Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
6c24c16786f6ebda395da9f8492eba36_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6c24c16786f6ebda395da9f8492eba36_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6c24c16786f6ebda395da9f8492eba36_JaffaCakes118.html
-
Size
17KB
-
MD5
6c24c16786f6ebda395da9f8492eba36
-
SHA1
f8394f22311c5c8ef09e1597166a4bcc232c05b8
-
SHA256
2083bb98fda9295c00aeb4c583730966b5385ab3bcd3222d43550814176fb091
-
SHA512
3465bf255e118e471e5c8eb1e10c34b6987042454d5e7d96985356d9dbde5899e568897ddee4b878bccc6acba2c7ce70304b8d0a2f9de24c672f9479acf22f39
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIf49zUnjBhfR82qDB8:SIMd0I5nvHtsvfaxDB8
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422657680" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{530D3871-1942-11EF-9001-CA5596DD87F4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2532 2316 iexplore.exe 28 PID 2316 wrote to memory of 2532 2316 iexplore.exe 28 PID 2316 wrote to memory of 2532 2316 iexplore.exe 28 PID 2316 wrote to memory of 2532 2316 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c24c16786f6ebda395da9f8492eba36_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a244129d4ec9e462d73f551b940df33c
SHA14b2a5b6218bbbd280328ca7ab0d8c4deaa59ae37
SHA2565035ac77468b2e640c77b8633f2bc7570248731175b6fd9f5dc485aa99c05185
SHA512d78c93d09a32fe5e927bae7646bd703b4638ac975531ae4184f042cdb3b8c6dac20d66335114eaacf78c2a154f2e7e23b984a03e4fe372b3dcf6b521453c0f7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3fb15552ba872fc4d080382c9e1cbc1
SHA1f9fa1faef941bb693e9ef95d278e17745dcb3de3
SHA256b555eb851ffd9a7aa50ccd983728f9a4d3009fab9d60cde4d8675127a9fc5294
SHA512e475e8996e079abe5cae15f22c6ab6894b0e7edcd1132d8a131720a3ee99d80f8d7000d1afe52104e9cb706b2961fcd24531024abf84f14b8bb61053154070f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c1401a9b4f5e84aca706db910a66114
SHA15cd5157dbfc8e8ce499bbe0856bcbff1232a7ee1
SHA256fd25407699055cf196f7be0e940420e5a723050efef0e8d9692ff98c65ebdc0c
SHA512c7b953344953948fecaa9a07569879ee5e34e242c57b9e4e9571d7795920764877a6b2739746da9a1742b3836a0ca52597536a10a14dcc56e56c63f7ced24622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c3f1fa6bb4747e484e7bae5fece6781
SHA121afa42db730f0c9bcfc73a5f2663f4d6b7c19f3
SHA256db291da479a87f0b8da26d0da0919f68a666479c4a45bbb740d497b69f4515c7
SHA5122e6d31bf0d4dc7e3e468f3117b736d59653e6d6b9314b861694e0e5051044329e1614bab3f117c6a64a63c1ceff3f4a40d14e0dcc824ef53e7001a034c2df5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff0e98c2f84c9900357e6f72f15a87ce
SHA1ec50fceaf7c1cfcbc57a58bcf17299628caf11bc
SHA2569a39054f03f93798aadd9af56252319154142065221c8fc38f4cf384921f0a4b
SHA5126e9ce42af78f9ec29ee42276ff305fe170796090b87a2c8b3476068555a5ebb6bc09a525382b541399af0dda6383400d09832aa6373c06f7002ac45162189dbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e91d5998b691fd12374aaa94e2581878
SHA110d3ff61f2b47b6464291801eec87feb1794d2da
SHA256c5b05b5de964b7e60268c7110fbf7f78d5451652d6176cc9744ebb93d6bdd2d8
SHA512d6357a892b1917c697af9896145eae7eaa8e0b4b3d835432616bf9f3b368e345f274a40ed8624889e553c6c70291bd41614af5dd0b3d7d6cfca70b71ac529ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfabde1cbee7e2189cc78d37ef799d8a
SHA1cd29875d5be020680286d1891cfa0246efd0239b
SHA256cb71546f4c3a0c5106d477e2a516ffb760c9d16efb744d26cf39bb4f1f31796a
SHA5126e34b624a46e705a66f03fa07248365a90ac59e68cd78baf07f824a064db9a68553b933532b5c48751880a5bf75a35e5d63f4185442546426ba883a7f2158a11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d62ce838e24c3a65e40c745ae49eab9f
SHA1a7e5985c6b2cd313cb31d3dc808a9caad160ee20
SHA256a90d2af40f5d441d0fefbccf57b4c936a872cb26416676e9b47329dfd582fa3c
SHA512603836246fcbb3f4f5f645831da7d017355d257d7ec764da756e06e596eb1bd55edccb11fa2bb9592c7d10f074fa2e246c2c00f6c117f935be4c6c3843a82005
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db7c69dcf67ff7e068e973380fd917aa
SHA1a58961d9b7b5c5009dbcc2824b97bec4761f9ceb
SHA256377d366780b5cfef3b07245abde0368f747ef691e4950c76aef491487494bf00
SHA512100a15722f8a4f30861d8bbd867c6a65fd78e8113a58ed698eff608a3a28c6b206e5b87909f0163bc1bf7597b7931720874b0ab72451c42e50f1931652f0ce68
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a