Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
-
Size
70KB
-
MD5
6f1ed205bf7c0dfa6037789fe8d5007d
-
SHA1
71299370d4138ec173ca38a1735b6727f8d6ad6b
-
SHA256
6026ca9dd587aecd049f4dc1cc212f882fc717d857889d35dacc7d25022f3cf5
-
SHA512
be7628b701cd598a83c5b77d631d406ce2e59f05de23c8461bf4d1dc1529c8236ea1476a1118e60fea9e928ef19151d91f92a939a9be8c21dc1573331fc53dfb
-
SSDEEP
1536:5nk8vJVEOr+6XKZVU03Y/lWvQW8Xz+LKtzF3iAv1nXyZiqJ6Q:W8vJV1r+6X+xvQWQz+LKtB3i+1nCZiqf
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422729807" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42187721-19EA-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2528 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2528 iexplore.exe 2528 iexplore.exe 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1120 2528 iexplore.exe 28 PID 2528 wrote to memory of 1120 2528 iexplore.exe 28 PID 2528 wrote to memory of 1120 2528 iexplore.exe 28 PID 2528 wrote to memory of 1120 2528 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a21bd1e52c118946d600ec46d190e79e
SHA1f146beac28dc73d0c3537ba106ad87c95beeba69
SHA2564050699b3c8113e6869f387602d47a497bf09d167fefc48870742527a00475cb
SHA512b0928a5c38475313c5abeaf2f1e71a8b277177d1e3981bfd1a3c6dd7e79d219b418007016c34b0784175a6918b3cf709fa5b1e84722e97f0c0d8c40756a9d926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520530711b563b28ad818b33e00c26d01
SHA1e978172171b20e226d2891a86751be1cf3bcbfbf
SHA2560f78aa6d754a1ba66c605c66b944625bb999f42948cc4207b55abccb027af369
SHA5124df288f5efb5b623c30eefbee7f2f416bc6604563019217229305724ef34a7bcd516cf1859f4921b9684c828bb1a950eb6e14c950b1940a15262ef4e16d0d258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3620297796b71a59597c7b4dfd4dbf8
SHA1dde80fcebf43cf7481d7c904b0a09c67109b5a8f
SHA2568fe81237566dafbf6647a8e03a41ccadaf5d3cb9dd38251ac94db918834a8eb1
SHA512f5871fedd7c271d130e053068abf01b123d305f887bfd333b419ed6fa7b94d99256feee5690595d853f185b601c3498102e9bba577ddc4791b8b1e1f9029e862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535c44daf33ad804da1d9b1379bc53cee
SHA10ee45df4b6b1b98c89af6542dcfb36a8341a8a09
SHA2560fab1e58b007c8f9d2beae6dc75cfb9543eaa824f99d9be48152e5bc4acc5e0e
SHA51277420f0504d901671c6b0271931276565adfbf09c1a09e327fcac7db350536edacfc37c8ee097f8f28f9e824653850931fa9b1141a4b987b1691e111a3c68c0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa05113fea5be03f9531a00899c12768
SHA108835217a6354494ac175d69724ad17872bb53f2
SHA256daaffd90b0076d1c5e1b0e2a1b4c8af0f27a91e98dc29f576edd80ef2815e2a1
SHA5127084a1f9fe21606a3241d353ee538290060f78d681bee1f5d28bdcf69fadf9abe3a6cf54cdb9a8fda1186c9c98c2e9433441363877f06003a0f254d4ca72c480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523e0875491a9e2d7c6b960dce7af23b0
SHA171196954776ee379b08089cfd7ede938d9c19292
SHA2566bc6ed28b13d2b9302a5347d69669f442dba441c7d182343463785366fdc5690
SHA512256f28359649299d47cb145c9cf6ce633e2cf80521fbee0ba2d637b198b2d519dc8135b495ec0a4456fecf5335a8991eeee0581d1defd608af8fb6b45afcf3a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2f5c0822235ea489ed9888667e21173
SHA168af1d52df37fb4411524b7f2f9a373aef1b4c2e
SHA25631d450362dd137eabc3131a0c3dcd214c5df72c4024aa4f1b9245009d9b27a10
SHA512e71bf6b9dfc47970f0127e3672a2553df597c534e599729ba7b554e1d553e96108d5a8196ab28bb67973f581030887e98c6dc44e162006c2229c60516a654d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576d665113feb37dd885731f25a43e4b6
SHA1c34f65a3cca51ca823953eb79b1ae1100952bea2
SHA2561f02bb0c4bf28a0b9cf14fc65b916e9e7ebe814426b05d0e65d9bdef208fb786
SHA5128f265376f386929ff0f407e44166669dc32d0be3b0a55dc00af214ff95414f58d0067905760e3c60b4202ac44b86a5e7e70820ac8e553e2a7e5bf06606e80946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffc8fe46b8d31f6099842334542f2296
SHA165c36838817a14b37491ba5bf0c9dd64ccaed426
SHA2567b6f453c9c961d09d87911a070802530b011481b5370d3686c3ce2112db592ee
SHA512019c08e8bd3bc76caac57733d3c30a4a3f3b0acbeb8f7fd53ab518db15379ddbc5dc6b17bfa279b7b4af537c4e6cade044005dab1c47d3ab4144ed1713dd9630
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a