Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
7a01775a70836d3b26924e4c83c82b59_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7a01775a70836d3b26924e4c83c82b59_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7a01775a70836d3b26924e4c83c82b59_JaffaCakes118.html
-
Size
26KB
-
MD5
7a01775a70836d3b26924e4c83c82b59
-
SHA1
de73ec390e66143a12b1c7649025545e7ebbabc2
-
SHA256
475de2e7c99c92df1ede3d3c3022f16b85e0ba8490445f9c71f72e29b7589802
-
SHA512
30916ca52b91186bf3d0ce89482b00848055eead44f5187323788e2e14cc71dc03caff922c84623ae5b4e342643ed8cfeb45a00faf2803d6d950c705a0f92faa
-
SSDEEP
384:SC8dZUTOKaLS1d71qQKo3b6kUgn4eQJSWkOaXViXPW:SCwZsaLyd71qpo3b6ZDJF1Xu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422994528" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C0D8351-1C52-11EF-8547-E6D98B7EB028} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2536 1992 iexplore.exe 28 PID 1992 wrote to memory of 2536 1992 iexplore.exe 28 PID 1992 wrote to memory of 2536 1992 iexplore.exe 28 PID 1992 wrote to memory of 2536 1992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a01775a70836d3b26924e4c83c82b59_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51013440cb71cbb2be1d52de2752b3842
SHA132b8932892a0142660f2bced1fd35bfc2d8c909d
SHA256f5a5d30e7828bc3e2b33857343a7fe787013d761da6c1006eae21f93ee94543c
SHA5125760160d1f4c43f236b08a94403eabc22335e25af080a3ba7605241302fcdc1f47b138ebcdcb0c412739b1d837fed34f68f6d902bb6ae24536892e5c55e33243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db1fed3fd1f9b0e1f0c6de76770247b6
SHA120d50bc83e03e188886583aaa2c5872093dbdf23
SHA256942351f2831cd881808b76935d9e1b8da6a2bfca9271c56d0b5dceb0339975f4
SHA51233d7df3f83f6a506866829876bfdcad2534dd526cfd1fae136e7a19470ca93897547692314d110080ebaf714f5727218718094c85312541e45a875b3ef6a84c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a16ef742fe7d4c9e69f6c5ec8ffb70a2
SHA119147dea3c34f2c5c2a02dd39d30117d25a1616f
SHA2562756c6018432acd82ae1e82e80479c6195ecaf43f5b7df9b2433dd813b00ce13
SHA51213dcab1ea9f576386f0032d8c589375a83e2fe6807a590e8153be1bfb5cc227b876c7fbc50dd828f7fe4f0d92a4a188fc823f6e96341e6036e42f39bef66f642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50745da0e0ad19f7fc6a7eb6f2aade3c4
SHA1a0dca7bb02c439ce809fab966475448da343cd23
SHA25667504cf99c05ba47dadf61ddc2c275980655bc5fd4ef2b58e1c73d277f29c06e
SHA5125d8520d92f68b4be8d9702e9055f85a3aa7aeb099cc3c6339986e21620f57e2356a35ec3c3d73ae4b11d837256c23a7e79cdbe93b86d358594ff3ce582f8cdc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596f8e5f94be1f33dc678f68631b321b1
SHA117d8cfee44022922d1464fe370dfdbb03f41a5cb
SHA2564664b9095a1c687621e9b4a92e79637888d3c249363a93255216933533639474
SHA512f65d3be50828fd8adfe583c4bcd68bb35a49f1dfb246fca381eec58e5654debfdeb5d6dd8439d971bf5211c09ab20c6482ce77f867c811b832b45034003ea5b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b391905a542cd2ccf66d9519c024ca27
SHA11a4aad19bf3ea2a383f5ff71a1d184f5197acc3f
SHA256989130fc16fa4da113149d87f3740e88fb93ecbb04c1d141acdc55486583b07c
SHA512856e40fb13a8cdb755f50a3b3f3abb7fe6da640ba1b0b6a112502ba4056db5d2d54f405623a5af925c56538aaa7b725843ed46c82afe0abea9bc248522d6a83f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58db0274f462fe42d2714b4d5b5e6d1cc
SHA13b9ee0ecee92138c70be3f98e97d69339677ae10
SHA256b91765775f4dcb873628aad31c571f585543876387e2903a12a740e3e9cc5bd2
SHA5129c1f49ef328479fee0e292e5e6b8272f24c82100f7e6471f02d17f7b91585b2e3e3d777c4aa6465a571c4da7bf74d2c1f1996db6b278c087320e40e3a552a1f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517f0cbe726db177b12f0bcca839d2ec6
SHA14f945983a46aaec0af1f22aec2bb78178f474f33
SHA2567768de3db56dff6982789ca19342df5b2705c1af3d639985706d6ab8013b6f6c
SHA512b5b1c1dff9de837529911e3e8d1d5eaa67b3184826df8642e39272ca156b8b002ae446896bdbb2e16821f2e07e6311d6f1daf33cec5e7a41d864ac4912c7e114
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a