Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
8137c050fd61b2eaf82628af50456dab_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8137c050fd61b2eaf82628af50456dab_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8137c050fd61b2eaf82628af50456dab_JaffaCakes118.html
-
Size
27KB
-
MD5
8137c050fd61b2eaf82628af50456dab
-
SHA1
9330434dbed68c06e4f2fd37f4247eb12df43f36
-
SHA256
17347ffd90ce5419e03c3938b7cde924ef82e363de5ee403c75cdaddbe980cc7
-
SHA512
bae8770df0829616204aaa8bb1e941873ee1f47d455b962e221fb3d2f85f6f8e72b1070c61ced0c26c3fe269eef759ee6eacb6d79b69ebf95627229b7f81774d
-
SSDEEP
192:NmOoKqvb5nlnQjLntQ/vnQievnZnQOkrntd+nQTbn6nQ4MCHAfpdE7wuMOAQWMlI:8OoxUQ//05Y4g
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423158921" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CB28B31-1DD1-11EF-9511-66DD11CD6629} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1152 iexplore.exe 1152 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2252 1152 iexplore.exe 28 PID 1152 wrote to memory of 2252 1152 iexplore.exe 28 PID 1152 wrote to memory of 2252 1152 iexplore.exe 28 PID 1152 wrote to memory of 2252 1152 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8137c050fd61b2eaf82628af50456dab_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7c5bc7b080d55604414728bb05fde87
SHA1091ea599d991d9389d1defd3da47debbadbd803b
SHA256c09dd91d03508aaa82fb941f5ecf5021d6ace2021223792e036257eee116c4f7
SHA51243f2460c8a8e0e280627bc225e58d387f36bde2fd82a0bd78cde0cfa6bc082f3b32e4f4d4d19a89f53971abaa033c6e231544913d2547b265628d0b440b16d99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8ea5eb5f1b5a7cb1a1132a40e56c548
SHA190ff180a182cb3f83e332f53e06835a12dda3e97
SHA2563407a593f8c9501eaab5e7cda516b54f796fd0988b3b5e7e895c083976943a06
SHA512250443adadaf2cd277dddeb2fdfa862a4ab3c895f741da1622473c4320fcf2ec43e6ad4ba03c202ee4e9ab943fd6181180ce022ab00a2333ee1bc4352abe3e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529fb9b10dc86462fd123fc2c7f64e684
SHA1b4a18524acb95dfd3d2af3c53c6532a24cb8ee0d
SHA2566304a9c2bb315d1ce9df6469b97b700896643ef8db53f8f981470479fedc58e9
SHA5120f96e5073caa12c911ee7b7256c5b04063916690801f7621df4b31ce805ba06dc3685d570de1e79b8a299790d888546d59d836ba8d612796ea8b633f3a953482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7bed8de291331f11b80d1dc5e3b0fa5
SHA1450993dda6d6b8c73e6b54f55ba888a1ea772295
SHA25672b4eaa17fe6f40e16ebfa9dc0272bf7c622957bba1bec7f954536c77465e782
SHA51213237b2d3035414b521965e83cd9733e0712f5b2e61dfcd0570ab0ea0b21818e992e3295a719bae47a728a7a3ec888ff4ce534d8f3cab71a6263bc47c978dee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5273e107ca484d05c29e1c7658f764be1
SHA19ec8a2076cfb1882c522c2fe11c14a3e28908749
SHA256d38876b035bf264cdd72a087618205a54b1662250f3f0fe525db86ba0935fcf4
SHA512245ff0046657cc30fcbbdf82af00162203e69185ce4b7ee2afdb27901515405a832392001fdefae5b4ed47469d3d82106dbbe37c37b0bacf0ed58c84990ae02b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517a51062b17b05715377358e1ed4f732
SHA1181dda84b048720f2a0e62ea76777f373b36c1ea
SHA256e7c706124ef5afdc73854c4cb7e88e3acfab8cfe5476fe92887c2ba065fcb779
SHA512321109546ca86c2888ad24607c694bd42041069765e640c77e100aa954c21e814e132a9adf00faa2cc944b8b875e7109e2acd9de4d00b928d7e95781a1744a79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfd8a889ab1be88de303de9e428d1979
SHA167c652ffe641f6d06bdbc6c311216c6b82538eba
SHA256e805a88a6b09df00bcf62785abd8cddb81e04a1e580bb6d14f208dca4ef88488
SHA5125ad4481f3cb855cf0d034c1b0cdcdb262c969c9a919ca3dd35813ae8e3431da4ded6d0b06f9ac187d47cb96fb696d0f0b7aad4819dbaeb40a92e294b2679c488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5225d0fb4cbf1a75729dfee772ff65b9e
SHA103329c022833d7674d522fee925163a4e03401b3
SHA25615b6f90c32b981b1e622970688f21d27439e5759deb7e1b025ea2c50668612d7
SHA51298c57ef48be4a7ffd1f10a85018f4b681dac7f3c453f7e6594529cb8bf8b2c81fd69b18dd590c0b5666498b24a8a4ddfc16e5592c881507def291b4630ab43d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ec68985c0a34ed6d48c3bf33bf853a1
SHA1c970f8ea6c718d5c03bcfabcf5fa75074bed1468
SHA2561f13bc30909af1b8cf1dc27575c2511393cf38d5928b560af66e500135b06c2f
SHA512dce78ae11c4538a42ef6d898ed1a8a60611fb3190e47d96f5f06f6ac3418a426ff1bc8fea0a4660d94f50e178477b6c3b1858c88e86a259a91b76eea9b99b011
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b