Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
4b897ea285f028f57e96afcb3453baeb_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4b897ea285f028f57e96afcb3453baeb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
4b897ea285f028f57e96afcb3453baeb_JaffaCakes118.html
-
Size
242KB
-
MD5
4b897ea285f028f57e96afcb3453baeb
-
SHA1
c90b6de300eaec4b8a6fb7c7f7e18e2f0313f385
-
SHA256
8630658f797f522d03663011aa583353366bc87bf67480dfe2b9cf98b961eec5
-
SHA512
68d5f3cf011b731a9a1b720eb49af977333dc6cca8abbb39cbcf26858b70b64b0b99c91bae04fd99db283fc8d0c766736378f8ce4bfe59b28d4f0cd905f4de2f
-
SSDEEP
3072:rBy6klr2vrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:zk8jz9VxLY7iAVLTBQJl/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422031442" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40AD5371-1390-11EF-84D8-C2F93164A635} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1576 iexplore.exe 1576 iexplore.exe 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1576 wrote to memory of 2580 1576 iexplore.exe 28 PID 1576 wrote to memory of 2580 1576 iexplore.exe 28 PID 1576 wrote to memory of 2580 1576 iexplore.exe 28 PID 1576 wrote to memory of 2580 1576 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b897ea285f028f57e96afcb3453baeb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ade99cd2795526a283d5dd147ee36b52
SHA1693675b7c8ca7dae849137bb7d8264ce55d2f567
SHA256ac3e16027f3faaff3651b38c299ccfb36fcde138720f3af1ec02416ef6a7e202
SHA5125120049a7c925ef587ad25d8e79f621308ca1626402a27219f2c5eae3db57637dab1a88b4f04ab296e0fb77923b418a254d146acac821251fe2c1c8237dbd670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53078dcabdcaf9dfb9c21e2c8ca7e4704
SHA14e0f9de1840ece28577b66f77bcd95808cfabd9b
SHA2562f676ec9834cc623b06107144f1aa10915fecf2f10c34714855c534e5ca731f1
SHA512967cecd4d254bf19e60b3b5eab27abe2d93aaaf15abce2b28368a0eacc66eb747b113849e20d4c0948fedeab0345cb238662c149d12a3b88b75f23943b758485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be8be02425fb91c00c9db82660b680d0
SHA10cf3f575b9c7adcd2166f693ff7a0a1ccd3acb14
SHA2568719a2ee8cfc83a11d6e32eb0da7887717b260e44d7e6137c93b4936097dae6c
SHA512a9e045af84752eae5ecd9b4180b81f3399c32e2b06d6bde1c8a4fb1c5504b86b78c5f7b08dc0a98a98abfc0410c2995404d251c77ee2a0a23d87cace78443ed1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e3d95662e3a04d214d3b2d8110de7df
SHA1551a77ab8c2b37d1cca61ef4bb2c6a0f1f2dd477
SHA256f94c50b3b8fe4da743db13adc0536b2daa4abf2df1a599e9e98c2bbe7cda2aa3
SHA5127a8d5ba6a1cae079ed7ed0cc8342f245af87b5f8a025b33d78334116cd4129115fa68014d6d22fa84fd196f6e93be2ba235fc02e8e40da0565f827b3d1404dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d108e78eadfc104e40896628fe1c87f
SHA1f03eff1adc29fb0d2cd67fd6e81a0f02fd22e939
SHA256a1c73d2946e69388d9ba7fadd6fc18dfd2f444acc616f82fb8bedaa6d18236b5
SHA512741a44ef5865b2360dd0a2a3e4982ed91093bf3420352a3ea665cc0d6c9d153384a75caebecd72190ff1c8620a140712e867e927c157bb061be2fb887ec5eb49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d29ae4ef5263940d77077c811f205243
SHA142967aa0e7dc08629de976941903dd6fb7447c57
SHA256e810ca3f835b257eac14c7e6efac322369b8677b259c89e30b374ebad6d0dd46
SHA5121bc17a9a9c95b10647c9cdaa646259df1332c419f14e5a3046f0408f0abd591c91026b62ffc461e804c3b6038fd7d9fd76014e9df48ab4e319ee5c87723669b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb775d5f03d213f47cfd8ab528c0538e
SHA1079936f970304c84d4719c5bd26464851c2b13ab
SHA256adc29e88f50373ba4410bb99066053d26bb00739c9f399fb495a4bc601a77254
SHA512eebf24aa0f3f1f0473cdb9e4d59ba901478d0807654e9c354c99157731fbc745f33ec16b898d31f5b8ee658c8f2733f294deede2f23ce6f8ed1980c7cef045b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d57d7fd2ac64f69fd490ff267554e36d
SHA18ad3f18a3c7fe6d1424415455f24050264d7c964
SHA256229e9384bd830b3c47aae3b0e64b07bfddf5e0e134df53486bd4a8c45ae0daee
SHA5120f2608e88e5debcb08706b0173a5c26785dbe1644e04e957b49fc96dfb53812e5547467ff4fcadcc55db3dd9d869bc43285d271075bd589562190e8adbd2596a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57afcb7aee96b6903670f94605d48a197
SHA16d283702e0d578b3d4242be6ccc679c84f115e2f
SHA2568d9c261495370f972749bbe487abe047d4ac0b0aa8f1b96c7b3f8759f8274c80
SHA5128cb548ec27128e55a1d3713da28ce03a5f36a07ddaae87aade11953302e427e307317b53d8ffe3efb976b7162726469ad73092be439f4e7e043fc842734ca0e9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a