Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
63b9c2c60940e0f21eb36a17461d8bb5_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
63b9c2c60940e0f21eb36a17461d8bb5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
63b9c2c60940e0f21eb36a17461d8bb5_JaffaCakes118.html
-
Size
120KB
-
MD5
63b9c2c60940e0f21eb36a17461d8bb5
-
SHA1
7854c8a38cfeb9bbb7ba3e7343594ada5dc6e746
-
SHA256
55956624809a42bed5b2b33350f7d38662cdd6d02647cd852d7f0538ac796789
-
SHA512
3583547264cefd21cead67299603257a23626f9a6ce89fe204db6792d04d46e5fe036c13deb7c6db72d7ffd4db93b697f7e8921571082d506403cdc16e5d8965
-
SSDEEP
1536:SNkyoTLMZutmzHhHAH5HDHgHcH1m2FjcwSCF4mPk1Hc1gq/:SNkyoTLMZuMzBgZjA8Vm2hl1g4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D8FAC41-1783-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465820" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2548 1732 iexplore.exe 28 PID 1732 wrote to memory of 2548 1732 iexplore.exe 28 PID 1732 wrote to memory of 2548 1732 iexplore.exe 28 PID 1732 wrote to memory of 2548 1732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b9c2c60940e0f21eb36a17461d8bb5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d99579481da5317e75528fc3c8bc62f5
SHA1ca2259645d7079092a783877ae5ea049b8815ef0
SHA2564f1255487cadcc71853749ea4cd6fc1417371980de39f7a7f4971b62db597f11
SHA5125fba5331a6e9fc0bf3614806fa31b9cb1492e4358432315631e7ce7600ad317cd4ca81820f27fe6ddb4017dec224cbcc0f22dc2af373c49c9dcb7486e49f8b0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c750fb8c5fd363c23e3db631dd29396a
SHA19a402862964aea698db0c557761c70e2a3b77454
SHA256f4f07e5031ffc12877cf963a3188a17ccad85ab22a820a62dc35ff4f3f8c81b8
SHA5125a908cb6437eaabf9dd0a1f408351f788a9250731197e1f24c57716657325803ddfb435c56a07043aad02a2d89b05c6b90c6f023dbc54491e3d4ee8caaccc231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dad07265ccafe62a7393ea0f88545598
SHA1559e483abde65027c2dfbca8dcb1455d2ca6dbaa
SHA256f0da2e03abcba92f4fe6a227b4ae51290a602256def578a0db6cd67e4aeae38c
SHA512d7295e4a30f4320f83d3bed5079ef547e4a0f732b6d8ad2fc68eda0bb605dbfc1e86b5a7ce6f4dcc11f7ef67b0706ea80ac22e1a5965f715b014488253ea07fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526f882d8a226101dc691be8f671af5be
SHA1f4363651e29e127305fe9bba398e5504ff9f75ab
SHA2566c2134110d8cd2d48eb3bfd723c1d179a80177c6538926e1d3f03f62fa0e060e
SHA51240021082acfda854a0327070097b309285774e224d9352c2a179fb6d16cc92ad9a103b09475c5d6a8251703538b010afac0d6e2f6bc19ea353a567d087dc5474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543668954dceaa93c18757d4c953cddd3
SHA1085e064ef22e48d2e52574c59526239b2465046c
SHA256cbb0e9ac233980f6e9ccfb58cd49919a873a76e0182a2a0d96af0ae91d259af0
SHA5127263be8e57265ad0b54cc76eca4c7e739307893d6d6ee44225bd418da4b55c62537a338c3014c503ee655baa899709fe6be88d8a3688a55bdf1df16998101f8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57039801025007ec34060aace25b0dcb3
SHA1dba5d9a9586257db362e4a3f1b66a26ff0b208ba
SHA2563d06fa99d53c4b7de94067ac0dd53bc7534ed68b372d6107bd7fb6df4328b085
SHA512f12c71232135a1c2c24be1f56e018c44875437467e477ac900ee1b8b2c180453584aeaeee45c3dd9cace9b6f62fb5bdfca484866dab2dcff11c6b01eae87d6c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c4cdc2d5dcb8d5406b089810ceef756
SHA113dda7d57460564983392cb50b99c33a58f29180
SHA25631a7c144da80533fd07f64ca1d5c3beef271ac75e89449bc568f64542fb9e428
SHA5122595406687c0cb080c9c5044c25d23e833e59e85166843a3f613610de43a10f2120b3273543494a74c5a2276750398658228a991e0b6423bda136272a286d2d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9d85284f7b6401fb05060064a9b39ae
SHA1a8aabba2d90075e44f16a140e6b108af430aab9d
SHA2561f0ee672435e1160acccb5962d063560b78e4229158435b382e859d763e72c39
SHA5125cf06ce1e59dad71e9dff16350c9c4b7f470ac37feb9ea99a70eab7d09b9c9bf0be4ba888f7954868611eba032383d73b8a0e17c048a558f801f2f99d130247b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2320622c3c3ae442f14363d77e9b184
SHA1e39f6d523d4c9aa49f5e1c3ba8295bef9fad4d11
SHA256f522d4d39423daa02a02cab6074f7bb42fd3c2ba1f79071fd68320d1e126eb7a
SHA5124dfb13a231fd9df707dd1848de2003a258f63d405bc89e1b58b1393914a020be3c7d2edc5487ff855d1a666968cc883da4963bcd3301e04c94d813192ef0bedf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a