Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
4c08cef432c0e996050745e7ccbc9eb1_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4c08cef432c0e996050745e7ccbc9eb1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4c08cef432c0e996050745e7ccbc9eb1_JaffaCakes118.html
-
Size
19KB
-
MD5
4c08cef432c0e996050745e7ccbc9eb1
-
SHA1
aff3fe7eda2bc99a0e13e03e89a3a78b5e014800
-
SHA256
ff47a7f241ab29bde89d3574e28f08bc16efae2092f5fa777a2bbf5bf1245bb6
-
SHA512
09dd12af7849a735eea7b344237df81ff8657fc511e9eaa5257494fb83247628b031a59e2fe2e1ec60053ec58d8b0ff4c442973e1a9c52352c84c214d3a209b8
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI24KzUnjBhm482qDB8:SIMd0I5nvHhsvmLxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422039255" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71024AA1-13A2-11EF-A596-F62ADD16694A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2584 2356 iexplore.exe 28 PID 2356 wrote to memory of 2584 2356 iexplore.exe 28 PID 2356 wrote to memory of 2584 2356 iexplore.exe 28 PID 2356 wrote to memory of 2584 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c08cef432c0e996050745e7ccbc9eb1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dabf9968ad087646e4e5e869fbae92af
SHA1fccd226c20a5b1741522ea7403a5c44d69f46d82
SHA256643771d9a47552483ed29ce750f494d2b59d2f8f5891bd813a244fd4da231d5e
SHA5128fafb859ec189fc820c33a993a59cff9015a0621cd42cb85ab87012d56a07a1053907cb95e626ea59253563f80a170e1afb49c260926b813b73cb94e77e5000d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aee0a214ec87af8a580f034c2c33abba
SHA17db8f8ec0f1121cf16e76b9da2f2095a138e0fbb
SHA256da6029f2b8b9025dbbb3c163acd4fcb3bef829fc0c91218938b906211ba1f64d
SHA5124f6d3400a04917550d0bfe72a10d5a7fd357c33daf61fdb633b49114fbfef2332a0a209b146b0026b363b676b3579eb36070ab06476fb54b49224dd89cd662ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a22f5c1cdeaa128f715357bb55032e55
SHA132bd863a3a8fa9953deb1ce815732ac6b734a1a9
SHA25612c950d1ff578ed93d0082f0e5f1f01801c979423b501fcae27915a022400c6d
SHA5125eaa7317ad0632c89480d6f47db63e18eaaa8897dcf440d45e48c9c5493aec6405fde613e86bd071796957c79c137044dc75bce92346ae5c079ad44e92bb3c32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502c7e0e3b76f8534270cd0f3c4d370fc
SHA143a05ea81f8d9d39d6163560a40aec2efb9f05bc
SHA2563b3ce203ef8c68a1478bfe6217a9dd4fba3ca52edc699339e61865b81bc5dfb5
SHA5125ca5e8d7da0cf9a7894e9fd5f569f615d95684423ce518e135aec840871a7a91a5d3d4428a742e800270f2094629bf523a5d4fa7710b47a008e159946e42ad75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9bce66ac65ea5f570e5c19f814f18a3
SHA160d66797b5d7eddde278394d5884c1d2ace36bce
SHA256a800e4bac11761ca83fd668094357bc4c642c283ae238ea852688bee29de62b3
SHA5124959ccf61dfb3d262c8a9be10bf9b8642c5ef50c77da495d0424eb70cfff1300ac877a3c1bd96a5413d5eee3bf0221532b743c6e3b09c663d0954ecd43f147fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55403bacd5df42599a3b0e99c04464409
SHA18546c0a4b9d2b57642da9f7319d4f3228574ed42
SHA256f1905a0d1c52257240496f0dd176baa42a8c5f021919dd180f6d6927c70a2e87
SHA512b4da7028f98e78dcc17aee2627e6c0bae121dd622e7b949bede9c771f607863b7aef9d2f518a0d606d70d83fcd6056490024d6bad9e4ce16d75e5d946c15b717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a745def503861167599449dee566a7de
SHA1b093d6db6116a979540e8de694a196a9f7d15f77
SHA2564fb38792d9a3032a5dde21683b209babbdbfb149b8a8c747618866c0e305b6c7
SHA5123c5b844ef41bd69351a61a59a0e85576df88ce238d535e69cc72b5efd8d6135c189553f119c6d46f3af517c01062135efcbb9c8af87e3ca55cdc9ff1f5af53a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566ab7021e5bc4ed54d2dc1e993ac2d86
SHA1611f7f5ea6e7c45c21bf3a2ccc0ef68aa5d3a9fd
SHA25668bade7f4af878cc2ea8489fa694a965e64e4eac916662cf7bf6ffda0810a308
SHA512027e30222ef5df23baafd8a851a38f30ba8f4092ae723e1e61cbd35cbd65229589a62b66db0daf8d218748315b42a055115488f58afcdd72f5a0ba13b8a3dfd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566bf9aabd753b3408810f3fdffde878f
SHA1e703d866431b10564920abcfd651da30c7d8e6ea
SHA256b708520f823d5207f825ee35ce607da7bef894eb6132dde66278861753e91214
SHA512aafb071cadb2583d772114e11a8bddf59fada44dd9955181737733a1a41c19c5ede6859fbf7e57e5eb8846aa7e96a6dff6bed01e1e5209dd22c5967677ace42d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a