Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
6c96e00f81d56969a282976afb18960b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6c96e00f81d56969a282976afb18960b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6c96e00f81d56969a282976afb18960b_JaffaCakes118.html
-
Size
27KB
-
MD5
6c96e00f81d56969a282976afb18960b
-
SHA1
08174e4c3b46c7b5fcc233acd5ad544bcd21e5e8
-
SHA256
cbf87f0d1dd531fd78aae5ed38bf5dee841dcf5e73cb179134dfb8ffd5343a0c
-
SHA512
3c770ad21e0da0be7a08f9ae2bb77cba5426c47b0c6a62f4e6e4296f0993e500c6ea7c1da1603c84f9c79a25938d6a6ec32e571218510599bfb37e846aa6ffea
-
SSDEEP
192:uwTYb5n7CnQjxn5Q/6nQiehNnOnQOkEntOAnQTbntnQ9eB1m60nLNQl7MBBqnYnG:GQ/AkPwL8S/IV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D8C1F01-195A-11EF-B1CF-5A791E92BC44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422667898" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2128 2156 iexplore.exe 28 PID 2156 wrote to memory of 2128 2156 iexplore.exe 28 PID 2156 wrote to memory of 2128 2156 iexplore.exe 28 PID 2156 wrote to memory of 2128 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c96e00f81d56969a282976afb18960b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512f14436299d6885fbf3665e02354ea6
SHA1b7a5b07ff7240315128cd8ef4493dc7110ddd264
SHA2561417b149246df4ede0823778ccfab7f17310b23ea6d63b64d6d002d37ec5eea7
SHA5127d1bf760504b2bfe0e44a5e00d8e6bdd5d4483c0d997164dbcd5c8575a0d73957ef55d8184d4aea693128f330c3e43634508647066fdd78c6a5a96c5867bf563
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5939b6d7c6ac0f4278d0535c01b84e604
SHA156526aa24efcb98198fed1475934f7258d3d542c
SHA25687832fbe1a1749495938952ed2874cf0ec4f22187c6f88a3b037eb18632ff363
SHA512391f7ed2ed7a25d68519dfbe9bd54a81d7254a346d3720416dc0a43d5d31ff84dd445fe387dd8a5c856d147f45b6406967f84bc1f5756de44f8715bde8341040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5795844b5ce493d8f33a0a36df7ba7dfe
SHA1d813c06520f40bb3f3e2e2358062d9279e5c089a
SHA2569307590ad114f0056b3f8c85af0f1abae78365725c3929b0953310010639206b
SHA512b077e43b03ae519d62cbf85736b819f873c0d60bd7dfea6eb11a248e0ee108f1cb6541486c4336e79c2e1fc67e789f3751140cd1c9be7953d43459a442678a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5234855f8952e7c912eb4c11046fc2a8a
SHA18686946784f3892e171eb5a88ed3e6a8bb7a9fe6
SHA256e89281e1279a4892a8017e9c6a5127450d6caa779ef9ffa829d84ce59313cc9f
SHA512234eaa72ff3ce2809990fc0585e5f11f765756a00ed189f1889f4d915feb007ea4d04dcd617959dead0b3ed0edac9775eba717cf72e45ac03f10d8d0083d560a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc159f816902d337b47dddcd8c4f98ed
SHA1dbf0974b92caf1334260c597cc5c4684b7ea4706
SHA2567fab83330d1e9a30246c58851c01d9ca6eaf9ee656b8a509d1f3d24f55fefad5
SHA51207ace620bd9348b006ef693b4929f9b7497af754c467d39599f208339d935fc6d5b94d317b1f07a69ac475c1b0db18f0766964ef67fef74ae4a9d05a0f7aeaee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcf91c68fe18c16f7207feabb25a3cba
SHA11ad1cf19573bc6649e3a8025947010bbd477edd6
SHA256cb95b0c9f9218d769d5d8250100ca88fbc34da0f25c2b376d569aefe11084663
SHA5128dde144a40099279321e523960e6fa0ab53152eadbec116004851aac37ed3c579218df642b64d675ab18664bdcb077a3831f298775838bd7545c7da88f8e12ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec3ada2c427193fcfbc8ea58670ada4c
SHA1e5d9384ed2f179fa3b2d4497650733379b6c17ac
SHA256704319f80ba40234ec92b4354fa7efcc85cd8f0c6a1e6d4162f9a52276ce5f22
SHA5122f19cf25f5eb4734406bfef0cd86572a576c4cdc141662416db233f7fc59baefeffba5528eb484fb132492d2aa21195d09862becda8e370e6c22d35aebb45b17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50408cc4ce018de55e5b53d7f3f672e80
SHA105933220816ff1e0beb905861ee255bd4d345e67
SHA25635b53aa9444451269e31d2c4ae643b187cc55c5270752ff2684d071e5d5a8c21
SHA512e34e6e333dc4ae43ade06290212c5c96250f353a56f535ae2abd51bfdf449a187cb740a720699fde6acd3db8e0be5da9c291360115e4fe97aa510a6be4f5f27a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fc6e0bd073018b36b18dba9ff45dc97
SHA12c4ea1d969886f49426846e70eb0fa777dcf93ce
SHA256374e600b692ef4a416b92a2c4d90ffc6a548f3fa23044d7b7a64d31f10871641
SHA51202a609a4b22a9e437df132f80f69843b294650114a1350eb916d5c74e60bfbcbbab3bd988f278cd4d9e86f9fc5a8895d457fd76d12a0f767ce8eb0c4c286ff24
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a