Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
748171f9b0e6a8f9946dcb876ae81f90_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
748171f9b0e6a8f9946dcb876ae81f90_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
748171f9b0e6a8f9946dcb876ae81f90_JaffaCakes118.html
-
Size
27KB
-
MD5
748171f9b0e6a8f9946dcb876ae81f90
-
SHA1
62a77115862dfb01834f45f720fabc976d61926c
-
SHA256
26480cd3ab1090bec10ee51bb8434ee57cc037e95e51b0a82a385bc66c37406b
-
SHA512
819ffdf78cffb7f3df0fa4dc324c20dc0bc67dda403999d7ee90f50d5ac7768386bb26e31be4e5e18871a085b522332b6bc68cfa7970146738890929b362a4af
-
SSDEEP
192:uwXgb5nSWnQjxn5Q/ZnQiesNnAnQOkEntHPnQTbnJnQ9eOkm6Ahk6Ql7MBMqnYnC:rQ/o38qkdS2RC
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422864284" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C9FF981-1B23-11EF-A4DC-6EC9990C2B7A} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3048 2212 iexplore.exe 28 PID 2212 wrote to memory of 3048 2212 iexplore.exe 28 PID 2212 wrote to memory of 3048 2212 iexplore.exe 28 PID 2212 wrote to memory of 3048 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\748171f9b0e6a8f9946dcb876ae81f90_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd2ef10578c7795c412d5c0253e18b2f
SHA1c78999653919f74646d3bfd6efe6bc4d9973e773
SHA2568a31cceab5383c93edcda7a12695a8e68703fc0cb18b367a5462a314665945c8
SHA512eedd7a5c33252ec61608a79ef119836ca7fcccc707ca2b8bc27a600872c3a039735e47dc807b76b3aa331fa68e8ded08bcb7eec65c1a1d8ee3f8a0bcaad721e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5080bc10c263f6566a4404bcf42063438
SHA13ce064bf5084db47c0681efe321e9a9b8f29dfd0
SHA2566ca0eb0a0ae02581e6eaa174b5cd33e9647aef827d9f84b7ceb062fc5aac148a
SHA512574195bdc1e874121584945a9d50459bedad73fe658a0473334fd1bdbd28fbd7d5085b9d5893d9aded4002f223b38176555e2fb1ee1272a3a3c884d5f1aa7ec4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc63205ffd0a789bba9386ff053ff263
SHA1eab60210b86bf08e3dc219977ca3337881db8d74
SHA256b36c44d3699c1fb1a9099ff9195cbcb49e348200b188c641ea2381d94b48f33a
SHA5125739358fa5f58c8589784f3eb179fecb99b627854eb6c686e851ffebaf7aa78dae427c7ad0e48c359197ce53f79dab414e61c4beef93d170c8ce6e5ab85f7c38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cda2435dd3ac51fcd27327c5630bbaa
SHA1eeb0a85dcac2c187b477be16ac97dcdfda980f5e
SHA256c66b7e16675d1aaf03986be6b3a110c944581ec184f3ca95c93e02b782b19a1b
SHA5124ab7553837f95d603209ce622389872d2b1b38826f8b51cd449294fe33050f0e3c83718f57a94c49c1a6bf753aab438d4ef7d1e478402e337b92c331808f27e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5212eccc3e91bcbbd97b7b4ab2686fbe6
SHA117d3af476d4aa8ac464dece78bd28ed1e01583e5
SHA2564b48f7736787fc08fd6b946011a35776b32ae852494b797eeb5eaf035694eb95
SHA5124616fcf9e5b1c8b5644817fcf52acd0a57a22f4bd87bce11d00ce0edcdb9cf3fb9160866607055a4790816d8426eff91cfbed1d3026fb45e09ce177bd84c0d82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e734e7bdaa98956647e22b5e1f44aa70
SHA11692d8638c745c7eacda5e60050cbaad8a1160f4
SHA2564488c4e86e6a5779f367fee4c102dde506f8685049df5aca924a20a1cdf3461c
SHA5124841652bdf7d55f2fe0c4d46e50214cb43b3ec4473b5e9b19c36360935d4c36333c56aa66eee76ae5d2f7dc0fbefb669f56c9bfc574fa7aa43a0357ffdd667f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d6b9deafb1ee996843693a07db3b1a6
SHA14b68e0b282d466fcaf1b3d4033690526cc349b3c
SHA256a937a2603ee8ea25f3b044f3b633179b475ea64227dece4917b59a6ad46489fa
SHA512ba5b6c6e9a4991d278cfd121c364ac107d92357f9233ac423811833299fea72d884ee23b2ec9bfacdf165364d83d5b492dd8f16f68c37f3a263d1261e0a7d577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c739dfc9a1e9a3b93b2970f877bbfe2
SHA1d12cca61737159bd80a454d26db702f72712f894
SHA256e5618c437824557a40299a0eb10e3075943a662fc92d30e76a435d11766f9915
SHA512994b36b2fbc4d4f9598b45164021dbebfdda96a83ef7761f0c4921f0578a0e9535f7758c0b2c40014dd7dbb15afb53af150bde71698cd7bda6658bd102a14df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59000b669aebbe747c3193ec8b0f4df29
SHA1a9d3ee9315a683411c65a317764f5fa92d1ce41d
SHA256773a6676fa21a6887a0a992f7339d40ae1ad8624218065343e9690fefc409bea
SHA5120c64a3f075ce8f1f456687344a15a9cda72f630eb254c477833625607346c470a0bb3b63bfaeb265e46a0681d024b5d88961196cbbe3b6c7c9bfa6254a9e09a3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a