Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
8c1fb40edd30274e63b2748d8f84a7e4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8c1fb40edd30274e63b2748d8f84a7e4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8c1fb40edd30274e63b2748d8f84a7e4_JaffaCakes118.html
-
Size
49KB
-
MD5
8c1fb40edd30274e63b2748d8f84a7e4
-
SHA1
3459eae295878c8408444b2e305c098c3bc85505
-
SHA256
9378b8e7838e92cefb5437066b4b4247e687d08772dfc274915aeb4813fc479c
-
SHA512
c871144a90a9acf28f561c8a64789e1c1400f62951e7f6298a1875cbf6d5ecbac7b49557fc3033a89188116156dca6d8ce0a1a282f8fa3a98bea2a8507028594
-
SSDEEP
384:E+dQVXG1t+/YpY+YHY2YPYWUBOYi8kCZu+bTTguWJT/1TZ1i0vtDjC0lxSvXqeDD:EvBo8nZu3FxGsxIXFKxRxBDQIM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423445647" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3FE1AC1-206C-11EF-822E-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1676 iexplore.exe 1676 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1060 1676 iexplore.exe 28 PID 1676 wrote to memory of 1060 1676 iexplore.exe 28 PID 1676 wrote to memory of 1060 1676 iexplore.exe 28 PID 1676 wrote to memory of 1060 1676 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c1fb40edd30274e63b2748d8f84a7e4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597c23af2569ef00b2b7fde6a20417d84
SHA1f619150d831521d798dc05d5d8c55756d7b1dcac
SHA25656651996f5c0d999514f70191e99807210cd46b7df72459627e4bbf7a4ecddb0
SHA5123aa4a584b1d429425d3bff37089b5b0c7bd7f66f250701d3b5bbf8dd80b75d96e8702a004cdd00db329fd146cccc1b4c094b2103c8461af56e7443ef09dd8bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5356a9ffe2893944e797db4b49046c205
SHA11306b2252e7048623c7f856a067f3b55892b6bdb
SHA2560d0e82683ab1da337ddb49d0c075ae518a5ad4e4989555974ea37d8fdb1c5936
SHA5122b85db3064a30df43203a3232fd82b7cacd0c8a5dbe8c17097fa5f224b1b6512ec5428487e01fe4bfe55a4b01ef97c4524b641f0dc42828266aac37e68e30d94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d28aedc609747a23ad97ad085dfdaee
SHA1a78a02033c7d9f8695c8bd5790b3a94831d5ff75
SHA256ab54d762995693a3d0c0dae5ac26c9374e196e205c15e0c0938ff4fa5a2e7bcf
SHA5124bcc2d3a3866b96b0f06af6fa4558835ad96e89b0962e0617ff0e626b4bfdbe9e1ab41950f55d5b9d71d3d12c91a207388f0af12849968cd276a3cac6591bb9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5041bb63a3a3df4ede57f554afb65f9bc
SHA1da48ebcaec6ab8002e2a5210dc4d14f444696d30
SHA256d437a34632b522c1ca7bf666c2b5fe11e71545f0cb6b52bda45127d06ab4838b
SHA512fd2730e44e4b08ff11431499573f2b12f7ce99da5987f291bd344a5d614b961ceea56d250f1dbe98119ecd5b26bd8d53003fe3947682f476f4a860fad706db7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b15eb47b4b49e2a261ea16398e06129a
SHA176e0990ec48d89aa12d047e7f3df8a259cd4328b
SHA25680a7ac0710865a9fadc3ec432097572d66e6151f95acf19bfdf7611cd095f9a0
SHA51266ef2fdf75e88d269c1e58f05eeb64284ed4edc1affabea35d027025e9d30e66ff61349d4e480fb365abe839f05eb6e95b65e7bb54d381b8c11260fe012dfe29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f4d28b62e3229c5b7cda9c7a8682da2
SHA1abad95f17c69e128c1af7703c204a476dea882b2
SHA2564c074ac7e57a10adaadb721165c3417bc9e10328aba03f6d7a0507f9f82910cd
SHA512ea364124fded0d91ba86a7df43e88d5266dfc9df2207e72caceae8a7210ff0c11a921962a64121dfee379f54264517081c26bdb2b82d3925abb88ef8b9fd7f47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52de92bd46e7b7b2f37d711c170178340
SHA1df9e38872a716fc7b74ab6703ba692c639b65d16
SHA2568bffe237d5968956edcdbe9cff17c9aeeb9ca946429305482d2ca856d00c9b2f
SHA512b5379513909c9318addee4e8cc50351485d6eef7e9685d5383cb1f60871b5215d0b1fd16bcf94fb3c3c98e797e64381b07a09a67a2dc7d9801cd4b0cb8dbf56c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545ff86b8c5c2f60b67078294411ceda8
SHA1983f0880544973eca464ee9b42939788e7c31f9e
SHA256cb62dd58fb563cd6d1d758d844f33e6c3b3049479b2ecf9168625a654b6ccbad
SHA51215af941f688ce59f504939b749568308e1943b02b7d03215b01b0049177ab0a73330a26f389270c113700e9dfb4f8d6598d7c2b445e9cdc7655c795e38d57cee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506b832f2f69ab5475f2ee92ebffa9262
SHA1a3151315f5a72fbbdc978bcead4e6ee21a11f098
SHA256153f2afc0cc82e5c54891131f363a35d6f816f458198b5aa2e4c743391f3ab1e
SHA512870f0f89a14b4f5f00d4a00353f5a88842cdb3ea5585e099b3e06488df0083844312337f0ec800d316877e487c43593b4da87c80396244a8664ab4e6781d6c78
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b