Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
719edebb74e081315f3029e3a29c8200_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
719edebb74e081315f3029e3a29c8200_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
719edebb74e081315f3029e3a29c8200_JaffaCakes118.html
-
Size
18KB
-
MD5
719edebb74e081315f3029e3a29c8200
-
SHA1
d4decfffc7dc4a2590249014c18ea4da8ff98258
-
SHA256
c34afdb993305a8186b015cac308e0e3024ee50f71b3fa3154f22233d2266d77
-
SHA512
82528006bc4e24e36257df10576ba13db52b1343b7409e8a591a38dfc4d508e90e52801b0b73a6b8e731404d2fdc35193b147563c1e5fa66a311d74b7451e86e
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoA8c4HzUnjBhZz82qDB8:SIMd0I5nvHksvZoxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422794013" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C066F3A1-1A7F-11EF-AD44-52AF0AAB4D51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2956 2400 iexplore.exe 28 PID 2400 wrote to memory of 2956 2400 iexplore.exe 28 PID 2400 wrote to memory of 2956 2400 iexplore.exe 28 PID 2400 wrote to memory of 2956 2400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\719edebb74e081315f3029e3a29c8200_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593ac0969b51ecdcabd981a476f43eed9
SHA12e4bc0df32bb9d2ef18c6bd1d225939428d892ef
SHA25623aeceb634e400d700d591d27a3e07ae66d1571c89eae992ce6df13e44946b33
SHA5127595408116edc1a372bf1716a4cd2189d2f040e0a660b66012ac58dbc2f940ec124647fb1461ab8834076994491ae1455e780aecb3379bd01184e7c93d17a773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f3f00c7ef349cb983e32349060e1f99
SHA13b16be81e15b0d788f534f2f4a8758a044a8403e
SHA256fc77fe7e4179050f26a571dc4c31301fa1728f1dcd6217f1936ba62d09354212
SHA5123de0da6a2521f8e2e477f6cad5fc49c0f6fb6adfc488885f9185307c52d785630b358de21c8ea78d31becd62b0a7a0a40dde5e1ce28e79677b392dd63dbc0844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e602dce415802541ee7af3e2d0b094d9
SHA18369b3c84d161b5f088279fbd7947e599e324ed8
SHA25673d1a4bf546ad9caa5c733654398058440e63709b5411d27633ecba590f667a5
SHA512935186182583c2f897eb8da2555e8a948b44938c88fe325ac85c72c26744b72c460e6b7539f43c73de47a31a85cb9d9fb7d08ccb2fbb968ca682bd5d416f160d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5006c025872b7ad5724f0dc6d88582614
SHA1614398062d2a10ab0a8b6e8d66ca09ca3e0b1403
SHA256cff1cc9ed721d5f7aa0adda8ed6c8cef3186951c1f13e750393ff9cfec82cd5d
SHA512f674151ed65a845995fba4ae11f1779a96833a83185aa3697a62ece28825f29cea58c545ad1c4d98f3394a9f521ad15f189eaa375f5f6ce27aa26d537230c7ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5125e42e227c5bf0bd149d47c4d9fa0e6
SHA149eefa6cda1adccec8c4c656e55f86c6c9ee864d
SHA256066a95b1a7e99ead230476ea7fa955810568a2f1f2e134feb267cfb00f20df51
SHA512efb82961fca17bc8882324c7c3e290c0d321cbfff4299b9082cca89322046ed72c0cf01394f37c6dc1a1db75c3b54c9dfec2e2af4606fc746ba199196278cfe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5150aa18450b9dab2f4d7b0d508e3fa10
SHA1d3b37f96ac9098767cd138b1c45ffcbf819dba2c
SHA256cb50087a490888d3f12d69bbfb099d37156a44c7d3826b17da45f1e7d9890281
SHA5121ffdab68a65e679c2a77220f0fecfb6e7248c733d118792c8adc80b91b1b0ff43e5b7a8a02d7a963cf147d7592040a2333d18c0f6c531b61a1a5f5c546cedeeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba08b7c4ef27922360fd96453a1238b8
SHA1c03c4a40b744654959d1efb7cd8b1bf3b7827223
SHA25683d04216acf5ed6a52bf28ad59de18651e7857f3d1bc82b1740fc5ac73f59e1d
SHA5129e264d44cadb741f28c1fdedbae200efda76f921be7bdec3b5c9298c3cf273b4fa3cef1213936bedb2efed246fc03408ea224aae3c2af7b5c99bc7f4027eaa99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e18328493e97ec9363a8df2d54773023
SHA1c3a84bd79c46eb9f828e9774cd15d392153ff1b4
SHA256912ff20a92cbf78b68500965834a93e7514ab842a26ca4bfe59d6e8d881cb483
SHA512504df292e9101ef890b9389a632f4a8e020282aafacd28e840b8172d36566862936fed3a452a5b1a63b7f6433481b09fff9d59d823989c442f6c84a16c6d36b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edef33be13c558fd545c124e92bae176
SHA1a54f4aa773f0956bc1acaf4a006943cf30c75837
SHA256c88d5954c66c3d413d7f08905c47aa79e19e72e5f14fd3e58df26f21f8c9fd70
SHA5121062926ddea970ac74c5e7279b01dabd44d52478940adf6d5432928669b1ea9270705a888b7d15b36deff9c5d10e200b7f64d3ed7e6bf1d36932ba7735f38faa
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a