Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
635d2b9289c436e78ddf28bb6cf77c2b_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
635d2b9289c436e78ddf28bb6cf77c2b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
635d2b9289c436e78ddf28bb6cf77c2b_JaffaCakes118.html
-
Size
32KB
-
MD5
635d2b9289c436e78ddf28bb6cf77c2b
-
SHA1
79d265861d47a968c397c97a7cc077ca6503e4d8
-
SHA256
3748eed2d474d7ce730a989cfcc652c9c0f4efe52add32f50f510ce88f7a05b7
-
SHA512
4968bf1202f18fe714320180fb4dd265513f3f14a243ff31beb2771a3b832d80277f3a4fb490c1c7c0fce6dea7eb07c474465c7e231ebf57f3075bd253c7f3ab
-
SSDEEP
768:lzwqFG9bCfCnCkparfGrYFDWbN8f7oO0/DtCNlnVom5hg4:VnFG9beahparfGrq+NPO0/DtCNF5hg4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422457879" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{205E6841-1771-11EF-8E44-4635F953E0C8} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2148 2988 iexplore.exe 28 PID 2988 wrote to memory of 2148 2988 iexplore.exe 28 PID 2988 wrote to memory of 2148 2988 iexplore.exe 28 PID 2988 wrote to memory of 2148 2988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\635d2b9289c436e78ddf28bb6cf77c2b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a82d4d555671d74bcdc2f8bfdfd20f22
SHA1d23b5afbaf41da0da166313e44d07191365d7086
SHA2560aaea7fad4ca40de2661109c3f8861cd56f476b1ea0c983b8831d375e9bffd5f
SHA5129300c76fb9a86dd2cb8f7c4adb1d76270a515e8387294afd2569922c64f9ecf0e3e2e3c7c3c25a58d7e4eb21497dc05fbfa7049cc9d845e4ae925f263855a799
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585fa19d43d7ea48edf36516860da862d
SHA151e19449a48b73269c18d2acaa9a039e96089710
SHA25649b5a221224b199d48cf4f319d65b281a8cccd86bce3daaa945891856598e01c
SHA51213b979c7b6a8914384df89c58a2f64c77dc46de04c1586615a58343eeeac9720986a70c456947d8a3494d5ac7a163d71ed75e01f683b05283daf30729ad6bd42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507524dcdeaefc7e4f8664b55a69cc5a0
SHA1b0343477dce30a8626ef44c215938b7fdca6f7de
SHA256567725acf12843b6b91e75b3660df8d7a3208186b98a997c4ccb0c1a63a7c7a8
SHA5129c8fc8b7881bb5894b467c0a01a25a5444052b8189070c4ab6912f806169a0df493b19a9cd2df86ab41eed86ec0748c55c943646f6d184a6575670740b782fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51801e173f8e4fa495107f2959bf803e7
SHA1c8b3d7bfb863284b219c40f05f45612e66bc065b
SHA256e51456a3f084d49aa79bb6d38596d7e7dff725458fc1d7bfc2d059e92ec213bd
SHA512cfe4e76e0a768b1506405e7586218644837c28d919f7545035db0fa443580dd58623134feae8c5a2a200cfece087581672fee07fa796b46f3d38ce791071e6c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a411bda25788af3cb191017d877fc48
SHA12772135d6a0e8bdcf8a55e856cafd4d9a29c37e8
SHA2561a21e29a512f876af4372726313059468e75fd80447e8be550a063f37070f38a
SHA512399c9cf10f56ea85c12e1118eb818a999878feae32270cc19fd2388b88460ec1a8e41a70d2761c3dc9755b1efbc01e01ca27126ba0d77b34b8bbb8a2d05b3fcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b42d271a0110bb0fc03b6b0c80f7e8cf
SHA102367d0301d5402a51bfe5a8aece5b24fb086ca8
SHA256cd035d2715f582a6b98cd94071a67e077c36dd861d4822f458e53989f0c4aa7f
SHA512664428c4a2dfcf8606cfc098801ca7a8610d6afa500bd60c1a6f828fe24617b7ed38e6b77dec899add99b30d9f6b87c23061ee7687afae60f881bf98fecc92dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588b971efd415c1ac78430fe36eb8b471
SHA11ac743e11f6a1e923d16fffb45cbfeae7a123d1f
SHA256ac71dc0d071b9937dfb2b5a21caf59a16808ebf58481443f44a8fb428b4c9410
SHA512c63a5ae1d554df18c4b7a0a4a2e1245b0191335ac98818d6f92be795ef493bf1ea2cb5db9112192ae651addf3d707e4da113ed6e77aad965d835995935ee946f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb032c6bee13aba9d8875e24c5786c1a
SHA1f73edc3ba10c4550a226d3cdbf7105b83c5de745
SHA25654aa7560b0c7d0251d7006334b92840b07f0c4cbe0e3b489c62c7322d032cf8b
SHA5122e617bcdba19a055f631e255808d80326acfdb8c5179df2e10600e7003051b88971f4b34c6ed0657676fa196cde44d884a7473a362a54cb670307709e79c1374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3460e02e20ae77a4115e417f9833e8b
SHA1b5ff8b5ff94dd1bceb06ebf5f3f1d87801e2e00e
SHA256e6d31ed17762ef18747202456cf95c5ef93ca3dd171a0c5d9632aa1ac0c1b67c
SHA512bdddb5a2355f29d744d3c2846982b36d73bac4104efb312b37a7b8751e92e4a7d7c468cdf3c6b5bd8140162bd48dc52ad8e7c41d6c4eb2a5e41fcec9c12fc377
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a