Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 00:29
Static task
static1
Behavioral task
behavioral1
Sample
704a4e14b8231722bc4280f4784b3a3f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
704a4e14b8231722bc4280f4784b3a3f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
704a4e14b8231722bc4280f4784b3a3f_JaffaCakes118.html
-
Size
26KB
-
MD5
704a4e14b8231722bc4280f4784b3a3f
-
SHA1
334431bec6846265caeecb3110afbfbbac997d22
-
SHA256
1723281592a62f3ecc1d5b494da1ae2916db53960e399ddde525a7fb7d15b36b
-
SHA512
18a150a4fb08532191f9c9a25b5dd8ab41e13d9ce543b1d8d71991130c4b64a7d3ae3960a6258ab72311567e09ee4dd4deea4e7ba21a3c300445837b8cbb39cf
-
SSDEEP
192:uq6f7Ab5n+2nQjxn5Q/dnQieYNnNnQOkEnt7jnQTbnxnQiCJVevo7NtDFo+NzQ4v:nQQ/AygcYKCDO
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422758813" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAFE61B1-1A2D-11EF-906B-FA9381F5F0AB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2252 1796 iexplore.exe 28 PID 1796 wrote to memory of 2252 1796 iexplore.exe 28 PID 1796 wrote to memory of 2252 1796 iexplore.exe 28 PID 1796 wrote to memory of 2252 1796 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\704a4e14b8231722bc4280f4784b3a3f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50351d2ed144e54324894544314c97680
SHA10f007599a5ecca54b0e3d40931d69a91a8161f12
SHA25629dfdb398d60bf03d29a57d47fcd44a02610b9677319f0a66ac594204ec26b05
SHA5123b6fea3822e868a00e97cd12fe2d18cc896d3625af216d3c096bf4567f0442282ebb29b0209e3804380455b626f47443a00ddc89b096397688e4e533cd4186b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bd26f2873b5372944d8c23285d3b399
SHA1ea293a1caaf4641e7008c2c4a14af71081ddf29c
SHA256bfdcf0a405bb1520b87b670fe820dfe5c1c6f6d4afce336d9ea45c47eb2fe0f9
SHA51298280c98a00033125ba2a173053b4f2f15321f14f2a64b7feaa8c33c3e8745d2e0fb5b034584104e051daa2efc68df6702011c22de42d16739c67054a7c49465
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5c0656d197a396c775422e9d5b98c79
SHA1a9f4b640f2982b61246a7af9690ce65fa397ced6
SHA256ca3d714a2e2c3880867aec5a1e1b80126d85f6807dde20d5320189eec5de9b42
SHA51267938344e06bb360892c89f3e8f1a1d9ca7582a6466a2b571a3066e59fa1e8de96ea25dbce97987d4c00d2bf4e2ce7c6c8f3a28b38947c2dbaaf54b0e5fe012f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f10d10553ba6ac173248389e99ae72a9
SHA16eec876810492b4f58402c3905da6c29d4d0c3ec
SHA25643ba972306fb9f91a6e5ee6b6713eec6dfb5e63428b54095018893f859c4452c
SHA512cf4002cb8ec486c54685dc8a786e13abe8ed7c9d1c00000a8a3550ff079ba9e29d501978295bdf4dc650e08262f17be3d4f703d73a42b291a8f3f82395cae5a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9fd0a2478d7be084d94e615f2492714
SHA1b2fad886f350bf18e939400043bf72d21c28ea00
SHA256423bde87a697b7f7ed6aceae3c728c977a7ead936138770db9bb94fac7526e68
SHA51214c994081db4f5458029e2203b8f9528e4cbb53eccdf49c9ad48ea3d201ed58a129236e5c48100d84511a7e1eb59627ca36940ed883f61fd4e0d5611e99d2b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3db45ffc65467eb776e44f3eb61acc6
SHA1c87203430225a2a688931f636da226a8da71f99a
SHA256253181a4519ef3fc697a30713e7affdf9547c548cbebba2092519d73c900a837
SHA512cf9073f0cdeac3fbfceb709aabe489508ce7331128609b16e18dec55c5cf9b6dc2d603a388ac6a53580bb66ca78b0b2524dcf744e8852b8c233139b632513329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f7c956670d0f95f644ab1f77bd7acee
SHA18ea116bf047cc6cc18c51d875d070fcf8141ee1a
SHA2569bd2462992b7bb0fc1d5907d2a2fae0679eb7306b568fde9f51892d70ece5b31
SHA5127227b5060fd93a1d1217d6da7fd2e25daf315ac92827ac060cf6437f40a1d5828f258f184bf7016e686f150cd7adc3d6dfb56f2709cb500fd3360946e2b3003e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dab290497f40bc2f70625dd253f715f
SHA14b3f2c62154e18f3522f239c48d27e2509d90b3e
SHA2567dcdb2533a96aa86182b06be6df3f7c27aaf8e845622c30340e8641e6343fe09
SHA512b10a3d4e8a09e03c40ee5b986551126184a3968ecb4abd5858246dc48255f250e8f22f90856bac643f73054b1e16946333b9d6dc42a3608f6e539a3ffb62f1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2cf4e85dda6d6575a7e69d66858bc61
SHA161255a34b4456321fd4b94320bbd1c16953df5ab
SHA2569c671575c08797522a11c60e7b39cf2c3fac89d6b6d799894b9421029431d617
SHA512132db98f27846690b175d276825d09b030d495b1694eda5389fe3483e9b74f1c7e3c9e41c354d99f44bb8b7f59835aa69943d71fc8b30baedc718088bd5441f4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a