Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 21:06
Static task
static1
Behavioral task
behavioral1
Sample
8bc878888cf7e7721e0aac098d3318ec_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8bc878888cf7e7721e0aac098d3318ec_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8bc878888cf7e7721e0aac098d3318ec_JaffaCakes118.html
-
Size
32KB
-
MD5
8bc878888cf7e7721e0aac098d3318ec
-
SHA1
4a003fda84f16a3cad2252e6e83cec045a14e7ae
-
SHA256
e0b6ae4eae1f2bb1c8ea340c1edb0c4afa16870b42af36372c679caebf41e369
-
SHA512
2e08d0c7c6d05247b5bd14404796629c84b55e9898b3ec19b9b53babc80b5591b680228831ba48337e9b58819b3671f96cac5095dc0ac7807e8b2c1714f1587f
-
SSDEEP
192:uWIaqZypb5nxGoS2uCGWLYk7Klx6nQjxn5Q/zanQie31NnycEnQOkEntt8q9nQTz:8j5Q/WYs6P9NQt3jtO7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3BA2541-205A-11EF-AA09-E6B549E8BD88} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423437862" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2392 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2392 iexplore.exe 2392 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 3012 2392 iexplore.exe 28 PID 2392 wrote to memory of 3012 2392 iexplore.exe 28 PID 2392 wrote to memory of 3012 2392 iexplore.exe 28 PID 2392 wrote to memory of 3012 2392 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bc878888cf7e7721e0aac098d3318ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a8243b0be32187a9d042d7dcb14ea7e7
SHA1939518ce8453bf5ded32b396920bc153c3c67485
SHA256424ed97ccaba86e42351b50561364bd9ac3e6c5b28ca9a64e74f600f9239b528
SHA5124a11e8196a394a1f74557c2b8c142e06f9bf89ecf21b3f89a24f5de1c2432b4a0a7f8287fea9199d254d427b5c55ee70b8f26504640f6b8c11e89ebaf912c4ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea926e66c38ff35a3937784d9d180694
SHA1befd511052e74caf5f303286a50c0c476f984f1a
SHA25666ceaee334c618868357b3a4a523292ebdfec205068286d71b5b443ab1de6d16
SHA5125d06093a21ea733655056c69b1affc8725d580a791cf95b1f23c653ef9f424dd7bdc79e94d2b1ae3953e51243a291bbb6a6829f5c6245d0a96f680a74b2dc610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f64b6f844629bb831758e4c35374154
SHA15e32d70aed325b3bbc746380043b723ecf150ec6
SHA25657b147283f9b9c3b000a3a6f9cda9fd1958796f418bc40aa053f4a4c14fb1582
SHA5120870aaf1b455a7c21ab0e521bfe48235d49ee8060052d3004d6971b2ba1b18bd1e66343a5212e8eb8d0c190b6d5811a39ee39a743f94d488c8708b1cddc091ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d8f5d0a25ed2a0c4b580c7404a0cceb
SHA19ab0bbf8700983503f2a042b8c19f7bf7b7030c1
SHA256ce19fb8e2fb4be3020e0d10e85359f6f5f6c4e966aab91806812f2a5b599f001
SHA512c0c267624eff7f34b4de9cdfaac8efacb8e0445994190796cfa685fbbd50a49911e71e3bbf55dbd56d4db29ce94a5bf25ee1e9c0209b8c22057759cab1581b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5468f8a92a2f46d1a455602feb4f34589
SHA15b3787f2b4195caa49c1f1e8091ac65bfd2cfc33
SHA256571055e4d67747012300d0bbbad4205a85221e83bba904cc6a737c54a989366e
SHA512fb325ef0c6af5201a79b7a606d5369fb6902d53e33227a6f450fe4ee9c136925bbee02f9764da9283f9729540300787db0e610aadb3caa4de4107751f450dd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e552050c9b10e7728675cfffe3f98ee
SHA18bded211e989ac05a3e5d5d3d3969311638dd7e8
SHA256c20fffaddbcf6c68514a8c015cbd93715af92a1a1981a08b54a3919632368120
SHA51224ca3eb67269f8a416fe36a79b03702b7065430795c56896ec155bb49d82f84bef6896a369fc5966825825bde349f837418122cb55eb22f1ea667e64030c65eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc220667471bba31f831ae38226dc082
SHA11784a19fe70ab02837b51a617b6647aed8e5cf45
SHA2562a0c8ba826a41c54fc4d9bc016e5de8d6bfc082854e0c8169883cbf02745e6e3
SHA512cd7a754bc4339986ef8d40b3a1292a507e42a74969e53ec123e3e1143a370ca09155133025feedc202a23f66fb5388ddea43a9b6e39d8720603fb2699e16301d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d1fcbd6144951973f9deee348b0dfa0
SHA128ffa29ca7a7c8ce9e14370113435446c438405c
SHA25673fcd0a94f127c230f1cb961ae05f0971b48837dbf47928e435734a443729051
SHA5121a12e6abf2bfc564295a28fd89d9d1b5b543c882bb0b36382a8923adba914a20a656440db33f33df291e7630a88d0f9a8563512ec69c23b07d7cbd5a9ce3d39b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564d8d50d70b9a54fa85f1e897011b179
SHA18f0d594b79e019d4bc4522c355e8b248da6b8bc8
SHA25673e848219024e9f99a5a537e0086b1c0e057eddbb2b6f6865a5a9dbbce84409b
SHA51228224040e92967c6e47ed4fd171a8c57c99315457bdc58a14460fd5237e5bdbbb9b28099454b87423f0bd4bf7c6266088a9ef02f3504508783dc936fe1716d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dd8cd78f00c866f5851adfa7d49670f
SHA156a6dc7dcef7f755ba1ef23e9e66838d45bc8d63
SHA2564fec096eba05f23fa9a96fc902996d608b0220b179f35325bf588947a410d78a
SHA51222d485557adb55d12ca8be998a726d9de139801ea8d3ae80202ab21854fd435472cc5addd24a18a6572bd513c0da6e98c3a7895458af54e15d7a5601a384b682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5be7a8605d8b9a902b165337d70fb903e
SHA1bd0b4162cd6737bd5619555ccd5bef4ddc497f1c
SHA2562bb91bae6c387686ec77a9cdab3fe55d4def0bcd9e9f2898efe67a14beb5fc5b
SHA51253a12d1579d38b0741300bdf627ce6935dd266e671004481e93343af72873313571dec65203f4f8dbaa5e339a7b2692115cfdea257316effe38f28f3da983291
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b