Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
44528491cd2805e8d212e1407b15d15f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
44528491cd2805e8d212e1407b15d15f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
44528491cd2805e8d212e1407b15d15f_JaffaCakes118.html
-
Size
18KB
-
MD5
44528491cd2805e8d212e1407b15d15f
-
SHA1
14a46ed6081048247135fdb07f1002e94f36b406
-
SHA256
be68a2c60068e28fd22d5aa361178890bea9f497e4ede0cc8bb16eebb8dcedfa
-
SHA512
7cbc40134cfc004c9a6b80910a8e41a58955e9a9ac6de09b32670794259d2275cc503bd5662f8ac4c6298c6de0493f23ec9ac0d54289410565232f4e62ee406c
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIq04hzUnjBhb982qDB8:SIMd0I5nvHdsvbmxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65F96561-1269-11EF-AB07-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421904804" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2528 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2528 iexplore.exe 2528 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2540 2528 iexplore.exe 28 PID 2528 wrote to memory of 2540 2528 iexplore.exe 28 PID 2528 wrote to memory of 2540 2528 iexplore.exe 28 PID 2528 wrote to memory of 2540 2528 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44528491cd2805e8d212e1407b15d15f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5747a567fcebf69c0eef1a1436232a6f7
SHA15af3fff5c01f778f06aede2161387c342b5f483d
SHA25664f53792b181f1dfa65af0a920f0fb3ff1193cbe3b9b0a8ae7dc8f75778413a4
SHA512ddf59b59734c7308d857b0afbd2fe1e22563b155937ad75182273363267a3728989b0b2f29aa3a4e217ee3405fec1315115c97525e1d3c5ff96c2bc4146ba230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd0b63fb20450a3ba54589eda8f4ff85
SHA10202223595101a44968b8221a3987228866e7bc4
SHA256292899645559aef19d8a5afac74715785489dbdb69951d616f0cdc383f6163d7
SHA512c2615477510c8e59f9787a45d130a411e856e1c62da2c032a1462d46d611b526289e3401a144c679eebb00bd91950f12d1cadff9513c20b2968694d0b9820eb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57886776ff6cb86e902cbbc04d0abf61f
SHA1282c1e1b29ffb35c48a9076ba5997fb96128dd47
SHA256f754322156e5a6e33df8769b70c5744a82ce08c70966cd959ce5993f8a950790
SHA512861d0cf2756413491103d54f85b9e39eb222de967e39f641af20f86ddc839b64ae055590529e373669cc1276efa072579cf764662c3af30be8e9c99f3134815d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cddcd52652156f3a56271986514b61f
SHA16422ed01a89141b516374db3d9f157ca7bf83be9
SHA256397f715c1c25bc817028fdf3a87055bf7db576bdd2c3c294536abaa83e712368
SHA5120b1f307c193c7ca3d3ab661fe625559616651de7e8ef6a7f50b00d5c7b865215b25bf1ed010755c0f74af6a5842cf9a70f276e611f8a270089d23c9945b3eb21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59830f5509864075acfd9ba4da5c462cb
SHA1f8c67ca1990bc4fc91a3d202af7e1d650570f43a
SHA2561c791bc9de8024b1ef58876c93fe21fdce12c61a94926cd3311b49bb8ccce396
SHA512ce08ce985de36a6501ac762dcf992eec40128fdf8e24ffecece5dfb826266bb309f14b26b1ac06d313640f36060545acf0dca6950a71fe1fe3a46a040c7be205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ab59ee0247036463aa82c9ba3832f8
SHA1bf2377f4a9e8b32d2646ae59b664e72ed2957ff2
SHA25641d20e92d758b7dc99d9299203c77ab860b2400d1084c1ea444b3f35ba2877b9
SHA5120d89e0bc18ad139240ecd4e2b9195c380ce6e2a8db1e157893b319a568362fac2e34bcdf2b0f31d8f405d55f1e72e36a53d09bd3a64e0c9f39dbe7381315a09b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a93a68d03e3ba2ce6b2c99bba031ebb4
SHA1029960355af4b21bfdd554cf47c66851a5e6010e
SHA2561296d8eb8f6319ceda245c44e9a00a679805aee8a2534b4f8108d7bd7d82e705
SHA51293096ef926b0d956f455fd93e0460a50a0b746244dbbf6807217bf44ed825d609a1f6abd71eac08f0a3438f9358248544e6990c8f5f1b7ddd1cb5e977f503176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5958524170bddaabde13bf0c5db9ac3e3
SHA1d02b9265ad95ab481182bd072825a5c755c57e2a
SHA256ba655b3adfcefe3ac65c493fd93cbeae20ae6c8a593b36458cdb91cd9f230cc3
SHA5120e780018694ff74b75aa6ecdd618c9a7d0098b555cbcd0438449bd61d783096d2f7a75f8f8a4a97713de3a84aac5478b627674c8fedd8aaa9d6082893f5b76cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5accf8b6bf3e9305ca87b4ef3a1089376
SHA145b2260e6b23fda730cac49abe9e3cd9b18c4189
SHA256ee7bbe73d4938952155683b216f9500f9259d831ba1ad155b3de1e2feb7e989f
SHA51294a898fcfac9da850168b29d7672d436c099afcb2e748eb48c2afcd5b153b2bed277436fa640fd04277cc1578f18e05302a7e9e7111cf9ff71a9cb566488eb91
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a