Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
7ccf05659a3d553127adea3582157b04_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ccf05659a3d553127adea3582157b04_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7ccf05659a3d553127adea3582157b04_JaffaCakes118.html
-
Size
24KB
-
MD5
7ccf05659a3d553127adea3582157b04
-
SHA1
65b316eb2e5aa5c70ed1941419cf44395277ac3d
-
SHA256
f4dfc112d5c86e35411f0517fc35f880dbb1a86cf25574797a02687bb37d1654
-
SHA512
9780b6e5eb8cac97ba4db7c869b063e1148a8a5ccc56a14ff822284aec488fa85e75181a7b42a3d82ed23cc72ede8919514d8541a684fd5a1aefdf02858fc645
-
SSDEEP
192:uwjRb5n3inQjxn5Q/mnQieNNnSnQOkEntycnQTbnNnQgGLnLnQt9qMBtqnYnQ7tx:DQ/7GCb0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{151481C1-1CE6-11EF-8178-52C7B7C5B073} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423057867" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2784 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2784 iexplore.exe 2784 iexplore.exe 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2652 2784 iexplore.exe 28 PID 2784 wrote to memory of 2652 2784 iexplore.exe 28 PID 2784 wrote to memory of 2652 2784 iexplore.exe 28 PID 2784 wrote to memory of 2652 2784 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ccf05659a3d553127adea3582157b04_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b26eefa1db018a879685ca7a68f16e
SHA10644d156295d9eee164a239343dd6cfacc39bb3a
SHA256d2328cd9d162333870337b497363f78bd646aee27fcd2655192215449f8d8d58
SHA512b2fbe0ce8e1d311214b9f0c6fe9b936af9223945b908b7c650faaf087558b579f08ac05e486e9fdd2b0045319a098f32b8908ca7388ca920a25ceaf465a94bc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f8ad3b3da5f1a3472cdd8950bbfcd56
SHA137d2fd94c8a565952d03a7d84b9b2e3ce1ba0048
SHA2563ac9d3a65f12b8653c8ebb6ee936b3c7f0cb6fe4c731fcfb3925e606f7745e81
SHA5121ed23c60ba4365ee22d10adfaaaa8e2853cda3f126cd2d9298cb3fe6455f1164e294a767a9374b3cf9eb3a4b97cd7c1ebf4270347b35d3a9631e64369366cbfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fae6f2b8f67546f2f3a7d28ab55dcf8
SHA1f11c442871c5aab0060092e600b33d2a34c4ec88
SHA256954fa92d5fd9f2773869bce1433850f3160c93c43ea0009ce9a4fff37f3bf212
SHA5120ffc4c17ee0707e351a5d32b9eb6d5b63e34b3f58bd7d03f4d3eecb7dffaffb4feaaf1d9f013bae59b0862edcfc97fd2c34124c12a68882d439f430fbd3c948d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5434cf77de61509d137e160c9ca5ce798
SHA175275c75eead5ed4ea555ede8058cca7f2764df4
SHA25658cc6d18bbc1381788770baafe7b8fc6dc011eb23afaf71132421ad36e73db8a
SHA5127f5eda530167d8f402755a53bd9cc08c4a726a3b519144fa725da4d8fb07bf886139ead783f1a97c207c3c22732c6617cf2c9a7c67b3206ca72f786d38007b53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555ab63331801915f1c0b1377dae6ebe9
SHA1771a1bc2577d1d030e35f546e4e9ff6f049c0385
SHA25675519baa4ee3557af171aa9e5e08b57127d3fba45eb3b57dcfad2a3cf60e130f
SHA512c6c56de532cc3fef6d24769322fc9a1c97a855abd6fa5978aab300cd0df45fed13113102daa2a8b42b72f384a1995ee4898660ec4c40826349d4a3eb18d04af3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e1ab9a1a7174711a77137da1d6260b
SHA1e25e7fa2ab412feaf15749475473af00a4f28d4c
SHA256075726e40cdc042e6a6f85324ccaecd1a4224546db589bdfdd4f1a9e76a1e294
SHA512483686b8b8b8267ca950d57928be03136b79721c8ac005409e0c6691cac6d677947bc127721faec217e765054287b5d448f10ba74dbedde61d0fc98ad022452d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501ace9e2488c4114eed9476117d37328
SHA1ae2a5a45f6d14c9634c43d36d7f1b88a06e7ffe6
SHA256a7afd1375f5c89a8a00e033a5211618cdf9b89635ba95b44d4876be0a98e3b54
SHA512c222eecc7811a4735d9a72753297a0a9efe7c9211f381a4e470a1fc90ae0ce0ada12d3f47301c9f843e4780d7bafebd710b89155ae2b8f7f9a911b624d824e7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50233dc1aabb88b25aecb289aec324a11
SHA17ab2ea7684478275f874b4bca7ff2caeb4590ccb
SHA256e1e5c9c87e6e25737f2af445d8f3aecfa877b0018469c8cdfab4785563d72671
SHA51289b3d42e83f9ee6aab24423d55b7d821e23e4fb0a519de19d57f93fcd1e4d88612bc2575d3b18950e0d784608144f6f87df83a068d85d806cf7582f6b947385a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575747671a8726dd026dd7002365c9ca4
SHA1859e403c0dca471f209d14292218eeb4e61e7c81
SHA256b2d0394078ce11997d08cea6bda735495f884bb5e304bf73e32c3763c641fd42
SHA51252fa0fc3f52ac9e83b5792e0e775d994cb07ef36bf907bc17c50419bdff5436059c81eddb7f964fb0b7022f053739645600297649d2e39666010b96042c566f6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a