Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
825d375db8a4dab1496a29c12787079c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
825d375db8a4dab1496a29c12787079c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
825d375db8a4dab1496a29c12787079c_JaffaCakes118.html
-
Size
27KB
-
MD5
825d375db8a4dab1496a29c12787079c
-
SHA1
87182e4ae1eb4e36b0713911f7d53adbb4a79f73
-
SHA256
6729fc4af912260a41ec8db14b50a5327e62e86cb719fba7cb9ff6ccee3978e8
-
SHA512
26c3a4a640d40705dc0dc98318461d047d23f865efbecd8155773649b72fc1be26e90138cb38b863b2c00357a9d10798548bb110f3cc189d7bee79fbc379ba66
-
SSDEEP
192:uwXQb5nFvenQjxn5Q/MnQiePNn292nQOkEntcinQTbnc8nQ9ejPm60f9nQl7MBvX:qPQ/Q9mHyxE9WSJagP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423187745" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A69B571-1E14-11EF-B804-569FD5A164C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1728 2844 iexplore.exe 28 PID 2844 wrote to memory of 1728 2844 iexplore.exe 28 PID 2844 wrote to memory of 1728 2844 iexplore.exe 28 PID 2844 wrote to memory of 1728 2844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\825d375db8a4dab1496a29c12787079c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f9891e09b03d4c222bfd9b2ce194abe
SHA1cb60d2b612809ca1503aba2df28f502ba433d691
SHA2566f9d044599be804bf21a30b96186a201bee229cde5556ecb88f3267d260b4a37
SHA51215afbdb4d3cdb52d28656122363e731a9ddc1028a143013158151729346492b1dd2735b17b48b66e93a65976f45834470a87a528fc9d22c18fcbd253b81d39f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574c4fab05b289b16f7efe1c0487e1a15
SHA16e0f61b6c83807f04511da530864c8908a2d7969
SHA256080dfb18fdd4c330100b2279839cbc8bfdad5537c20f4fe4e7d9cd1a04cd465d
SHA512d1ef3af8e1c5ac4279a950e57ee8aea05c3f65f115277101b13b2b4d7f46122bd09c2f0ccf0d7647c7becc7331ec0d4bfddd60ecbdc8d4e7211862967c8b5e14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5412f0f7e866877fd9d386fc71bbfa367
SHA129f179f602481f0f6551150eecbc7b4b4ea0dd78
SHA2563d7b02b9f5e1fb4e754e94080dda033f6d3300264f5f8014d8fbb773b1971c75
SHA5120a1393d745c31e1521f59f018246e3a2253d1da5d5c4013b535b1853663f3d49afd4a92afeae691280643a4325663d8a426ef51698acb6a9904fc72bad85875e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d059b8c474cb4db0def0a3cc41c492c3
SHA1e6a6cdcc55ff663d8a98b0a4fb121e0c72513f02
SHA25624ec9ad79a52bd1a2f706c43cb2475e19e9c3d4f3639873a6646f1cdcfe652a4
SHA512cf4a3fb4f9239fcfff89af2da82c35f5a81803f9333a1c7224d952634a0cedf15db54af441a41bcd2f4cc011dc54fb6db070113c42b20ddf1e6e8ca698f02193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9768400e2b81ceca80252f11f63fac6
SHA1d56bb1025d5876d8b7b03452c5cee88dd8700405
SHA2561a220b04a0ad522f91e8cac686326414dfbd9aec6c09353666dd79d941727739
SHA5123099c64bfc966d1023d87d3abb12277f92e3efa51dc81e55edc25dfd5fd78f26266e1cbe9380f94147eb4cef545831dd72c25eec92bc35d6132ef9b505891298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c2934d10f761712252ab7beb0077529
SHA191cbc1a9d1ad90f0cf8e439575ecdc5623bef552
SHA256f21f46136062065504671bb6aa7cc9195ba52c1ca2810304f14fea4e3f8b5bd6
SHA51243cbc56fc32263d978a4c4adae922cc2236e67c9d69a497f7762dadb7d66805427cab6208bdd6bd40a11abee70f8194faad330c2b64579e1de5700cf72cbdf1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5639adc6736a4565a7f57df19ffa10209
SHA1bc5dc711b4615df3dba5c37a6fbd9db7f4c0cc67
SHA2562811fda4da7d4d49fbfa4984064d705b0d4947e15b4b3b5374d16525d49e585e
SHA5122f3ca4b82a18134fff7593f68f292038deba01f6b9342ae3c0c77769eca560a18988cdf2e7fa535af54e78b49082bd1f0a8307f7e682005067335c49b5ecb71c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d30af0e0ca6c20e20f4b4cd18fb1df3
SHA19a8708d5b4c284de72db8139500f9a096ad3ed02
SHA256f7e47140fd811e26b0524e8e45d4980441a5c4f7bf57b67a8d31dcefc7aaa47e
SHA512f137a89f36f2899a1d41f0eb122097077f57849abb9a57951a13a39b414455da4f05f12c05fe5c6e82de055861981eceafad1a4d1e1d5c662d0d614c10063eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55046ab5897655c1c6193845eaa71609d
SHA1a7cc0c5b729efbc60eb67263dd6e1e5846087ed7
SHA256004bbf06f151567139f249b8d84c22f222fc8eab4d4a7b7053aeb19d56da356d
SHA5125beff9bc02996d28d7cf85eec4b3ce7887585cb9a7aff0e4f7c69dc150736308e2bc2e73c66bad18e9c2db3bfdbd37d6d1ca9f12d1bb0bde0e1dea7233478759
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b