Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
69ca302c1b8f368af0294abd54329bb4_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
69ca302c1b8f368af0294abd54329bb4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69ca302c1b8f368af0294abd54329bb4_JaffaCakes118.html
-
Size
460KB
-
MD5
69ca302c1b8f368af0294abd54329bb4
-
SHA1
d601bbe0a78341fd998062914986c8b19709b0cb
-
SHA256
8499602f3748c11289bfa5af1d538d4be6bf5227344e06f092d1827c3be848fd
-
SHA512
3f4f16951270ca162c347b6da3d0cdb540a28f6bd3c474594e118edca25aeb6e40f1650900ca505ee8fd4c232f2606a7401bde3d1230cb279aa2132b5f4fd62a
-
SSDEEP
6144:SYsMYod+X3oI+YEsMYod+X3oI+YAsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3A5d+X3w5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000016f6e02848b8cc4b904114d53920cd1b65acff3617f47f697b1719703dac345000000000e8000000002000020000000936ae92c85e802f82ff6b3647ad5ba3ba382149915caf08d3dc210d6bec6385d9000000046eaf0eec087348faa89b44b49277a0171c15f31fa120e69750a5abf01a02cacd9ed7f87292f42e0e693a8b6f93e436481caaf54b251949aab94cb968b7eddeeaa166f1292f946ca8dea398ccf369b882954ba55dd2050b35a24756d201310240dd99cfad6b610fff297a892ad7473530cb1d9d99f0c82720e18e11b8c5cefaaf2651e55eaeeda9a0cd6bda4b7f500ca400000005d8304e2c558a174aa099c272895ee34674cef759f43790b4f0ec913d635d250a4285bda57175df74d57723aa3aa0eb2952889961f73a0b01d7d9c233f3d7fd8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{801A3F71-18C0-11EF-BAEF-F2F7F00EEB0D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000860f50c52d8dab502f37fe041e4a003e08b7f164ece22e8815a8241770be6bcd000000000e80000000020000200000006a65492a05685bd3d7d8699553b708757daaaa4989f0683236ebc72966c673ef20000000033f410e5d0da8cb049bf4cf11da80ad889466ea0aac6715dbdb98c3106e10fe40000000129bab4c03f445b2b8319269a5c73ca9903a0ab9fcd9893283304e41025d658f0072ec700b12c521efafb490462e2775e1a585ef5851f2a02ff9c33de3eb6c9b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422601921" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f8c858cdacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1868 iexplore.exe 1868 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2068 1868 iexplore.exe 28 PID 1868 wrote to memory of 2068 1868 iexplore.exe 28 PID 1868 wrote to memory of 2068 1868 iexplore.exe 28 PID 1868 wrote to memory of 2068 1868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69ca302c1b8f368af0294abd54329bb4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550a7dbd4257dc1f341fc7716a1f56dfa
SHA1a007e353896711a8121b2504cec3a071bb643392
SHA256d0f497101510f09795850a1d78b5be592e75ccc506a02797058754603af510db
SHA512b9a8f395e7078f6ec641186dbd9c583c16046b35727dab30c749d61bcbf96d25f6b7fb1b4036405adbd1194c6f862d987bd594683325f074db702cd5a7da4dd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d01753d4f2f2adceb73e1921ce472692
SHA1e231218691f36d99dc1e89b3d7ef2f46a4b09fac
SHA256078a1a0e418d57abee97298677c17fa7b40359846068c771b7c2c54447ae9230
SHA512e0c8bb74f54ffe5ea9de821c7add38794f8ea9ade4c2bcb2237a61145bc10e5e4fdc954ea4f0c054aa255c674ffa40988464aaa480d2ece693c335cd14ee84d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac0444cb17603b1b59666977eff75b94
SHA1157cefebd5a9f4548a0f47fb0cb43af580db2cd2
SHA256827ed6623d9f2c398a1d6f35892792a1ebc84d073b132af3727877c99cf9e50f
SHA5121d8253e0ecbcb92ae21fc63f9eab0bd8a0ce723c1055dc9229b1bab5c858b8fd64895b7af656cd06d60819bbf606f770f6627fc7df4db24ce2bce43cf7e547a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dbeb68caccb8ae0919a5b6ceebc119b
SHA1b97f9b9e142db6545e8f599fcc7b6175413531e8
SHA25666a36dd2ee00e1c4a1debf0a07303b8cc17177211a4573fce2ec6122e2e3eb3a
SHA51220067e244c2f746e2a06f47a6d51ca76d9b96c4a2715e59316091c180c33b05257437b11ecbdc91e0ab4b937d065252feec8448b8878c8f6f7b689539d92d6a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b4b6579b9c379a859c698f36617cbb
SHA1df96f35e0685c6ca3257474df440f1e854cd78cf
SHA25667e459b8fcade0b428b17c55250e01c90644902ae9a9fc0a58356c06c9e2ac3b
SHA512e104c04152d9c8c516c16bb18866c293b46c8d89d7f2711121b6d067c17162491c8da312d3b082ba77f90607b61a8dbcab27395b8eb3ceee2f20f1df8a234ba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abde5c6e985443fef9d3937ab60bac74
SHA1890a7884ec5b6b08570452f2d34129f8af7594bb
SHA256ef48004c51f7810df100503e423825693fde93ed3bb37882f797442aa30c48b4
SHA512e5f009f3be1799ba0dd7678094bfed671b8053691b243bcc0d147bd18b8c78c4b96eb6fb83990f97b7d638a43182b9f3da583cc890fd16ae645019877baf2c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543fb93326947a73ff9028b54252a4cdc
SHA1d0d330594f9c81ab0f8e5226d3a1bf7aab52882d
SHA256d1269d61e762f32b8ea152c20fc453a9ac9dda92f67f1fd222bbc5c766ad8799
SHA5124de1264fefae0fca5587964c7a45d51dd236e7fcffd9978782156be28666ea0f8149a718b6f8152a45bfdaa6251efc26734c3aef0fadf6dcbcd73fa794663507
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a