Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
4fd64b8f965f0c5aae982f1e0d76c3cc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4fd64b8f965f0c5aae982f1e0d76c3cc_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4fd64b8f965f0c5aae982f1e0d76c3cc_JaffaCakes118.html
-
Size
18KB
-
MD5
4fd64b8f965f0c5aae982f1e0d76c3cc
-
SHA1
16e155a75f09303a706d34a2b660dd04cb2a962b
-
SHA256
3c07f874191d7876e5aa77192562eb9d04991134e8ffc3dde21a55a92601870e
-
SHA512
cca0a13c79406e3e04d231d40253b8af41a4cdaded50a2952bf890dcfa42ce5e47eb8a08adbf3afe11217b5c604242508d4060ef8d836f87a7b0202a1041d5e7
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIo4SzUnjBhW482qDB8:SIMd0I5nvHPsvWLxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C008831-144B-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422111912" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2460 3056 iexplore.exe 28 PID 3056 wrote to memory of 2460 3056 iexplore.exe 28 PID 3056 wrote to memory of 2460 3056 iexplore.exe 28 PID 3056 wrote to memory of 2460 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fd64b8f965f0c5aae982f1e0d76c3cc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53924f057eb38fce6aec0a1fb0f2bf0df
SHA1640639b5b3024f0c9679f8f5e51ff0d871fb154f
SHA256968ac4512acd50920e7f4aee2efda93d87844374e7dd66bbe6f62f8134129781
SHA5124bc8e89c397771e25991711d60885b9026cfd72cabe56455425aa6ea0925c603b560eaf7b7369cdf9a5dc1fc46a5c8b8ec8cd05969043f2afc9874745f982732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ccda126630fc5070094c02925bf3bac
SHA1b16cd90a8bd5bc268df6890c9fdbf29463563d38
SHA25621757af0c388a0d3188364ec1a848e4fde796abb9d60b5ee485cd52b845f3e3b
SHA51229552c7a6d4e328e5add313aafafe6d5e193c1cded52d131c85b99f512b5c3f4fca66256eb89c3edb70e695ba8e5995946e324df0532037b5cc7c014b3220253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb8d3d3df7a058f8b3a30e3eb05c1d0a
SHA17361362af13c15e59f2cf5ec59e4543a282e32f2
SHA25628e73c4d8579d03fb17d81392a01576f166abc9c36579d9e74bc10daae242588
SHA512e340f4c621a941cd6ba9bb37b470527c4f78d0c0ac360e5dcac11a2a0a8702d280955c15f5a83e22b23d446c5b476e5b11b1dac78cbc9acc237fb31feba5c142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511b98ba45c040c57d1e2b61bd65bbb98
SHA1c253cd6a621c353855bebc1b279001380c991e60
SHA256b11df80b5fe086e8345ea3cab20237c0583eb8d68d00dd70b9cdd2b11508e18e
SHA512defff59080bf97471e6774b9f4af7cd7e806df7e7968bc377184e14a9714b819ad5fe497b895052913bcf2541ea840a865cb5dfa50adb1d46eeacf6da173a7a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae12c8c0dbb89b343fde41b5d44dbd1d
SHA1b1bd448a4966975b3675d79d6d79634df915530e
SHA2567658c5af2ecbca0e660ae24aed4407b9e2d654b897c90265b4205868092734dd
SHA512bfd179582909bc53d639ba0f5035b18ae904ffa95a27736d6aabab0044a2b98bdd4b99f42387fcc0166fbbc8110766ba54b8574e643ef757b34885f9e014e3cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b29287af7bef3f01021da03f892ab2e
SHA146c9aaa20e11cf1f92e9d9c974970f92ca5dc1f4
SHA25687038399901f7ebc953c835eddc3091e7776ce1304728727ba17f0441a2c9ec0
SHA5120ce0cb5d23b965e8a04d88c9c6bd113425c75b33d64e54fafd18baeccfa1be9adba035ec3adef15d16c779c48bcc71a4f5b5cb712bbf34fd00b56f18cb0cc464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56328e731603ae7f07707e68206deac2e
SHA11e43a05fa9a95bf027b8cff5caec4d6979a3ab98
SHA2562e416d152ba42a8d009bdfeb813f710c754434bf30b6a7edb9e252674ac161d5
SHA512093a4c30aa75947d363564da16c91bd95cc65d6cd30947e0db65f45fb962d9607abb40e14742a8d8cee4eaf4434af09bbf02962cbaae66cde378c9121f7302e8
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a