Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
8bce69c866d76335ae7c3b92e553cba0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8bce69c866d76335ae7c3b92e553cba0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8bce69c866d76335ae7c3b92e553cba0_JaffaCakes118.html
-
Size
103KB
-
MD5
8bce69c866d76335ae7c3b92e553cba0
-
SHA1
ad8fb4500eb76eff6e86d618698c79db0343aa58
-
SHA256
8f74e78f081aa8787ec4c92d6c02df27ee2f35ec48538975fdea2608ee783739
-
SHA512
7113690aa79dcd4ea84218f8616e258d1f60816354775e47e7e56736ce3e4d4965ffc361dc22d79864a8440a9a404eac027c00a69a785ef6e4986e3cf131a883
-
SSDEEP
1536:s70gTAVZ/c9CXwrRKdD4+N5VREx3vnX6tTKwCsSXkDkEcLvUPTR:sTAVZ/R54+vqw9PTR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBDEB2C1-205B-11EF-B0F4-569FD5A164C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423438332" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2992 iexplore.exe 2992 iexplore.exe 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2024 2992 iexplore.exe 28 PID 2992 wrote to memory of 2024 2992 iexplore.exe 28 PID 2992 wrote to memory of 2024 2992 iexplore.exe 28 PID 2992 wrote to memory of 2024 2992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bce69c866d76335ae7c3b92e553cba0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebc731d1732d36c38a2b1010d995293f
SHA14189f10065d9a9dd1e70fa4e873cef36b0a89bac
SHA25684ce0ea347eba53c8894d924bbb473b8ade1b379393e26ea867c32932644f107
SHA5120d9f7e165fbf69efa4f23a8b221af74d4c7d61fab0480cbf1d46190631fa6f90d55c5ba77b8e917793dce2450ba754f408c5d881aafa9bf03653551456052d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c786fad8b5bdb506f78f5ee06a8f5ea
SHA1136a60119ef69e13ccf5d7ea2cfcae42e011c290
SHA25614f05bb60c6bc77f2e0b2a600295a87772eebe3c24a0665bdcb7a954565c4b47
SHA512ab42cf9ca73743cc5c89bba88792231ecabd177ea36a21a94e9f1731a30005f8f2a9b80c1a4fa1cc7a72cde9ad568a2b6ecbbf8bf0930ec38afb1927da5a436e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a6c123dbce4dd69464d4d3e61626ddb
SHA1c7333844ca45f0b31fad7f59cb8dde71a8740895
SHA2566a02475cdade32cdc028c59e8d8b4dfbe74ddd90c20857286d7fd2cf1547e242
SHA5127443cc22ce66d4f4c49491bb1bcc198bda70f2c88576d02f7e57feeb6cfd580256f10d905f4a8b09cfe7ca3778dccb345c31de2b467054847f860911657a42cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583774bc4fdf310f23a6bfeb80e096440
SHA1dacdfa09bd51975c6b17dada9f502ec7f6af9bd2
SHA256b20f8fc4eac74660d13ac0b83ddf5be70aaaec5465f29e2b815e969bb7e3fa11
SHA512b19a1fe49268649bdcb0bcde8522a34cf88beed433d2ee7f2809fe3565219d49258f00388c8d30c17d907debc2a7cf610a42290fd85873e48e60660e1ade3962
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0ba7a26f19355d42fe2103b5f10519e
SHA149f16482ffc2a3c37bc374447685146452674068
SHA256e142642d246906dad08791ec49d9889d8e665affa650597d3e049e17112405cf
SHA51203e152bd8183a39852b3e322d43fed30a4f2b5c344e5a4fd6d46390d1c987afb30612c41e92f863e77a2172dff7710466ec28b8677bcc66e523f7d101d7824e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8cc821e47ff0594a109f1a55489b766
SHA18fc9167e25a959ef6dbe7da75f1fae82223ea7b7
SHA256c691d8cd0712edbb987727c5f149a80e07beddff011ecd25155016378a72e0d9
SHA512e31f8a62d503dc964085967a82a2e00b300aaa619b58f4238779e8a33007b718467b91fb683be8fc0df9f515e44c356d95ed6cc2c88bf8616e7aef22728ba5b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50da3bc33c902569fbc9e9a2f56ed9078
SHA1a4e0afa65e19383b6fe21295cac9ecd2f56f94d2
SHA25678d5e6dfaa06583006debbf86f86ea3dca8564c305d87af5648518bd61267404
SHA512a2c10c9b43d51faa664bb6efe082ef473cc7acc7d2f6c3063dfe07d963eae9929e481984dffbe39bd157d2c569a5c06b84dfce21e661f1d560b74ad56bbb29e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5117001921d7a6542fd49ce8a69d8a044
SHA1bfceee20aa256dbfdcff3465f6b06bb93c166042
SHA256f5e98cb339db4b16730b17a0e3118d8f58a11049f487672686b4bb583b7cfc09
SHA5122e1dd60b6a28981aaef963dacd34c0f28eff67ebfe5b95d927dc747224dcf7c0d0d501e89b7edb7862bc8980a70678f5142f847b4e8d17404b89f8b4cea8f780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eba44fd905106c95308479693e29c12
SHA1bf433a07e059a979ff7beee748ffe1ffe625ea2f
SHA25690f8085f2f4f78d995c31ee78856b57db0512d651818c143a75b7f35420fdd07
SHA5126a254569be1e27453aa299a2d7f900dff4e75117f1434901a73c0969488d1de4865a5dfea83bdbfebd15fb52a5c6154cf9c9359bc532225787b2cb2ab153da0f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b