Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 17:48
Static task
static1
Behavioral task
behavioral1
Sample
72c3bb48e551d28cd7c951e13ac81904_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
72c3bb48e551d28cd7c951e13ac81904_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
72c3bb48e551d28cd7c951e13ac81904_JaffaCakes118.html
-
Size
26KB
-
MD5
72c3bb48e551d28cd7c951e13ac81904
-
SHA1
f7e57cf140fab120f7413d4361245cf06b97a4b5
-
SHA256
f191a501627dd85026c1067fef749ff54dba14072a4b7b3e5f5dc30cdce4cdc3
-
SHA512
59ebb9ac3d6aeb99edd07df735bf8fca9104dcd7f4297b5c77297db53a5e242da3ba1b3494e02cadd3bbf7a48f8fa7d8d62fd7e8e392daf643af7ede7b7b28da
-
SSDEEP
384:SUWix8dZR3NprO8AnUxISN12l+25zG8bwKE/mPW:SqwZvpzLNP8k3+u
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422821168" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9835951-1ABE-11EF-87AA-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2936 1984 iexplore.exe 28 PID 1984 wrote to memory of 2936 1984 iexplore.exe 28 PID 1984 wrote to memory of 2936 1984 iexplore.exe 28 PID 1984 wrote to memory of 2936 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72c3bb48e551d28cd7c951e13ac81904_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb3325f0a9095781182311ad71d899d6
SHA1cd5951e93e765c826774343c0b83710a7b9b88af
SHA2561366728a809db6ec090961b9b6e3d26beaff9c48c63271ee5f8b5e0c17954e5f
SHA5122c1cc5ce5a5b8bad87372569393b696c3d38c18390bffd033268c44c321df268a9e17d8434985953e418765ae46f0c3ee560c752e25d9caa01b3e72e3ac44d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555e9caa30ee392e54b1690d9189dd992
SHA1f33149f1268fdd192525d91421a12b1124a81eb6
SHA2566945c4270cc540a2da99e328b4efcf500ac1eeb75ea57c42f44735f40e2ea37a
SHA512c6a9cf515614db324b449474492f994f2fed5f408bab213a5d7cc1264f1c664a8dffc2e4584eec6951e7c0bb881ccbbfdf2233c98c52bcc8bb5c3830ebce239b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c3646af6b9110677f18bb7e7e75a329
SHA1631d76b743c2ab60d8277723b64496d795ff6873
SHA256a4f29e2a0bf5afe5ac1dab596695255aacf4b87c1382ff96aac90a4faee525cf
SHA5121996deeede3b5155b77b5c662bd5bc7aa0c64b2a40a00914404c268cabcb8ff78ae74b7fafa2c0ce3d7e1f2d6b8b8c1ad9eb6057f7f76bfd7647a0bf501abdbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5158fad6c6db1f6c06c289fbe07f48b6c
SHA1a0c3f393b20874a3f217a5a35b02466a30a0b907
SHA2565fde1dd70118ccf0450ca83dea44b50b6e91e26663b618aaa48592f20c0c7a4e
SHA5127b5edb0a92dfd85e4d505b8f48e2b95035db1b46b99cda7112b909bb4aa49a5a55a793a73fb7bb57accea4c67b8cbf6f2919bf29a191ecab2660ebab904ca2f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fb29bde195c8468ce4af189e8482c33
SHA180afde6f3b2cdb95bb509292aa6e110280c67056
SHA256cedc8ae5d56bcd37454ac7936a4f7e7290d84904387be0a335e854ba0c35bf32
SHA512a52ad47c68cb3b0b81e29b0dcf7acbfd51908ed53feeb6af9d50657ade2c6fdb449d1bcf9178950f94334ba8d71192c90ea8dfa6a088fa092c5012017ed47d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1ca39f738e73d56d8196fb626042981
SHA1034f9592cab8240e663ac21ccbfc59807c7e7032
SHA256c05cbdff8597f981ac8f138871593ff203058c0769600b8e23f7891e02266ed3
SHA5125f740b551115ba7331c32b2a5a07b062d16fece00473fc431d4e4dca905a42a82ffdaf7be589159504fec40a2decc9387b594160b1b2fb6bd7fe681c51a581d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580893d31140f6e169d41bf04833b46e4
SHA185faee27c2a7ab4c57891cea7ac1338cc4eb132f
SHA2561e2515f02519d933829147d65a107b3c695fbd813d70d6c53500898b8bdd6ff6
SHA512ad06db373597481354abb00e0426bdcfb35000a1ee50099640550c5d4335d48ed4624cfb9c50a61d5673bd88755ec595d74848e94a33f89e8d3153e0bbe94ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e96047ee5baede54a50512a8d7e23c
SHA1e156116ca5b5d3b8e393d542e8d2ab4aead72d58
SHA2564e36e9e8a872be545e9e98c97f4c6c760aba1dc788bf8cf4fc7208a0c810facd
SHA51274bb767179abc9817287f31c2c56674f045bbab5b6348d274ce4376f0f95e44a20ecefbdeb4f5fb40234ab9c4b66617943c7141f618a3a4fca5090cc35eb383d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a