Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 11:52
Static task
static1
Behavioral task
behavioral1
Sample
7cd97f99539badbb71644f12ba3037b2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7cd97f99539badbb71644f12ba3037b2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7cd97f99539badbb71644f12ba3037b2_JaffaCakes118.html
-
Size
54KB
-
MD5
7cd97f99539badbb71644f12ba3037b2
-
SHA1
95dc83b49c0d825448359e07b658ffa4730f9f35
-
SHA256
be35ef0d1ad44f600485971eb021f6d6b26b4043d1f75684c977649a019c96be
-
SHA512
5768663ceeefe157352fcdde6e7a8e5498a99924972fb83efda7a3a3882c9be3b335ab3be5b1da4e999ad88d013902ceac33546910168a632d356e3a48e50f3e
-
SSDEEP
1536:Jpp8eMSm4bzyN7OZEs5tXayG6BOOv4/Z/ooZs:uSm4bzyN7OZEs7FG6BOOv4/RooZs
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061168" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C49F4D81-1CED-11EF-A40F-5A791E92BC44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2476 3000 iexplore.exe 28 PID 3000 wrote to memory of 2476 3000 iexplore.exe 28 PID 3000 wrote to memory of 2476 3000 iexplore.exe 28 PID 3000 wrote to memory of 2476 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cd97f99539badbb71644f12ba3037b2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD59ca3d7fcc8f8797862b461bdf925572e
SHA194d4c3b1b99761d66db00a3ed81a601c7b86fcb3
SHA256c8d3e8fafcc1162b81f183a53d1c8d70fcec330072fd64c12271e4c738cafd93
SHA5120e5290f912e3b112daa779029e165e8cd0d4955a34faf9381160801a5acde7a19accbafd530287eabe4f8bc35d5e41daddc384b00ec6d768c3efb2492ea961b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e60214381d5f4fe2ccc595a60851a13
SHA1262db0c5fcde15afbcdd9e12f6103246f5a1de81
SHA256ace5759b835aeff50fd00c8244c06fe1029bbf9e64122d8142d97a8d94b2b99c
SHA5124085087cb083ffd2ecc1703b17d78d5e6afb2769c613f9a5be5c19e9e140584dc7b4b6d737fe7c1972c2000f44fb15a62552df5695d474d148e35616d352b184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eac994b64a44d82e1bf049490ab79b8
SHA143c371c404d1f844d2962ad51bbc44364f64b1c8
SHA256dddc843774042d95f40c95b96890f1782647648f3121bb40223ce2de6a4d6d63
SHA51206e40dbf016aaed488cb3cfd64f6999b7e9231e0e800f258335d77dcaa596a30df34fec95e42f970045925b8e829ca86df6da4dc89005809de55d19512585ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51230de2e7a5fd30b3108f219b59f3ec8
SHA1e25d81ea935ac6bcdbf4c1f75416c7acfa46b67a
SHA256e249080f6d0dfca2bac020fbf780e3f3c989a1ec5433dbad0a666e77029db571
SHA5120afc31549c57fde79fe3bbc399d8f1b3caa9217c001b928ba760412d9bb8e19e298674953768ba320ee4f37b67eb820d5560e9e11a6018afca27b517ba38dd72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ef67a0537f69ec94e2ec84aee4577b7
SHA17c512fdea724524da8423bc39461f5c43fff4c6a
SHA256e2d952d86504f9b78f660ea02c96787a6acf81f98aa4db64de846b923ab868d8
SHA512aaf940f98f363ab1fbb6cf94a1310e69c8bc69984bd899f0935818313c6a2bce0e71c526da3493fa5e176a6ea918a3bb9aa9b8dcf44aee3456fc6d5d1b898532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590d71cff84164eaa2929b29ee169c454
SHA1a856ca8d86efabe1ae02b9ba61b005d2f5172c10
SHA256f654d1593a61bce44660f835dfca863d962fc90aa7c9da2a47dc697268d7ad78
SHA512e5d7a5400845d57e10a30dcdc47d76fff000b2af4b0a9195f9a2880af35c4cbbfc6afe5cbe66718e9d644cfb738f9e4bafee29df36ad38f84ad4c7433fbaf376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c48a864ea49755885e156ac09be94a8a
SHA16797aa608864c9d48ba57ee3f9cc012ce42410cc
SHA256fa2e806c639ade70b747621d0118250774637b7a30a5ba8156f10077bfe0741b
SHA512cd6d49e6247456983a36fd4a09c6f8bddf22694ccfcdce9f76cc8751182dc22be6ed57a77d67e3b4a3d4ccd2601f4c8daac1bba45ef45a8b58b5f27be1d0c88a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d9164efe56418b3c5375b88abb52a1b
SHA15f8bd7f33dbd2a465d52b0d78bbbd845b9f3e3f6
SHA256fc66fd7460b95a5b4b4d516d4b9c45b6c82f01839fd26a1a2883f82059435783
SHA51237adc3b297fb4ea9899705589d7f4be8ea19386e6ef7303c16665a0ead5001068ba9d71e04cd2e9d084b87eeba259cd6e4a2b69b442d80eb02869c49316adb50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a7f410f88156100e090d6ad6fd5ee7c
SHA15adec2c9c956de8fd7cb859ba172cb88b2dcfc2b
SHA2563e90f39088ac4e435e6bed7cc69a0f5c3e3a4c5f7bcad8fa65ea6fb3778b8f6d
SHA5121f7e284df27e470e8fee4fdf262ebdc378814a59fbb5576e455e9d93fc490fa6de3330bf5f92e6b809ad1cd96c4221b596be80e18d4458189374ac6bbdb8e5a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfc27c16ec53f33fffa8696aa305e479
SHA1003552ab61d14263de6cdb8182ca09ed7ea4c447
SHA2563b1096dbf08b0ab99f3e2db406bd5fe0702ec36748d4fc1763f81d5a83c455f9
SHA51253ee6f0057e71951f1d16f7237ee7c46b8e61c38797d00513410cd6fcf7eccfec7a33b7aae41741680d5ee544ed329257ba2f543fd03a4e62dabef3565e03fd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0a528b240b2e5d612385dae71d992e0
SHA13b9dcef71b86fdbc6ca38472fb5da2d1fe80243c
SHA2560733caa28efa62cb05b1b083fe2606d2557bce582afe15bfd36091dcc0aea517
SHA5123be8393898b97909c96829756fec52d0fc17b01f8b1d55f21d4a30d44ff8e7ad5c4aa0004b2a69962fb9cabfd5c56c486cc15bf9fb4f03178909058a2d8dbe8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52acf32da94ae4e968d27d8b629225741
SHA18f3fba98ae8a97c549a22ff9a8d2fb70b9c16a23
SHA256f402a6cd6631382d72afc8228387d188107c7a9850877c042212f79fbb2d61a7
SHA512a0d3de73e50d77a7bedda399c668b605bf700652eeace3bff79cf58b4f2d026dfb4f46ec80ef50d48c65f3cb0be90604434ddfe2d55f32bb1777bec9d64ffb25
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a