Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 07:32
Static task
static1
Behavioral task
behavioral1
Sample
864aab3f47ca00c7fdde9e447fe6d5c7_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
864aab3f47ca00c7fdde9e447fe6d5c7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
864aab3f47ca00c7fdde9e447fe6d5c7_JaffaCakes118.html
-
Size
20KB
-
MD5
864aab3f47ca00c7fdde9e447fe6d5c7
-
SHA1
1bb7014cc4762c3e518629e25e74d284845162f7
-
SHA256
ce411ed117b243eb1f90ef59321267e3f4599e1a4c7258c623867e4d85629ac0
-
SHA512
f22041426d4d00d03f8367715df3e666edce356ef8f1a39fa19ac5137be23c4191bf366c3e9797452122abbe8c412756ceea08c91b06b83ffdb750764cc32b15
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI04kzUnjBhMW82qDB8:SIMd0I5nO9H9svMVxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423302603" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E714E441-1F1F-11EF-B9A1-EE87AAC3DDB6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 624 iexplore.exe 624 iexplore.exe 940 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 624 wrote to memory of 940 624 iexplore.exe 28 PID 624 wrote to memory of 940 624 iexplore.exe 28 PID 624 wrote to memory of 940 624 iexplore.exe 28 PID 624 wrote to memory of 940 624 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\864aab3f47ca00c7fdde9e447fe6d5c7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD579f4d4388d715714fdae779903575fc1
SHA1ed8908c8785987eff684bcdfa20c2b0b89abb4c3
SHA256eef6a0b3f1079e717e9fdd89c2af2909e102a9a67c6c1add9232ad63c8b180f2
SHA5124687dafabe343f6f7f9df9b6b7ce19d6a7f7f1a710fa7de9e9779a5ca3b546ab90dc7202842df8fde45163dc6265eb4b241228c0a92fa938baf94a1af11761a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eb027222a1cf3e3fe5b8b94cdb1adf4
SHA187f85c27c2ac56fa13b4965a87d0266e5fdb0dfe
SHA256fc92ecd54945e19c9002e2dc31f46ee48a351dfb34d60b04d9fe357639acfb62
SHA512a71852d68fa26887b55704b5bc67aeca6c1152b96397fb9487a8354e7bdce5429a0dc007ac247ad051f4a52e661d62ff4cf492787bc83a61ce4146714acb878e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0c62524f458d18e27669c48c8659343
SHA16f7856db4c1c672907604808bca5afae8c04d298
SHA2564fbd90cf2481a49fb4fdb12cb319a5c18a0735768790ea1e6f21692ba5aaa07f
SHA5123c9af5e1e6331b788aec4a9512f66f07a185c024003bdfe9ba34cfb64197903ddea18cdad0867067ea870a705d6a1a746a654098eab4da9ce018d851cc83b85f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a3f87018cc2c9c833dc7c4880b016f6
SHA17931b3553d5743c8c9568001ce3ef0b8fcd7ed13
SHA25681d05e13a0af0c03750279a6fd5973c5edbbcccffe596af2549dc553e39f5a27
SHA51256aba9473e4ccaa3b8aded020871bd072ef273ea92d43f3d9063be959db9f056b76f6dcd39a48c7fb6eca71941f0e20dea5b5aa9580aefa86122abdfa104d126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4f5a9048a161e852d014bf85a7353f0
SHA1754ec080eeb2020e32fd3c9b88bd1c1f20086a7d
SHA256744fce5ea240fa27a0a7e61714fc87c748fb6bfb85f045874bb00ef04b07ed6c
SHA512f9bc377fa60f5a5e76211cd780695aae22cd4d2db17af7befa08b81c24eb4df44f6003acb2f495e0e10cf014fed0ef916448f37f3084a91383d1d6107ff481f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dbeec1602073dccc293d86da00d4778
SHA10f78dc83a0c1e2e961c7ca545f2ff2f97140e7e1
SHA25658186ef7c4040b3b4fb398a31f83c425e34729a14329afb2d5c0656b3fb2a755
SHA512be1864b15c1afbb2b3ac329e51ccf6b941d7fae1a9709316f90eba2b577e18cb7a67c6097a1c48ee484983f85b1e13f1e374edeed8464171662bd3c552aa01be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d85d8669055ecd362c6e370b9c60eb81
SHA19b749097a5e3fd28d0eae5bdec3b0f36cde46e20
SHA256f03f3ca7aea75b35d37b94a0a25e5391116cfa382e22c5f7cab23d0f42f93c0b
SHA512f37b84d0685aeee4968cd04d2b6d388b0d419b3036361a4f1ff78deeaf2899eb29e88bf1fa0b4d4328dc090519deb389bd1a79d8f6dfade0743410441e7e1b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55338b5a9700efb57fd19426e9e13c4c7
SHA196eaea74a6a914fb1efe85312450419611d69bef
SHA2567f440917ebfff2ceee8bf17692b6a076da3d2ab4a5cc0eb291edae67073dd48d
SHA5120085b8f22389a0f4847f4d62b2875d1b4961c3a283d9f64c24aed0311b140bf1c36ab9352a3cbd49f27bb92397e62a16ea8ec3cd28da83e1ed56e2b711ebda34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c74710c05c17d9ab7a71d2c755b3e48e
SHA18eb7462a8c15ae4a0fb34f5448573d9a0440e8bb
SHA256f5d1294c8d33868cf478349b0c92423c68a2840f7cfa9f3e2f9da28bef2eff96
SHA5123f357617b0b3cfb28188f56fef48c3f4a64286df7bf88b63d97d492191f449ac422a2fc727bf1f74ef97ed3c185ea2950ff5eaaa1683f6abaadfbdc19f5eeab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e62272132eb46437410c890aca81de6
SHA1522fe57974e350845578aa01a0c8a303a7e6129e
SHA256032c50b34e75a2f5988569f6bd5c87e69b27b7d3c13b952ffcb8be7403df928d
SHA512e25a24ef1cad54e309c9770b2350d199972fd71d1b74541e2abf2aed17ce26d826680b28fe252273c197a40ef4baec584af113177875097880fd19a2234669f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58995bd0de4c3ee5f225fc9bf34931792
SHA14a7de24c363b5ccc77f2faa33162bc0147aea0d2
SHA256cfffad22d266a9af7550f989611c07f46ad6945e4000eacf12843d467e21631b
SHA512c5cbcbb3dc540d18e9f112957e2a1cc8e460930b339e525dbc7eead27892f362522ec38413ce0a8b54beb88470c9ec119b5110361cbe296e0b2d8fc87af477ea
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b