Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
73da25861d87a8c10e784ab175af6d63_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
73da25861d87a8c10e784ab175af6d63_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
73da25861d87a8c10e784ab175af6d63_JaffaCakes118.html
-
Size
31KB
-
MD5
73da25861d87a8c10e784ab175af6d63
-
SHA1
82c0b50d531e6be2d534bacad2b7bdf4b69f89b9
-
SHA256
2b5d47802469c8a8ef567f7e1ad39914b706268572734f106c91d1eec49b269c
-
SHA512
8ce6aeb18a08961a596965b8dd35385d8ce84a38f3665172372a5aef32675ae4ad0e533b4e5c047d6ca6fc12361108f83467fa32ac1d5ccd8b7ec284aaeea8ed
-
SSDEEP
192:VWCk3GDG7GSFGNGeWqGUpGtqhyrRb5nfqnQjxn5Q/2nQieFNninQOkEntiEnQTb6:ACk3GDG7GaGNG9qG8GtZQ/SWS0SQ/jzO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422847383" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02D1B7D1-1AFC-11EF-BB1E-6A387CD8C53E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1868 iexplore.exe 1868 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2584 1868 iexplore.exe 28 PID 1868 wrote to memory of 2584 1868 iexplore.exe 28 PID 1868 wrote to memory of 2584 1868 iexplore.exe 28 PID 1868 wrote to memory of 2584 1868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73da25861d87a8c10e784ab175af6d63_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ccb8141f0468d49674edbc1444873ce
SHA18bea238c7adc0d8f7b0f824897a196e4ade90a2f
SHA2567e8c456e8d3955f632d049c0a95c592633a6fea4bf10424292c622d38680682a
SHA512ceaad00675a166ecca651799f3c46ede8057f9aec94b2a553626605219461c58d69f8ec93990610b8e1fc799998b933e0fecd56e4f821dc84360854798e4477a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b65fd73e0d1c6a77b79218ef8a12dc91
SHA1736309a49377701bb3ea5f75f52fa96c6af6ec40
SHA256021e9c8d6c090660fb0b9a0e0452dc99b38cdb992754ae1b5654db583b976f27
SHA5125ff1bab0012cb917847db855a6933f8d476c05bef3b54cce3ca69167b3e6e470b7819e681537efc84bb476dcebbae377c589c941a2eb1637fdfe3c4e9592afec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da532cf5c8a474946eb6fa00c467a437
SHA1f16a42659932c11412ccd9531d3231b004b16bd1
SHA256535edfee4949d03eee03f3484305e820053e3f794b4247851e9e07b161d2605a
SHA512a54fb5ca38b12c04bc835c908016bda7f66fc4306ce9f22150f337ec7575546cf882047e948fa8e7780d26dcfba3988639243112a49fd451e1165f895c8ad23f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521098484bffb2a867460c57b1ae023d5
SHA12fe07220f59c2737162a62adfc325b0c8887d4fc
SHA2568af6f93dde40bbb528146152ea76821cc2067901b02c797f5e54e3c068190ff6
SHA5122f9364ccdde0429a14683106211a41e7e3fd236513da6f95ec81a81c1649523a4178e3d34855c4e9bbf8ea437e120d8f3917b0b9e19f083a8ac5b538888731dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5803a393b5232505d88e1dd07f556ecee
SHA1df0e438d68f031eb41da992c9e1df0917928a123
SHA25670428fa1d51dcea3836ff764471d1e06478649d8569f427152dc0ab4019c0fda
SHA512530ab648396293bd0295f02dcb350f5dbd0f7496c02bd4c5b322a6db24f803b3822970f1741cb629953175bccccdfa9c6b1e1a310920cc0194f51c7506e1c082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54659ab53f6181e4c2d147285ead8a4af
SHA114c0c7b81634dd7dd6f3a5fd8c1d324ff2fe4e4e
SHA25628cf6d735ca2c48f5405ec923f4d67756d2512c6c4c5902df785e2ba2cad72a9
SHA512573bbe7bbf3a59ae4e96c7320c7b524ee71c921c101a280e100827f3e3cb1b57173f6eb434a5c7b5097dda2f14a7df08a61ee547934acbcad4e0a8799df6bcfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55618258bd218f155cfa9b1292635e8cd
SHA1efc027ca733292c055aa7ebf50cc59ac7875d609
SHA256e6d8b4f02c623611a39390cfb92e54d9abb7f997ce261981fa2fa5255fd270a6
SHA5128615d9c0da099c7ef589f2763f718a86245f8e8a3b2e54858c7f07dc627b7c9ea718cee7c13364ea7a95b6bc148cb189fb70f9236e9c1fa67b707e7449fe5738
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a