Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
6f448386e16865e5c9d83e0a84cf998b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f448386e16865e5c9d83e0a84cf998b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6f448386e16865e5c9d83e0a84cf998b_JaffaCakes118.html
-
Size
22KB
-
MD5
6f448386e16865e5c9d83e0a84cf998b
-
SHA1
411cf91072b25f9b5497deb2e09da2cdc2e732c9
-
SHA256
86a5600fb695ddf1ba81591b64726aa641dc923cd72952f47cfa175791df58db
-
SHA512
d778b32060eb313dc70641741b357dc50089b049e319eafd94029d820362881ce89fa7471056d3e66f9772554a98d7d8d2f461fb655f206a3f86d4bce4a2ce10
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI94NzUnjBhbd82qDB8:SIMd0I5nvHJsvbGxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E1E68F1-19F2-11EF-A34E-5E73522EB9B5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422733290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2200 2184 iexplore.exe 28 PID 2184 wrote to memory of 2200 2184 iexplore.exe 28 PID 2184 wrote to memory of 2200 2184 iexplore.exe 28 PID 2184 wrote to memory of 2200 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f448386e16865e5c9d83e0a84cf998b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5949bbd5caf52b2469e8459db26a0eb
SHA1320e39bae6c59d0c3610b25075904ba00e2d0c55
SHA256c54926865c3b563f11ac8db2524dad566e4162779afddef2fb60da1dcee5f2f9
SHA51253fb520d66bc4950fa15a8e9fa632961bc932e18924730f4f68e4be4874a953b554b990a1b9a25024eda94b67a544f6e7fac6c6e0bcf1dc94c2f3af0533ee512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdc7a11f742fbff5592663e2093b7d3c
SHA196fe8d9dd301b57de4dd5527c3c0c007d0ca10ec
SHA256673a1e73d153a771a8c4ef8f6e34fa934e6693429154d380aa855cf6b1333570
SHA512737c0792d24b64b00eb586c879a395668d5e11a2dbb9c7151eaf096db052a77a8c4b426f8fa494448093d4613d6137db435fad8839695ca5bbc424c59db0f76f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a7490111d00a68213c76f601f9e103e
SHA1fb503e610fa390d70ee3735931c34c08790a14c9
SHA2567b0b7b4bf9fb367ecabf886d032d1454e5836f4c43243351fdfe89de77ee2e00
SHA512c22f236e3e61f9a7c65bddc0f5d0003b1490e5e1f3a41754dc6522156c2fe3b110c98a382533e88dfa6755ab4cc35563601d4f711aa0bfa398bf77ef325336c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594d8b35cbc833c0e8203b2473709b050
SHA1f788629ec2bfe72fed2e2ecffacf0973c4d67f6e
SHA256de222ca47ea423b69041a66c5b4ee23fa58f3ef7f4e3c870c19f3457d73a1b15
SHA51268db1731d712f359fb5c4bf58523a1fe4e596a1fd1af9aacf3fda789a1f2c489c1c4731c4a3a8aa521fb6d668f25efd4d88cb35631947a77875fa25b7985ba9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c725579a6b0fff4153a149db7999f1a9
SHA1e151586e8cb1fd0bc0640a27e6daf2e653fda9f4
SHA256c981073cabc38c66e14cdfd152ac126a9f21fbfef9f0682852fac481ea97d799
SHA51297c832f31bb89f5fb349aa1dc4aa65528a76f3027b4cb321f54db0ae9a711d1fa5b4e38ccbae5fe1f3700165fe806e2c2c59eb20489a420064601a32de7310b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535cb8e5997b46b40c24edd24e377724d
SHA15929d2efcbf0925e4d0b4a4e6443763bab48b1a5
SHA256dea777da41f03ef4268f044c762da7c87049158564d61826d1cea9e0f7ecf834
SHA5121932459a333ac532b457f5144e74581479289660ab8fb37fa5157e5fccf687a5d43ed2dc1f2e4fb5177e09a673c16e8e1d8760bd9bbfcc9774ce4a46155d0b49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f114fee9d4c4b4b2c65f237c7168597d
SHA121ccdf16a94cd668f357f1272a2b3dff87a759da
SHA25694c5bde0c38737a708e2a7ef37a70566b72c91a9547f4d5f2e8b378618da8ade
SHA51217927d997e176872d2858310b8bd96da98b90716a5c03c861623419fc6ed009ced6cf8740eca168cfef2c00e209446528bf60d8396337d1fd85a062b1d12ccfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5530cc4305705716b6c90db43bac77325
SHA123704fd3a30bac3b203e75963499a54ec05406a7
SHA256f85b053e1dd9a26943bee57d5685d36c3a65682ecbfeb7e3e9ad4f20a725b3bc
SHA5125b91cc2754e4c9b800dfe93f9d621e4a1d49b24ed8f6683fec970ba3ec13071e9bd74b02e9ed3da8c99e225a3f0a04c4d56d9e2dd1938de23a8c8c4f496288fa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a