Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
7b0577ae4b1c4153deea44d147d96859_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7b0577ae4b1c4153deea44d147d96859_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7b0577ae4b1c4153deea44d147d96859_JaffaCakes118.html
-
Size
17KB
-
MD5
7b0577ae4b1c4153deea44d147d96859
-
SHA1
55bf6d76c238fedb12e22717883042a24003be22
-
SHA256
aedf76007bb2b353f26adae8567f99b297ef576a1182931a499fd69cd7a04466
-
SHA512
84411ce2deeb10069b1e2dac5a5d1b076cbaacf5937b71856da593cdd80b3bca8f427e8b8a2e739bdb79af4ef783aaa394a172e4d044631603be039bd097c52c
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIH4tzUnjBhPB82qDB8:SIMd0I5nvH1svPKxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423016662" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24F4A171-1C86-11EF-A4A3-CE86F81DDAFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2688 1844 iexplore.exe 28 PID 1844 wrote to memory of 2688 1844 iexplore.exe 28 PID 1844 wrote to memory of 2688 1844 iexplore.exe 28 PID 1844 wrote to memory of 2688 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b0577ae4b1c4153deea44d147d96859_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9539b578868b311e7a527c788a90042
SHA1404dff72db66ddb1bee5e3168519555fec5be6cb
SHA256578fb05306e0a5218faffc8630aefcca4e7cdbf3b6fd88ca1f5f3419e0f90433
SHA512a0bc5c893e1e7615b747beb675959bf27d1413da91aa746ef9e7651b5ee8e060fbdb48578b24b81f8465f9bfc007a4748c5dc6814d9bc3a3100e79d78d72b98f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593d32980995aa70aceb9a860ad39e368
SHA11f1f5e0d8381001844fdcd1abefca185497158e3
SHA256ca05b62ca698dc12687d82c7b6ea532048dbcbc0e6b05883ecdd0d72d00b4ad6
SHA51225714e62986500d9c71dfe490ffe34ba8a4691bb7aeb3cad6e25f3bd15b4ceec4e259dd552bf38eb53f32448bd9a9496eab52aeb83ce0edc1686e32e2ec1f872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6c55e4f902eca7debe94b3e57f62904
SHA1defac020c32c0770ac5e50660fe0c5800fb8cc7c
SHA25637f772b2c65f20fc69dc95d7ffa846e832b9b4ae48fd612bdd5d5acab99909a6
SHA512423f6d8ca206318de094b706d2355be6a37aae358dbd6461141ec588195bf777d180293711622f4e1a4b833d592193dfbc5d49ca0ece80e442ee6cb87c27b317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5700d56203cb542d4eb4139fdd4dce497
SHA1ebed6e22f2d07c2612943dfd5133d49277262675
SHA256f0f5c8a22fea35623198f08a476e7e8ff4e0b74838d598cb65f2ca53f3eac9d4
SHA512a58c2c7fedd3bc229df7cbeb93f8411d863a628b14789b0fd708e93ab4c4bbfb5fe1cd725d2b039fa9c11cf8a15f19f6b865c5d5f6b9286514a50d733982dd75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598608421e2ade0ca9ab8311e1d72647a
SHA12f5153777e1389577dec8649812f9f17d0eee9de
SHA256597f66b611ef22683f13505956642d759f899386c74517b22270eff71fb9ac51
SHA5122fb683363985312f32233b3cb51b5624421c4edb9e469c0f203bd88b8925190dd131d47a5ba92c956e0476de6107dcda2bd68ec3bf0a6916347b10225c2e3635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fc45ae6bc7477e3fb4d175732d36fe6
SHA1b9303cba4183bd3fb602140629b7f40064a9f9ec
SHA2562c278c860c7b15770040d776cdb3c5c65ab615c44665b1e4d81dda16cdb2333c
SHA5122310f252b3cfdce5096c2e2c1563f20395489f1c3522fe395e5a8167e3b4a66e2cde9ab50e08c13848ea1a22ee53f11163c4c9fa5d1b49edf8527c68c72eaf96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c58af4ecbdc0b0c7cdaa0dc2d6ea8aea
SHA190b90d31289d655cc85147e9b11e02ca264c0d5c
SHA256ebe2888f4765b2b565ff38c52b23640d9c3c33825a82be90fb9b8ce06090a6b9
SHA512b0719725b665bd18a098d11a2478d66d6a91c3f3af30d8a2b191b7fa491c923d6d0278d4275a5689f1c11bed02adea5eaa4350377055854093079d5bf44ac8fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a89b2314fcceac78ab5e093be4e8750
SHA15461fb921f7abddd62f6667964c7a5254250fe83
SHA256cb178fc017247710eb9c327fcb88e80c748c2049ff645ddf09f416c1a02d9b5b
SHA512e9c73fa59a198a755f925305ea86431ab2ad9c9b4e3828ac354e6837282c67995b0ebd2138e8625608f26d7bbee1cb4daf9dceaabf31ed57845fddb92a242c36
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a