Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
8fbbfac774ef39e29a12d401d83b7b08_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8fbbfac774ef39e29a12d401d83b7b08_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8fbbfac774ef39e29a12d401d83b7b08_JaffaCakes118.html
-
Size
18KB
-
MD5
8fbbfac774ef39e29a12d401d83b7b08
-
SHA1
fe92251dbb2cf085deb03fb219dbb1648fe82f08
-
SHA256
10bafcfc794e1a0222d841b8a4f2224f776bf5aff67ffd53f935b3b46af38256
-
SHA512
aa093ed1eb08e9aeaabb000a3942cf6e62574fc2727a7f96d0ce9fcc972acfb98aac2b7da8dab41be8f057aee129d451f03635d62f862835fe2f7b1c23ec02d7
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAMl4tzUnjBhHZ82qDB8:SIMd0I5nvHLsvHyxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423531046" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA5670B1-2133-11EF-A1BA-6AD47596CE83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2928 2916 iexplore.exe 28 PID 2916 wrote to memory of 2928 2916 iexplore.exe 28 PID 2916 wrote to memory of 2928 2916 iexplore.exe 28 PID 2916 wrote to memory of 2928 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fbbfac774ef39e29a12d401d83b7b08_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536c764beef83c44ab982c7b66d228be5
SHA1a2841a2b4eca7a3936a123f7804241631f57b1a6
SHA2564de521cc962ec1a415b950e9a2e7ffaa8b0bd05630406d64e691dbb9cc4059c6
SHA5121fff5a674882927c4c3281d986bd3469ae529fde062b5732479cc1e365b81727192008c6d7ff5cc01f8f6301768afd17ed1b8c7220aa092d978ce933c1b42ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512194bc92af11e64089f278eb0b0b7fd
SHA135d64a7e4cf7a270486d9fc6708517c459cd7b0b
SHA2565d089fa6349bcbe6a0d756b14735bcd4b3243d6e5f72f0baf625c144e13138a5
SHA5129aba6452a662a59e122290bd61438c27d7e83556136bf6d7aa69c96833f7b9c39deac42e758a7ee77c419f69fa9e781be6f63f877ccd0209b79d6aed03e3acb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a5d618e15a2763fd6fb88ab1c6c0344
SHA1ff68ad80217b4d78e6b5de533876e22be25242fc
SHA256d2e8ab9887c38b6cfa771eaf22fc005f55e3abd14aea03d6a5b9ed224d29ac80
SHA5125b4b631177ff87e9e29e986560d882d794f619a1b042452cec76eada4c4ef04783c119e4d548245077d2b88f0d77d3cd8be9628d8cbbe94ca310eab3a89ec580
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc45020d1608148115f4d1358f499d56
SHA11ca42815d312bf90889268c3053497ab01ec0d06
SHA256bf5a413b34bf4db35e6154310836d2e6329f19ff08e9d1617b661de1b17d4157
SHA512e570c21a05ee1f31156c35fb01ea5747867dfbe8921d9124f04bf82cfd035f62d597f5b8e58ddf601dc9d3dffb06108a6714554c4f45491ad379dc43f64f6b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5119a90c3ca2763f63d86d29e1038d5cf
SHA169891c69f96c121d45bca70c4aabeda961e6c6a3
SHA256b0247ab27f12875c6f5e3aac1dc9f0668c981b2372be6afc81bd5f994513e730
SHA512bd0d419cdc293a282ab1cb09213f3d865eb4472356f73442e19e600e378146d6c9eaaa38b42c96002dc1513fe7a383b92d01e7384cf78131c80892a856b82147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52074f9f402c1d8e59d05618b36b0f4b7
SHA148a6235901da012e142f124f4f556f51b348603c
SHA256686139cf4df62d038d912ae3e64d5ebabc4e06a0be1a7023a70c67540e5d7b49
SHA5120057a75f01de1f6a68336eac752b2e40f26c04448d23eeb1a20ce5c2eafaaf36fa22b887b9b695eda6c073ed60983728b5986e6a69b8b0ea7edfab4762320fdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584f927fa9a6ceaef23ecfbc31e9af207
SHA18cec35de3bf8881cb5668a8b772bf9d47a68d3db
SHA256c751c6a200c4ffbebee54bfeddae9d0ee33997377bcf197aac4e557d0df4dfe4
SHA51262b0cc836d70fe259123ce799617e62694bea990fc0ca41adfa6677aa1eb3e5d22e4580b41a0b09f939ba13d802bd2333d7b9c1b28c774434e1d2281c2911000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e73affede0426a5d0bde6fc8fd978024
SHA1f8fff3b89b6fe39ed9e80ec4572a3e5ea2fe1836
SHA2562514c0f4cbb26071e8f37495cc5634b29d4f34e86cbfcadd6b01106d5325a463
SHA5126cfce8338e5e8563dce0618cce70392fddbb8f8c3d69753f97d08720b21df77242480dd67293b18b00821646c0b5cbd4df31e997190667b882961c7739fd2ce8
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b