Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
-
Size
35KB
-
MD5
6124b4e4b9441e5d0501af3ca1ce277d
-
SHA1
c9d5f65d0ab46cccc2f2063d390a6e617ff82e8f
-
SHA256
b2d2610830d2d1319f2d6ef72f4e4380ee9bd03c2daca62cbc2da9db4c8d5494
-
SHA512
bb48479a0d69ba19f44040f4f7b80865e2c18b1651898faefeeb98e138592a56cb2c4d3f23dee1f4802aeebf2f998970636a122261e5d50036385698c0eeabe8
-
SSDEEP
768:SdsfaYT//ysnzNm9F18Hc9snzNm9F18HVAv12CSTUcpeY39zJZris0pvicWID4fD:Sd2aYT//ysnzNm9F18Hc9snzNm9F18Hl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422406274" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9F312A1-16F8-11EF-B195-DEECE6B0C1A4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1712 iexplore.exe 1712 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 3032 1712 iexplore.exe 28 PID 1712 wrote to memory of 3032 1712 iexplore.exe 28 PID 1712 wrote to memory of 3032 1712 iexplore.exe 28 PID 1712 wrote to memory of 3032 1712 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588352bd732d4d40136c04813a6e4594d
SHA1a45092c34e23fbef909e9041ac4c41598aca2ba5
SHA25615d47c213b7653ecf636b5fd0a0dacb991c38ede0d7d409d8f1f781f673eb80a
SHA51274a4636bbd86921aa7d24b3a82cd17af991ca81696d6780f8ff26e0ab0caac5a22a9dd76c00cd813b91103323a36a8afbeb160ea0dc9e2b16f85ce096f72e597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4de21ca2e4b0777467f2bedb61b7e07
SHA1be05f587893fe2976ec4db9f2e2d0babdb5325ac
SHA256914ae7fe51a266f8b8702caa64027fd87a586c988bd92e1598d5a9f875155467
SHA512c721670525bb375f11adb00338854e1c8437b46b2818dd4c3e899a2cc7880cb68a252370fc0bb58d24a01e067a58e12dac112f4e3ac965c71a392cac0cb2c770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b177636f23bfeae8443e9f791d938047
SHA196937f183d6816331b4107ebcbbbab2126a79006
SHA256c239c826765b70e3edc733bc0527c6565b14c973dbf111e2ce87658d712717e8
SHA5126f246d12515d48222bf46915f2857e6046c665d213742744589d9fe876788ddc1fb4e647d666c9f1b8b3115a9969cb35abe4ec49a65355449f6f9f6b87ece45f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e802ecf51460650bf1bf9ec5d20db6ba
SHA1419ccdf90dce63e51e5e090df43a318d0f754848
SHA256a7853d5dc59a060258055bbb8d5e807c32c9a05fba9c5098c0855d90e21abff1
SHA51261169164905c93f62b699df1bed7f9d76b50a86b879349b047db98bb5b2bbe56d9c5462fa0b0f26ea04d5785900aac7268d665a961e7792c91d5e8af8930d80a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c7e1c52fe277727570f328785ecbd49
SHA1f387d5c5aad4b1874f34ac2001d2804ae6bddb4f
SHA256fc4b6126d020cce6aad50e8f84f68bc1b5390bba3e3be82d2b1662cabedabd55
SHA512130e214f5c3aa4ed6f94763332c92d3e61f0da72638406bd47a89eab5b08a47028036398e0640a811fba8f82ef1e1f7787af29139168ef13ab513ebb697f06b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e0689942b3b475e373c7c9040f3960
SHA15298b52b6a8b8b98a4b0880593061fd82cdc3c46
SHA256a6ef7600f6b11d087600c9f421aa204874c8779b8edab649c93a7026368066a6
SHA512ee7c888fa9939cb2c177f9e546912975d6cde972b05748783af0294c45f6fb80ea28d03187b8414750dcdeb6e961d8688d78b11d7a5604980d1c402dab78d04a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf5aa8cc3ea3d26addc93299a04d53e4
SHA1ec40aa33c3e5566bb36ad11cbe523a824266e438
SHA256754d993ab527a2b38ad5df3e69dc94f5efe62950e60d26118f5197892f14e6d3
SHA5128665fa75f921d9fd4be59736b04e65a27fd324a2ceb638c94e9c6bd0b37fcb85804f5d60da90f5ac67cfdd6d3a0b7f29d7dec302d30f621b134283269d5a950f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538e00031f39059fabefbcd473399b644
SHA1a4192fcbb8c28590a2194ab3dfa22b24ae48d1f6
SHA25600f2337159cc91ee5d8038257df27c902b4e13cbbc40009cb625bb760c12fc28
SHA512e750c821dde6d5eb384846e4d4b9d0f14e146c2cfd045e26c138d4a0bedcf263d9ad99ec742652038b88d8296768799023417d5b2a080acbd325332644e81b88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c7eadfbf7582823e4bd311442f9ffbe
SHA1d2ea8d0b5386b8b456ca5a25e3eed5a852438ea9
SHA256ecbf4a9698c50bfa0b1890c2c3d55bb08fd3a1dacd8ddcfee1b3dca2d03514ef
SHA5122bfc388260c8a65f384eed7ec2042985baf1687df2b02ab5425b884814e532a348ff2157a524f652ab5b46ee7793560dbe33bcae4322fd5d428848b1c9b9d01a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d9533a1cfdd7b2260ec79eaa197992d
SHA1979393e5c478a63e7474771743dbdf030a6391bd
SHA2567065701c0bab6a06da98f60a4fc1a95bf1ea25dae398e8c866b302e12613ec08
SHA5120fccf05db27b568928dddb9aeb021b70dec407efe8ddc8993b170c7ddfe366f423b6ff14faa62f16c0134859ef9ab0ea850c76ad034d023800c598ffa200b162
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\WeiboShow[3].htm
Filesize20B
MD57029066c27ac6f5ef18d660d5741979a
SHA146c6643f07aa7f6bfe7118de926b86defc5087c4
SHA25659869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
SHA5127e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\ga[1].js
Filesize45KB
MD5e9372f0ebbcf71f851e3d321ef2a8e5a
SHA12c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA2561259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\WeiboShow[3].htm
Filesize241B
MD5f5ba896d004fc2ad25e2efb56b129b57
SHA1f4f586a75c24d595aebac0d105fbf989b7f723fe
SHA2565551cf9ff3d42d87dcd453c15951f650effe152236573faf7e3fa6813343bb7e
SHA5127431e23775359b0a0d7cad2990b3890d14ff203a8113e404b0439ca9f5019021ed395b5f2c9e4b5ba59a398659578205bcb5c92ebd3f8629b70ab8d97f5713fe
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a