Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 04:52
Static task
static1
Behavioral task
behavioral1
Sample
70e89ec5ac072120ee690e5465919dfe_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
70e89ec5ac072120ee690e5465919dfe_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
70e89ec5ac072120ee690e5465919dfe_JaffaCakes118.html
-
Size
23KB
-
MD5
70e89ec5ac072120ee690e5465919dfe
-
SHA1
8d805ab4ccf252426afd7844e2b32f150e77d4e7
-
SHA256
8713b2bb3f527828c576226ee575040e371d4e4dce31793bf203956c8c7cf298
-
SHA512
06633414842b490f2cad6a4893ae01f4720fc266be4af2122dcd9a70ce36a4702d9176e39ba8473fe207e4a72646b969f312478807ca55150e79571fc71a5625
-
SSDEEP
192:uw3lb5nLWnQjxn5Q/anQieJNnbnQOkEntK4nQTbnhnQcGLnLnQtpqMBpqnYnQ7tU:7Q/SGyr5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93FA5E11-1A52-11EF-9CEF-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422774612" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1096 iexplore.exe 1096 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2212 1096 iexplore.exe 28 PID 1096 wrote to memory of 2212 1096 iexplore.exe 28 PID 1096 wrote to memory of 2212 1096 iexplore.exe 28 PID 1096 wrote to memory of 2212 1096 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70e89ec5ac072120ee690e5465919dfe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cacc6c6dcef8d191a0ed6d2c5e9e8265
SHA15ab5b733d28f79b776e18998f086b3baddcbd163
SHA256ee2ca3547311f1f6944d726fb4de4f2a12051efa8b2147e8d28d526a21872729
SHA512e4b23ed41580fe4fd670e550cca7061804698b3864220c0ba6100f972d36be6539418a9d2f442e5ef7059b52c38a40862f7f52b485a53b3b95bbfb575c176131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554ebb36bc6787b9e5a4f59c485197394
SHA10538a311cbfc3ae159ed459d025d85d553c130fc
SHA256f37eec2fd547daf3510836506be9bf801965d23951ba361dd0d9ebf75a656a1c
SHA5128bd25ad93242af2bdc7bf19b6c702ee13a8e9941f183ca0a4643cb79028c5e974666a1dd5bf3307459f3dfdef79d02a9dfbd8000e78fe3cc5ff2800c0b309753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1626a4b5d852bd7f0bcd40d83dedc96
SHA1097591d79003a19f2af468532a7ec80991451e61
SHA256b63337ee9ebc5f2db9238aae31340744036af05d9cafd0088fe4c7b5b64fb695
SHA512a0ecdc569d7a325980aaeca18b22ce3799f3d8caf1de0f103eba13cfbe042451612e466c2dc41109d49d4f085b091584a433d2542eaf0d312f62419187e05de5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fd55a5e0bc2058ddbc111b12f623b7b
SHA117a5b61d74a92488e8530dc7b35bb0655c00b932
SHA256e76da11552e44fe4ad1f2c681888932bb36f41a0efa3de9270974acfac390a80
SHA51235659655411f45de14089ad4b28d6f73db81129b51cb5997059aee4104d7d881d276a902d22e3ee4ecc3a08aa525d037a0fdca74422467e3f9b34baba94f3ac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564c9fa84f1ff60096dfa1bb5cad52971
SHA179b714aa157b77b2690e0822ec2c04dc29778c99
SHA2569de829e785a31278936501a53501529fd19029ea7a818b526561f277479229a6
SHA512c45c39354ad782a4d8d5df75103970466aa1e763d0b311b515e045bee972ff46a4df3ebe596481495ec537e3d38d1c4a2c87549e527d8818f2965b9212ddcb43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b161c832426091beb7f5415e8da0877f
SHA1c19aac512053b9f5a519551a057b40e38dd987f9
SHA2563c42e301ecfc2205669b6e361a74a18c36adfb32ff7b745d9b118303ecd557fd
SHA512eaaa43919931eb909dc6e3e98a416c6b0767a10148f5cbc8b2bdd01423660cd2e6b659e5cc16ca3a1c1715c1bf8752ae7a083ef6548ccbaa520b4a3699c5e1fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521c27c68df2a3df2be0d9f45275a2290
SHA111ede0877e6ba4a216f79a77d238b63deb0098d4
SHA25653e583ef7f0187e8caaec075589cb3bdbe60cd262e6f9d5e308e354c9d1c6be6
SHA5126a6199e665e936e3b0baa1937a2d177dc0c21b3c7e4b2692266a1496cd23aaca51350ba92a7efcbe96d91f5a9885aad288cad9e33f0acf2ed8e7b7bc28fca8e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b405d2e0c11e248fb7747d1b0c087b1
SHA131fed61939701c6fed3e2635d45ba549b0c339f4
SHA25652598e6bfeb883bdf65bc7696590dba6a74882bbb9fbc4a8ada2a471c9854d55
SHA512b9e95401ee606b8d6ae2ae2687d3568b7b9b63b507bc3b391e88f9054bfba3d2c5910cfb59cae40040c50082649863fafef0715d8506941ac6763e03d02a957e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a