Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
67eb9f0794da82cc0b4248d538cb8da9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67eb9f0794da82cc0b4248d538cb8da9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
67eb9f0794da82cc0b4248d538cb8da9_JaffaCakes118.html
-
Size
350KB
-
MD5
67eb9f0794da82cc0b4248d538cb8da9
-
SHA1
1b033cf2ba30cb42edd240053ea665b83e8339c1
-
SHA256
d6b8a1c72260dbc76426633cba3312a94706ce1ecf200bdbbc4878dff51e66e8
-
SHA512
d698eb8cdb5935f4514fd2549a2e76f1baff47eb5543ed6d58ead11a50318ee8c58cec6ca915a61d58a4db79f09cabdfed19127fb505247760715826cc7a9548
-
SSDEEP
3072:SncyrfiLJWn/OKz6vaz+rOPFgDVZzkETsD:SVrfiLJW2Kzvz+rOPFWsD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60D3F6D1-185A-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422558061" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2304 2236 iexplore.exe 28 PID 2236 wrote to memory of 2304 2236 iexplore.exe 28 PID 2236 wrote to memory of 2304 2236 iexplore.exe 28 PID 2236 wrote to memory of 2304 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67eb9f0794da82cc0b4248d538cb8da9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4513a59f368fc784aa45750824e50f2
SHA1bbe4fe729bd813c31b13b94956e67915e284183f
SHA256e89393bf1ef9233fc8d705dc71cab3f948199c7acf33c1ec6811777891ad4013
SHA512714210eb77b0488b85d764fcbadd90b3341f848fca77217d004b8e3aa25a2ff277f526be06c544312d44bd3189e6d5394acd5ca91d033d3b00cb44365aa61a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506b2f709ece445e8d601fb6ec11ec7e6
SHA12d0d1ea0f249000c3113ceccc40acd73ca299011
SHA256bb2738147bfdc8e412bd52359aad248bd4d12b20b2f58e0af5f21c6f82f50dc7
SHA5125ce28efe9e26d676348d56121ed9ad657ee7fa4dacafe9174d843cd777bc6c737af2f1fd70b04f64bbc2c47664ec079cfcfaa1a5f0461a05039d9caaa3ab5b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d25cc09c89b96ae7cf998bc0f2674254
SHA17eb913a11f8b59d9e4898c272895bb155ea0114a
SHA256803b35b9117bf9e379f26eca0439eb6b448930d2acc20774829a6677fc2b00e1
SHA512f8340c976201c1b8f7827b7a347270655095a22ca8cfe08a602f021cdc7123cc89467c6eec4670092b206c0ce5ef206e1327044db8dcee112cd8f51285399ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d178ac3acd9960b842107497b4c35b5
SHA13a84a07ed83433bf4646c03750a843857598b99f
SHA256ff226543689b36a3fe03c023042df04a00625e311a3ec8045b8341a8e74b0137
SHA5128171635de061244d17cf38fd4574805da7ebda66e3d63efc0c322b80bb34782ad3a33c268b7d413f2e6fd8bd8328e503b35fe9fb419301f0f8bceafef3060874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c35831980be807d0462469e7cd92dd26
SHA18a5804aef2b0bb4ce54e85dbc5675e8b4d01ae1d
SHA25667730007197fe6f20be8d385c5a81e14c75391d19f039b03f1d8399d6badd8ad
SHA512eea935daf10f76d2dff54055a20ea5789eea1aace95576e68788295fdb4445e465c79c0d72451bcb8e0b7784c2e7a2357d87e0a7fe6f7ff79dd82f89aa3ba5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e0cedabfc6a792e4f0384b890dd2793
SHA154b32e9707afcfef6e730a3327b6e24aedc08213
SHA256c7d0a7ece495662ab078dcdeb2083f8efd67709a45cbe2614b598a0f9d44d04b
SHA512bc7d2864a53e8ed0ef1cda8ae585333b93f5a6f90e1f2be33ed7294cc2f03ae159e21334fe97b2123f491c6b54972c018dba1c1667d143b49280556a2c84f819
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef126c104d1126fcfd4c798814e7f9c0
SHA11b158b373a11ec90625bd8a38f91bb221c2c0c24
SHA25685eea5c0a9ef313286301ea72aedaf7d79cd46fd53d603cd9c14ff6cd82e761b
SHA5125c9f3c0039cc1b9a269e1ea6a73a2b51168ee8cda38837357cb6570c3a6a7f0f84c151d97178713ba9d3d10a40413646ccae6840ebde84e054f43d5b4f26c4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aa7ebd2e3aed51bfc55a86c4f2e78dc
SHA1fc1cead9ed50c034444bec8f94f77ef73e4cd245
SHA256fac071db1b16a61c80c7cb66ec62d7c44107d9bac62d7df30b2e5f3337b6991c
SHA5128ed82afe5ace35e3b6f331002981052b8ddc3a47659d284ce8940200463fd6acbc9ecc26607be8b6d85ac793a359eb8c76522a6d4a5b767ca7047d18ee9a3aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5848331abc57b87e4d28628e645dab8de
SHA1245b7617bc46853d2b96c73dc2df9786770385f2
SHA256806515e54a8ca78a7ed3d64f2ef95e6746d4cb86552323f55812a916235dcee8
SHA5127550216c43e9033b508c65ee9d25f33196790acded52109dc6b1d421cc938068c1bf322dcdebedc1db6fc486853004fd2cccdd0439efe29861bf455154441417
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a