Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
752e713c980c70228418114a41c9be06_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
752e713c980c70228418114a41c9be06_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
752e713c980c70228418114a41c9be06_JaffaCakes118.html
-
Size
34KB
-
MD5
752e713c980c70228418114a41c9be06
-
SHA1
c6f5538ea1c76fb91d8e6cb65799277271757fd3
-
SHA256
492dd48a934e4652299d3cd06a61ef2d15f99396184f93593dd2babeda7b41b7
-
SHA512
4375c1900ae3c43094685388930098561b74ab015aba1deb9eed454750bcb25294ba3df79bfea4a21a12ae27b91905e63d6d4b1182636800858fe81cb4c5078f
-
SSDEEP
192:uw9F5AcjrlIIob5nGsxtB549tgClYcwnQjxn5Q/AEnQiek7Nnb8fnQOkEntSm/LI:1Q/VUgtEy0domQQ6kWcdPLKF8q0OB
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422881428" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47588F11-1B4B-11EF-B54F-5EB6CE0B107A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2924 3056 iexplore.exe 28 PID 3056 wrote to memory of 2924 3056 iexplore.exe 28 PID 3056 wrote to memory of 2924 3056 iexplore.exe 28 PID 3056 wrote to memory of 2924 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\752e713c980c70228418114a41c9be06_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523b3f2371f7a52684a43fb78bc80c89d
SHA1037c65d1ebd1df44a195e0a364ef5d8de8ac8166
SHA2561019d7b13b288ed82fda56413e55a3f9244f651e86fcdb50f61e2e67ddab9e14
SHA51213d5b8a79154364145b2e6aae6b0c0649ec744dabbea1aa3647b4ddd918c741f77a137d48f3fafd1c8d22830d9a7aaf4d111d9178abd045955c4d16b325b0f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5288dddbf2ca941369fba6363ad93fb0a
SHA1b787977986a83218f6491849f1641ccbca1a9bd3
SHA2567c9a062e3e9136f44477c78091531ca55445545fb214faf73dbdedcc137d8770
SHA5121c39fb0b2dc730ea2b66632f0070e9e76930df038062639f94cb00cae9293a0d422fe3c4d28f8df0b9fde8824c2e31fa127ae2b5f9df9728b22f93dadf3d1605
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52631c3ed6db435e6db9152bfa7e2e941
SHA1ccbc78a845d7194a9c3ae2e829cbff5cec1b2f25
SHA2561cb81c3981c17aea4c1fe8d965d041b82e9be9e9fc72a1825967f203ddc0edf3
SHA512d0473f4dde4fc57305ec9b6c09728f3c45f505d63534940bc442e5844ba9df8156218c70bd8644352facf2d995f19c1df7affe5b838cbe9981275596fa1a00d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52997765ca0265c0a00d69fa528016720
SHA12fdadf20610dcfde8632f7cbd9150a6f7f74ca53
SHA256111c0461362ea8773ffcc8f706431aac8deb667bdb899802c557e706abcff037
SHA5129616f0f1e96a75057ae672d3aa26428659843adf6861ef1946f555537b6b8de9c80cfcc464d7a904baa34d3e0da1d8d470fc1a00027c775aa0cb94a3eac4f89d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51de0fa01b94b616ca25bf7a6d620003a
SHA1e694eb89acacab6060ca2ce286a673b76cd050f6
SHA25607c57224bc19d85708bb26a2e0509e7e07ee33e6ad6aec5b723cd85ea553dba1
SHA5127891e5c82fe7c33d2ff8ecd437948c8be7e51343cd3d059b2d1573f620e94bdfae31979bd701857b2d811830bd77d30bafbc36a72838e6674eb3146fcc3ef751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0842844edcca8d34819b8a9e8a73eca
SHA17cd85fef30080102ca3bdb32dab63b6719a6d8cd
SHA256da6da84aea0b6c2ec28f7db7ebd2c9d041d8fb2476d0e3207c28b0c8f0757abb
SHA5125d8bf95dc03c337ae1bedfcb6abb47b44f3042902bed3fbda88a73a2d10df1e1e32892480d29969a2e2de4d7a4d002dbabaa80027772bfe7b7dbb490755b5fe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54670eae573f9b782f972907322bd962b
SHA186bb682beefff6032ea48e4c2018f5f59fafd999
SHA256d2e95743aaee12760dc36b90e5613d201fa24b1617d3f7b8bb94197a091f1e24
SHA512614ecbbb2191ceaff7387cc85ae3c7cc4bd89ec15039ce62ee840fb066af2af798b5b5c47b377566662fb9a8f57ddbcef41ee64ceac50f08d93749180308508d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5566c2cf2829f27ab88babaac63752385
SHA123528d442e95fbeedeede932b4fa6ad0a5af5956
SHA256aa6ee5c98d51922e25d2f0ada406fc775a1f03546aa388f9a8c4436a2a4dd531
SHA512c906824089c888d592d3616962622a27dff318c16270ac4575483e618fb2aa46890862cfb568e4e743b4aaafad90485866be4e537598c16e50e4a04c6324c188
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a