Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 04:17
Static task
static1
Behavioral task
behavioral1
Sample
83011971a3370fe470dd68d9b380da9c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
83011971a3370fe470dd68d9b380da9c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
83011971a3370fe470dd68d9b380da9c_JaffaCakes118.html
-
Size
40KB
-
MD5
83011971a3370fe470dd68d9b380da9c
-
SHA1
79a4feef029b2e153fe83ff9370dc610126a6f79
-
SHA256
931d8f9c3d77f2990dcaebded4540107b86ff3a1ac62ffd748aba3c279b58b32
-
SHA512
9bedcdc7e0a7b22480ccb90eb27a8fc4e000ec5dba209c092fa9f9b41a31ec05115ab18538a2817342b73d9c7de3650705a47897b7ee088fea4cf0f09fbf2c59
-
SSDEEP
384:/Q/C/xkn+rhZ1K/qCQvisdv9WF3FZdEdPCJiBclxprAkxo:OQvzdvq2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423204537" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{933B0871-1E3B-11EF-87C3-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2512 iexplore.exe 2512 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1680 2512 iexplore.exe 28 PID 2512 wrote to memory of 1680 2512 iexplore.exe 28 PID 2512 wrote to memory of 1680 2512 iexplore.exe 28 PID 2512 wrote to memory of 1680 2512 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83011971a3370fe470dd68d9b380da9c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f568457344d641ca2785c7e4d1f36498
SHA12ded7ae9e0a46775bbfcb90e6966d62d00ea8448
SHA256bfdd1dcc31fe4de197d9c6aa94470e22a39f834011eb6bd9fc1d5644210ca2c3
SHA51258a469d3c194324f9d823b1eaa73a31868c5b86190a517d061b34e6861a9e8d1bd7afae0bc179789a31baca289b801ef81140316091afd7f44702c8ae19953cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5235e8202b4cd71b4e769106f5aa39962
SHA15583c3b0e83d33c28870a89e14826bba3020c2a5
SHA256e1c83e5ce44cf25c896742318359b21e2efcd76258c27ed5b05e29ee0e48f5e5
SHA5123b01b7f0558cc841e1eb43e061c5cb3824b63046caf997eadf730a5f2364b2178ea945b9bd4aa456ebff2eacdab4c5a4140ec7f74fb290046bc4a14701f0c903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50142f036f34f1135e38fc98f43478319
SHA1ebe9e243cc7dcbd8e492d1b3d46241fd87fa2f73
SHA256894e08b66192775ee402716a6e8d0bf03efd98316125aed7b1cf2c035ebd45d2
SHA5124def0baa324204460ba8bc0ad6d3c595c2a122713e0829608bf389540821999ac24d201664b2ecccaa54c7307ffa41c5367b3c6cb8f46f82c91583e38b3728df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa0e232e96936f3b732f32be5a1384f5
SHA1da24a2809ca2f1a5b321f9899e05a7d00f11b255
SHA256b0a6c4715a6196633045614664009d2fe655b817d37ab84d8f5ef2ff0be2fcde
SHA512c5e029ed72dc9016026d4c107ddc6f3e4af105372a0cccebb2fe26b9fb03ae54721f2447aced88ceac7b06561775931f9a0713953d5f7b747adf3aafd8a33a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3dacb8bd60123bb4bb575d1e89ef650
SHA169b1b6d6e594559a6b9a260f400bc72e8e163001
SHA25614ae8fa3aeb2c99ef3fc1e034ff497168d6f139fa4344b5050a7f608338f7ffb
SHA512e09be2a5f6e317cd7075d8b527be086a69fef13112ef0f7140b60e2fb233ac5740c2908376ea353c8c9dd1e684f736ba24c5468d4e9d2ad82d0eb3f383933a32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4b6994248197e74bbfbdcb1112fe2fa
SHA1e89fa87200a7add428394ee0358f3174f0ef5ce5
SHA256d2cf0698b2d8ce8b54847970d1dcdf8bb64c72bee9502a469e3e76ce5280f560
SHA512d4febe8fd576024ace9c0b50a17e504da9ae554fecdc1689290f028ad48e6bd5ba1dc243641fc5744e7e6d5829594d9e14292ac0d3b619418e0ddf08d208f5bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6c2270bb5e7f11ff304989f9fa38478
SHA19d9efb249f94f25ec6ce6c4e735e2cc8cebb9bdb
SHA2567655a9ecf8edce67c331070301dc069d817ee8c53adf51123b12dc71179398cb
SHA512856b37b24e2594a03f1610e7e8603a4741e113185ce416ca93f57f79b15fd96caf817bd650ade1a920d7fdb076412e86ef1a15f183954d053feb8d14e169b7f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc21cbcfae003e0042009583a2c7a0e7
SHA1ff516489a3665181dabe91e44abb488e1a68417e
SHA2569992a7550bccc6889bfa99a0eb0f9b247f3f18111d5495b5e115aa75bfeb66e9
SHA512058746806f157f9355d4c9e9080f5c7c7573ef4e4b8bf463d172cc35a0261ce8d07e368c3f7cab523f415dc741300c96257a092a34ec3154253d65bddf4d9c64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c8e7dbb4f3d1be930a44ac3975a8882
SHA14f515dd1d3f161b6a64df61fa3ab330405a94fad
SHA256c8e64067a357a00d4511442ec825ea3205887fb201c12aa2cc582280b41e4b4c
SHA512ba7175f095556ec272702a913d439c4bd5b1882af9d5295c7949acda805a734f4eb05bcd88a9b02e145597fa724bf407f0839449d9aed56653c6edccc2d70b83
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b