Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
7ad60fc0d16958f04bc2ffc5e89ff10c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7ad60fc0d16958f04bc2ffc5e89ff10c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7ad60fc0d16958f04bc2ffc5e89ff10c_JaffaCakes118.html
-
Size
23KB
-
MD5
7ad60fc0d16958f04bc2ffc5e89ff10c
-
SHA1
d2867d8a32fba0ee290bca55982e2f977136420d
-
SHA256
8af3c95bea5dc06ce5e6dbf67a8b2d4499ab946aa50101c710490e580efeac2f
-
SHA512
f59246fa61b631b86b7e3f7f13cd371299a5a289eadece994a239fa134e72e19bfe3f74570095528b1be95931769e5e788f6ba80fc53f8f49a57b22b2f85eb46
-
SSDEEP
192:uwHEb5nmGnQjxn5Q/dnQiewNnEnQOkEntbTnQTbnxnQHGLnLnQteqMBQqnYnQ7tR:rQ/8G3aQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DD946A1-1C7C-11EF-A538-5630532AF2EE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423012542" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2712 2164 iexplore.exe 28 PID 2164 wrote to memory of 2712 2164 iexplore.exe 28 PID 2164 wrote to memory of 2712 2164 iexplore.exe 28 PID 2164 wrote to memory of 2712 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ad60fc0d16958f04bc2ffc5e89ff10c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553704bc5f34f89949c6ea421a8413739
SHA10c9d7d2db71e946aa84db7c962f40fb004ed3af0
SHA2563cd41152ffb92cadc59a232c6655207e844e88a203d942c7015df85babb2be1a
SHA512fa2f29883bdc71b0928822b60566ef63597d28ecb699cd6c04784dbdcb74c08ffefde843120fb199d265641f216349ec659fa553f03968a6207a529b1dafd33a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511aa7c8ac528bdc8907e10ce5aeb4487
SHA17ed2e694aee496f97947f15411e9cf52be6e864a
SHA256914cbc0318690947572ffc30273643da436992981ebc9b822f0345e0267d9ea7
SHA51269f8272d0053eb877469c0734ba68704a44730acb7820ccc4277d90150f4e503bca27c6ce401ca87bae063b265643cd159a99c1ac6730584e7852e4a63088b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519dac70288cd06a8d1cb5d9aeafcfeb4
SHA14d674ab8372d65bcb9cb240620ca659a9046ad5f
SHA2563502effa3a4eb845a364485401f1def65804458d01e817d21b630c504ba09d46
SHA512b95049613d86bb234ccda9da98d9f50218791e08ecee0b6b24facf2273d3941c9ba7bde4c0e3f77fdf0136fd14bbe90ad3cb54a338bf8e71c5ea52db7602b1e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559f6928e17289ff729087c87572cf948
SHA11ec69405043a0128416e6bcc02c76007e00bde0f
SHA256b6aa3d7de550774ac3fed442458001bc14fa3e6f1404e1368fcca0b63bfbd160
SHA51294f307f9d9f9ea0cd70081a46b9459255e601f28d015da7f442f9734257c699dfab6898c23f467b3594fdd505400438da58918032107fc0abbd12399bb3bfdfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5248d0e262736ef928643d2857a071614
SHA1924eee72fa267e3eefbf97151eada0f7c4bb7e95
SHA25630ce50f033e912867ec64541b93e54f708d972f4e2a9de701559f55bc1f53488
SHA512ed54a09b48ef9515d57d46c95ca848530434ef1c187a64dee5e5a951e3c1e6e1613fd9f12198ff9b865daf677f0c310b7c32e2c2ceb013b206bca8145ca7fe73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddfc8420760ed2d80eb73e3396ddcd93
SHA1f71a0c40c7fdf3482d6f7f31afa14188592c56de
SHA25652ecfe05fad826e0de6380f4a18218c132468eaded7d841cc839f3319e4576b2
SHA51255cb23606dec5fd197201e3b4ffe44df3f3cfee7e684c9b6f7224273a16b3172e5c4ed334fb9573dd3175ff8ee2b87fbafee8171abf8812cb9736367b5edf59a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb68343f6e56f6d3a1810e539d05b600
SHA1e4dcfc13d9bbe07bb0ba99a844fcb4b9d38a6101
SHA25615625ecd249a2ad138d7af5dc84fa1f1917af43ca907e80497ae3bf898a0bea0
SHA5126aeb95a59e0922c05d62fb46117dc0dffa5f09b041e04241a7b73ac4d257db92ee22e4f290c30e2d4adbdcc660d60c70680f824dc142138b61450d98097026ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a3d504af4e263df1ac8ddc6da946f20
SHA1f40f48769868078122d76fabaaac65009c69cbd1
SHA25630fd38c6a4d8e8e21db8ff167ec1ca1bf183d3e8800441f991f92b102570302b
SHA512d867d9a101ed9bd7bf452948db13caa586d74bf25e13825c654053939fb6f705d12f65b57815b0161f17d8c18a8ffbb43c810d7147a8976b519d0d5db8f97054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534109d61f643950eb0c497697a180883
SHA1485e1fcee18171b5ffb73dbf16022ca7220959dc
SHA256f7fe6e10fcd97eda49379ee22ebbc1fb90c6c23a2bbd471544bd03218fd8482d
SHA5129ec10169c4189058494dc18dbdca6d63392ebec2f7000ee0caf1060d9f6b511d039f2ddf33a83d3b65163f48d8ab672ae942ae9c21ee438788eb29ea4ab8cf92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532e35d0af9c72dd4d9845c82a09c7549
SHA1bd44fc9f3c1e16f337892db486fb2e5b552bc81f
SHA2566432ad5ca7867ebf054b9b78caeb0471b243568a345b849529627fc2ea803f76
SHA51242bf7253a1b5903a255f54f448324acf285adcce618df7939c509e65981d6b1153d815e036f3a401509f27a7a5a2ef1d7b46b9861df662ea167fc0b22dbcf48d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aad4cebb977661d61307226280c68aa5
SHA1741653de16d0de1e15be2002f5b0eab6dff6778e
SHA256c6d0b8786e8896d4e0a8238da4c1742a093066c21ac949682a6c3c16b40bffa1
SHA5129dc24a9a563b93becac35c48967c8ffdc582d811b3fce7f6e14792478e87cb8aa6b887bc9f7c2385efe973cbcf4ef4bedbfb57d6a0c78e7155e8a4f7bcb1da0a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a