Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
7810163818901bb60d0fe1cc5d4a96b9_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7810163818901bb60d0fe1cc5d4a96b9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7810163818901bb60d0fe1cc5d4a96b9_JaffaCakes118.html
-
Size
23KB
-
MD5
7810163818901bb60d0fe1cc5d4a96b9
-
SHA1
fda22329b1a9e794dfcd4540ebfe616c7541ebcc
-
SHA256
a4105b740426244bb72521a17c72b2632e5df6f509d07d1ad98ed657b9819bea
-
SHA512
78745e94b828e7e8459e242fa11247eaecb5d122c4bea3cc59c73c035db26410d69d173bb38e4212fcb75648eb4ed13196d7f85c6db821867d2cdf074a5e5c4c
-
SSDEEP
192:uW/ob5nS2nQjxn5Q/+mnQieUNnjnQOkEntkQ/nQTbnpnQWCnQtOwMB0qnYnQ7tnU:/Q/7eb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97139961-1BEA-11EF-BEA9-FE29290FA5F9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422949852" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2820 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2820 iexplore.exe 2820 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2180 2820 iexplore.exe 28 PID 2820 wrote to memory of 2180 2820 iexplore.exe 28 PID 2820 wrote to memory of 2180 2820 iexplore.exe 28 PID 2820 wrote to memory of 2180 2820 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7810163818901bb60d0fe1cc5d4a96b9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5250f535f0877c872389102893cc215a4
SHA14627d622bfe595d501a2b3f586e2d9feeb4b91d5
SHA2568bb256e568d11d839afd49371b32652626c48b090b5f9b516e43ce73f24a254c
SHA512f267120aac110aa7cffcb6a00fa5732b9131c335a63961c1df931fcdc1a46d05320ec36ea4c58f8cdee73f08a07627eae51d61b705498664622e1c6a9a336ca7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2307b7749f296c1b638e759c0a0bac4
SHA19534ddc4830d0b1fbee3219991a503c2d0cc262f
SHA2565452c033359c2d3ce2349c8721e8df2778d819aaea737de7f8a61712235d6904
SHA512d4b5f2ca923532532da9b9857d8aaf5715d58763348d3e2a0f125f3e16d72f9de6bc67ca675867a60fbcd0f1f6df51145d2fb680cd7a6de1b95c09b63c2a2d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56681ef4f6710d192aae8b6da35f61b2f
SHA186b148253f1604902f22a814de312ff6e6751083
SHA25660993c63cdc4260b4c96ecf072d626aad40d5ea1d2ef63d0f5302b60c32d4576
SHA5123890b61d938a25b5cc3ef0b77fad7ba08f9347049a702da3c858eaa2f2e9f7d6a899d4984aef04024cd55c2db9069703f06792531032a84f9685527c6fdc57e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b3fd90a2022f4dcd4a17478aff13ced
SHA1530db87bcbfed1ab0c7b5078953c0438db060bf7
SHA256e8f6846671dd4e52885b2529dc2ac6beb99fc7adbe6b014b9c501116bf66ad86
SHA512fcb83c4af1735d32be56d5550e1c31cb864d7fa7285b2d075e6b13b4a2cba2069f56426712f7b76c3ab70cc3f1a8456ba31f9e6e279e336b9b9ad598ca0bfe33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d89d1fca40413121c34ed42b89a3a69a
SHA1779a4d1c3ec5999f3ed14fb567ebaa9735d85c87
SHA256212b6786bb8f911ed3cd0cb920adf344bce06b3cacf01ec709a8f88aff9b2752
SHA5120e19f51c0f519ab62c996e3ea01dddf8a8c1eba01863490c385ed652387782f37d59ab780e2070828fb91e9bb5b8a1624b762e1334472636234f1f2efb0f5345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8b4d9d3abed414f540396781e139382
SHA128da182f01f4fb117fe9ef15042a5dda3d78f428
SHA256302552f99825e8017705ebfc40fa3e3d3a23b78cae6e74d7a9b688cdc40c023e
SHA5122fed17e7060f6e36e4c7e4b970723301ce40a4180acf69baeb89aa614044837f792bc2db85baa9105837824e5740a0404182ef6f7b63cf2a092339c491bbcdd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596f32799f0dc3be7ae538b99c27df527
SHA12401d70ed97728eed1d224511bb22575183ac375
SHA256f88ba4209612e5be7a3ad524de4b178b710d26850492e394571202541484c6d9
SHA5126c0d4eec4f37b362130ef04c4ead994e82b12c7749a0f1fe6d5b7f7d523326d76392f13bfd0eba17453b98e249a6531dc2637b5af1137247ef2c32c6126b6a32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57380bf5b76b599c717cdfeb51a24514c
SHA1c71da0c48f72abe5ea19a04ffcef79f7f90331fe
SHA2567d42b646ccd1d27b9f4f5d679431b09c34761c98f21a7a81542c93d9f4dac5dc
SHA5124e53c4f05483839b59f80d5500241cfa887e2392fed31ab3fa64c8a887ceeb8024499fdee94e8200f119e0375663fde3fb720c90eae50618d6bb829e192851a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58441852589b3a4e198972db4d6cabdaa
SHA1a02b24bad85720ed1c945b088bbcbe1973a8fda4
SHA256db8826cfd82ac5ff99e684ce9f395cf91f85a87caf4988302df01da99d3879ac
SHA512ced4d2139d383f64ce7149533480ed64c1d07993d2f67ae3eca71981e2aaafe920c9928a247b6b6af1c730dbad3fe07ae2a60e2c48223a7e300037dda4b541d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584908a1ace87f05d5cbaa22dc3b19cee
SHA1034422cc6d60235fc74357473483817ebf8856f4
SHA256617a08ab77d247a6ed434caefd5034a9c04e1a8e22fb8fc7c833758850987034
SHA512c050144494aeb988c2b3505f029cf607d873df6763ecd0fff5595c33f3481c81d2ae9411ef80f9c78bcce20e5fe27fddc5dd90d813692f1818c71f7427de49a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD568e63d34ab5b6f2593eb65894b9280d5
SHA1fb74727d48131cf9ce4bd3e7a29be43554adae4a
SHA2561c30b4d6d1ad805a982c4e70960de7da31117df3caa607cc40fbb3a166eccc00
SHA512637c881c8ce334e906e0311d704c007d582a72f029617bc28b63df488d7085e192c55b3f05e74a85596c29134fe693adc29338fe6efeeb7a525a453065581c3b
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a