Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 07:15
Static task
static1
Behavioral task
behavioral1
Sample
86462259336b2ea766c23bb629afc1a0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
86462259336b2ea766c23bb629afc1a0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
86462259336b2ea766c23bb629afc1a0_JaffaCakes118.html
-
Size
22KB
-
MD5
86462259336b2ea766c23bb629afc1a0
-
SHA1
6ec889c4c1fd5c64cff839e4806810bb73820da6
-
SHA256
7d91f1b39ce048fd8da1407c031acf6996531ee7aaf18acaef75facb0aef490a
-
SHA512
4d28ae8880c3ce2ea440b4b359ec5f64c8817178af5d1edc3072cd6236e6d30189b2476ec5607d30ae3d2e8622a737ca074f3d396f4a0c45f575c8e7642d1e33
-
SSDEEP
192:uWn2b5n0mnQjxn5Q/8nQieXNn2lenQOkEntcinQTbnRnQnCnQtvwMB3qnYnQ7tn+:ZQ/glYM4
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423301575" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82699971-1F1D-11EF-9F86-7EEA931DE775} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 3068 2168 iexplore.exe 28 PID 2168 wrote to memory of 3068 2168 iexplore.exe 28 PID 2168 wrote to memory of 3068 2168 iexplore.exe 28 PID 2168 wrote to memory of 3068 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86462259336b2ea766c23bb629afc1a0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eb85d46cb66baf0a57408ca51ab7416
SHA1897457712f5a601c3021181338259e984ca12d72
SHA2568c8acd685367c58642b6273acbd8a301d373f9ed37927797c8745f9c1dd3d261
SHA5127d751a241e6f43156946bb7fefa7aa4220eaebb224d12ffae779da45bc70d718c61ef0f554710d57ec576850ba801270d3cbbcf4924ca24567133c982407aa72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53edd2c27434113f013853a3f09cb111c
SHA1cfce0c7d847dbcd13c330f2cfe0c03ae4a5389f4
SHA256c6362eb5b2b76898cb34f677acccc3510cdb246693586dccab7f1a4200dc2710
SHA51225bc3a2fb87d8bd262e5bd46ddc80eb7f82ba86ad6972f07d4727ed4a76aeae310182f752c6f73ef78d82960952bf05b111f79aed3e43191cef7522415680795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e4de4b7b477ec843c90667985c45ba4
SHA1825d989382256fae2717d8ce613a23cca4837fa1
SHA256973c9104fc2763e575cee5621acfb77136db81a8cc3a3ece1db25dc1a0af0e18
SHA512981a089bed97301e88ea69d209b7b7d7f380225ffd0a40324e9349f1779abde1032825e077f84fd75c34aa2c6206f1a567ea930128240b30a909cd533028b840
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1edc71fb4644c7d015183d3a56e0bda
SHA1f73c63726eb0449b90603ce4cf8e48fa4412ce74
SHA25657b6af9996cc7cdac9f21c6850553d3553eca4d204fbe61d0be3f777ddafdeed
SHA512d6172b80c5b45d6590e820974344e3509ea5542592ed164289101934754ad35f925e17c759734e8c13c5ffc1c7f9f6e3bda6a465179ec740478b20a8454cc618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc2156b242f56911c6ef5b6bf9b6e4c1
SHA175ea638160b5400e9e5e546de5851ce9a35de816
SHA2566811f82a30a246719990e7ad63c987980bb7dfa94624706a839c91282aea60c6
SHA512a9a6a53f78f23f3a6f986415c33824510f74687199351baad769ebe8e587813ead363e55ede6efdf6c0fe3c9e4d27fa7b77d3254442d2a1bf5fed5340db1c658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b790ace433c91d7e28bf30c4372750c
SHA18a894c0e4c899d7ffdd38e85ffbc35d578fef9c6
SHA2565bf8ae001e0673eaf5c4560f5c9ec35031ba933e834edb174567cec78c5270ea
SHA51296e21584677780a6a2f0a0aab7e2c90ef787dc1f1cd997a676674f9e9aafa3ea35163fe5d8dc0dfab00b2f0d47481cfb9dd287f59772970e797ecab1fb43504a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5821f11078a8973b43ef062e0759474
SHA1fcd1c3c0122c7eee70f25eb615cc16732fe97b86
SHA256dd8126f1ef94b961c1aa8269fb2ec1da221e803da8f45ea6a963e0a900efd88c
SHA5120f9450a1c5ae278619284e42ba7a54effa7801db7f48e0f26cce6add73d7b8da74875a4dd9d4f62e21169514e3259987054554404ac3fad7a66105d0528a365c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ea2c36127c2d28cc0174fec3038ee0d
SHA1cae0da85f8c95a63af4649b54262bea3a9e95ca7
SHA2562d31ac26fe5f6234c75c07c77cadb75de12d2bde5fa636b064182dd1ccb08547
SHA51286cecc18c1cf6de80cb82f85bc36de3b6dabdcb2e3036ab7a375e345a7937cc1952ac5e0bc96a2acb2c25853c1ec87ed99fa73700b0372469c22bdef82013fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b16a5c1339c01df5cb7f65a743bd758
SHA169300e76e1d9e7735c1dc7310b539539c54a6c32
SHA25671d3f0acad2adaaaa56b113eb2757275a9f5036c33f8df82d4d670068e639686
SHA51273dea027946933eddf1c5588c735a12aa68699b388aa26d9efd7b7eb0d692d2fe035511500571d461b46581d92268a5460d2e0169c51e491b96c16ac9d82ab87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586e285000b257a34d33be100a6e0fb79
SHA1653d880a5f65310dcb0ba1f09ca26a7f0580a54e
SHA2561cf7554eb0bf4fc9614c3b0007c57ecda3703f0795f609466aa6c011e28a0e1b
SHA5129d7e3eb80ea75af2dd169710e9b314a0e9d67925dd6f1f36aeca77b44915a0421a708cb08d904507b67e37bbe7a222c9406e8134e366be70c578f159ca266ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553f0ae88d8a7f65816af87ae6262ac19
SHA16da6dd153c7e44b404513887b4f391d47bc457c6
SHA256e70af0e378a4c806a9960220fb549aea74eb209cba1c70ea2b17b48ac17c766d
SHA512697add7fe4aed9ccfa054156ebddcfddab98726282c568f0c03aef06f29d9bdb79772e14576fb40b0e9972574915b84de960e9e65f71f532414f070ccbe3345e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b