 2080 3000 iexplore.exe 28 PID 3000 wrote to memory of 2080 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bf2749d1d08582a605c3cfb21f63777_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4750f5b5fda7f895e6e8a0f5ba5e097
SHA10e0480c643f6c96f912188218935884370ab2e33
SHA25693802e9cfab6fddf7aece84507fe225595ca64958fb9904d19a9e187416f199b
SHA512cd8af9532a13bcfd8378030cc78c3c20bbdb74b494be0239cb8c1268f01b5a4114cec923abf9654ded867adec145e3380369dd1ef93966da60a88c378b1e949d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aea5920122354193bd05fc2d1e8ae85
SHA1cf522918da518d7d1eae06f9b25f068592958265
SHA256a75fc25ccd0305e68cae76b279f686d3749382ea014bbadb71cc94f66955c538
SHA512d71c878080bff5e2970b595423eb156bed6e47cf98ce40157a56bf84262dc4f788f914a3899ec0847a8ab807e88bd6c27ab8ebd5f0d9fd9c3a501dca04b4ddfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b55c051de4bb01be5aef305393b9637e
SHA15c64be84ea181b25b7de562c8d41257b13fe6ff0
SHA256614534263f911cba0ccf8680843594b8827a4cb1cc7c5b7aa5fc45f82ec0aba9
SHA512cdcfe9cbeb457a5098ca2572abb53119a285b3a8212bf30e57942b290b9c93437ecc7515e4be15d15a82bc05fc6fb999c9033dcbb30fd36b5e10ff7cc2ff1166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c6751ec6f8d28914af6522d21c3fd96
SHA18e76f490535db1b73a4438932fab9c931d55b546
SHA256212ffcd5b1c8972be1d0504a0216cbbca39c5cc742f03e87200f7c112d6bd220
SHA5120032ccd212a74ba858dae47254bfeab84efb6d2cdf36662d2820be20479c41ffaaa6dabb9acea83302360ab6d0d3afc33879ceb1f5945c5b1a28f7cfe00ab2ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e61305cc46ad4499b69dd24c0aed1bd6
SHA12713130d8d7fd4b7873183f9137f65659793662a
SHA25694c7d1524e0bdf56736000f6deac714ad299320c57c73c42a75fa10e83230d58
SHA512bf870510f5c9a11f63f5da04780eecd2d2513a092063f6790b07582b6aca7f3f623534d269f64b6d81f5b849491214ae8e94a52b108dc18da4904cd959627c1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b17e66e581cd823a10180cdbe330e8ef
SHA18e930e45965f06ed006353583a3202ea04aa9cc3
SHA256673985afcc737d83815410777824c32750f1301fe4e7372c1978f48dc3ef7b03
SHA51253f2541f25e48b28e4ebdee25e3a0da908a24be52b3adf986ab0f9f1f875b1ca10ff54e8c62d027fd35c6212a36fdc20182a03617d48b43aae12e812bf061421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5203522d951308f29c9654d7b5353b073
SHA1aa6dc798f3ddec816ca7ff4016f95d20e091b108
SHA25634641c37d6b7285c6da524a97af408ad24a1eaa04611a746a054ac8ec2dbb22d
SHA512759531b28df60588544c9fd446afb9f0a22293cc1e0af3921be608275797ebecd5e0e62b3c19204b77e3f253510ab6b6797bfdb1bcbb5f2c8ef79a2a2ed8568c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5e7b58f2e01af37c165c1c25ba32377
SHA15da5742b566325dd2f356227380f45992e7fdafe
SHA25691b7ce230de0362221361fc1d0f3a8e788ca59409012ad857872764da4c20c33
SHA5120b1573c50fd7dbc19a046d6c18797ce895d1b006ff36e3c81924ecb460b67beaccb1a471b89710942d455eb28e263949e178048d6dcdb93b2c880048f3a1b951
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a