Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
878f9d9e0b291816a10a007bcda4d4a9_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
878f9d9e0b291816a10a007bcda4d4a9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
878f9d9e0b291816a10a007bcda4d4a9_JaffaCakes118.html
-
Size
23KB
-
MD5
878f9d9e0b291816a10a007bcda4d4a9
-
SHA1
12ef0510ad3212b5a48db9dc3e148862e952297e
-
SHA256
c9d6637c5916d262e1dca9f934abeb1bf7172ffed08f03c5c5ba19cc7b90ceff
-
SHA512
c5a4f687bf891543a0ef1e22962b830a3d4a98d98767c9b8a95b6ebcadfaae7511d72ef5a0482f9d6914cd8bdf9a3c9550f6aa255da9b2cf06dd89cc7fd491dd
-
SSDEEP
192:uWHAb5n52nQjxn5Q/QnQie7NnRnQOkEntwenQTbnpnQRCnQtLwMBbqnYnQ7tnEY4:cQ/b1T
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAE22431-1F66-11EF-8A73-D2C28B9FE739} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423333050" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2032 2956 iexplore.exe 28 PID 2956 wrote to memory of 2032 2956 iexplore.exe 28 PID 2956 wrote to memory of 2032 2956 iexplore.exe 28 PID 2956 wrote to memory of 2032 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\878f9d9e0b291816a10a007bcda4d4a9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD592b09e3be7691be31fa5043df8bdb71d
SHA1ff5f6dfe799ef76c8c0929dd4e6550e6b06cc0f7
SHA2565fd8823ff01377af1e75c34177c2cf9130a3a7e8e4fb55e20bcd2cd02a489b6e
SHA51256d46de9202c62a9ec1c0e33c35b2461b9ecc6b0c5ca3ab4d60c5be1c20c3b2a0824a88f7663f5adc89ad43059fc354e367582e371985839ec3c8c1c192a82a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0c51657fd6ae5b7afb69e68ff848d29
SHA1a93824abc5551325a5821e3a1c49e46a22a4b9cc
SHA2560a3f6605aa8b5c9abde7df381987043d0cc9272a0ecb6a7825575fed0c6d3c9f
SHA5122a3c3d7b9f05b17800a0f2925f949127a2bee29b171a2f31d187215210a44972e8e2bb9dea89072f34529244fa113748a853ba4761f9ea6d20a0b8a2ee2f59cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f3853974f62709569e0515955442167
SHA1703a5509d0e2513ef3992165fbc04ffe22cf4e3d
SHA2567300140b5304072c18ee305db47fd49ba4ba92dd9a6b780db4bcefe30d3661ba
SHA51252aa3a53f95c4a8e84088a80a778cfd6f21742c8c19ce558414942522b090dec7510f20e0fc8acbf556580b0b78d420ca6e98543b4e93b79b606eee8cb2afb6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589698833fe11551f5920abc53b0f721e
SHA1a909c3c24e3dec0b0992b7cc5f8658a23d6dbfb6
SHA256713f40ef0ee5aa1c2270be8899020223c59608534f81226dd5b0dd0a8deeb039
SHA5127831b8c10cf2dbb9c81c231d78700bd08a21b03b407cab816850eb808356002324100004356ecf17673b03c6608e1a4e836ed8756a1856e6b8f924162abe7153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf7f92a282be5563c952536b6ab2c1b5
SHA161af94aed0713bc6dcc3e0e6f1be07db743bebc4
SHA25637f52379be30e8b1ca28a5ff0af02545257c798e4132ecea45d486c818072821
SHA512d1f20d9033162f07489acb75ff91daaaf7f9d42152505233c9d587866dae01650813308794f3955e573b76336375147e724a91076447d03bca303bad1889941e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de0e7bbb359e1365c37690ceb3ebf9fd
SHA1da6b3a0fa95ab358d32244003a90d1b83ac3f146
SHA2569d7db89193add3110315eb2c0417780f26a7d3710dc67760dcbd3f9b2a2efeb9
SHA51219e0940f80e64bec1ca9b779066a331defc954e857f7b63116afeb03def0db4bc531f3bc857149346029699f5b5c041471a6139f4aa98a4fb217ef812d743b12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531aa8cb67ae48294fc01f060974cae58
SHA10b7fc581a94ddb679cea21bb4e78eef94d3f788e
SHA256145dfb69f56cc89b7152f536ebdca40f10366d5b6a22484157cbcee916e3ae14
SHA5126c72a0d49933d630971282ca2fdabe04a9c219a80abaf4c81544c9a26b48909d492addec6bc1e0060f27836aade4c8eacc316945239771d8e21f6e5d3c5bed45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524749868d092b9a9d56d2bb323e13426
SHA1235aebb5c0ffc6dc15d53f702ed72178a7d6aed7
SHA25632bf3ddabfbaa10ee785a78666fa9219f9c79051e83aa143b620685c33bd1d6b
SHA512c77d1f3a7dd815b3cf7aaaaac872840711d95967457f13014a0e8c3a10e7b50ee7ffe4d37f09cf9b3da390c38e2b4bd3fc226493f765ed7bbd5b3ead7730d6e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576c3d02b07c039b1c4748ea75f9ff29f
SHA198d6711ffc1b0966f3022c679ae4b515639e0fb2
SHA256ee9e15a79c51f53b94bae199fde7dcdd15d04cd9d39959bd1183a70d1953aa41
SHA512b1e272b147f5821a87d4f4ee316e95628de463d326a8d6e12569f3be8c5e2a6397383ddd36e27f45df8bbf60f883bd54b921bff44808c92a98bd7ffbcdcb67c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9e9260a309805d360aa2aa39bd11aef
SHA157ed594b8042342d93934b4e11d8b503aeccdb4d
SHA25628df110c0b56f61558f676441871057c31ea0822190a6d92ca33bead2f2a06a8
SHA512a858777483b6d09c743b2e85c7651bbab681992b3ea18c611df56d089a1e1e57c5b0e5c82b064b143ab2838983e7e3e1d63fc47fb4adc33329d3c10a1a110f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57a50274327d7b0759388b0d0101d6517
SHA18fb6e866a329c73e80d7aa9d7a4c98f8c85981a9
SHA2563c8fd43492259eda5b8316d0464991cb2bc7c2886eebddff4f04f767d312b657
SHA51202cf8be77779e35d8e446e74633719ffb00cbbf7de48b563d4bf05d35c58b895d6b1c7c06db5dc41242d3d06ddd86d93e269c837843c7f2d7c81cdaa6b4bfa2a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b