Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
92edd3966ad659d44d0e340fec145a5a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
92edd3966ad659d44d0e340fec145a5a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
92edd3966ad659d44d0e340fec145a5a_JaffaCakes118.html
-
Size
23KB
-
MD5
92edd3966ad659d44d0e340fec145a5a
-
SHA1
740e8f53f553c7f089a74a97afd5e6687880ebd4
-
SHA256
e3e8e61fef608b054f4bb9fcb5a99b83264d423c5e415091abb17b855ccf3f59
-
SHA512
ca80c48961290aa2c44785d9c6210e1e432df3bc95be49abf2b43c51687ad9fdc632a3dce7026092343c8e8f2978de82e9c33f913b944f2fb7c3194fa3cc00c2
-
SSDEEP
192:uWz+TmYbb5ne2nQjxn5Q/xnQieMNnWnQOkEntXLnQTbnhnQuCnQt+wMBsqnYnQ7i:iTmYcQ/41I00
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71A75C11-21FE-11EF-91AC-F2A35BA0AE8D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423618086" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2656 iexplore.exe 2656 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2620 2656 iexplore.exe 28 PID 2656 wrote to memory of 2620 2656 iexplore.exe 28 PID 2656 wrote to memory of 2620 2656 iexplore.exe 28 PID 2656 wrote to memory of 2620 2656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92edd3966ad659d44d0e340fec145a5a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f58c95bf72cdf10842f901dac3e1c7af
SHA12af23c54f123c313343ce84ba76cdbaf22d86409
SHA2564f9fffd6e06e33108939e19471b861cbe16aa9ab83f46b1866aa2a99fe7ed9fa
SHA512db8b293e0435de4260212b33ddc52656b60512a2c343990517a5ba870b46681e2e8fb2b6f60b542d0937927cc45222b46bd33f0f9a5d3d6fc4e689687d787db0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50080b83736fb8fab1ba7dd94e13457b9
SHA1dcf7a5a0c9cf07de9760b413f95bd68f816c0133
SHA25677bfccbe803edfa37981c71641ed2320ba0c6d85cc1a8bb9c22a14d79d35921c
SHA512f9f19175ccd2aed5b814a44ae6f3503ad695a16dae025481b4fce39dde7058434777fe9bb24d84f3e6177732b80bac4aa0b244931f995e0ae6ea80c49012adb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57253465af6b9a9ab04c7c377d7f02621
SHA1f813b48e2acc8532a2ed096c378193e270cce51c
SHA256ac82a22ea4d3fa94fecf7b376a20f8a146cb09973301eb012f25a3ac8ce83dd6
SHA51265a81e6570da1a03aa7ed30357870a66ea207b1772758fa84a4495321b43beca818f2c92acbf851bf936ba1f48ccc461c114c3e71a4fae8d20a774b2d55b01f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c3f589e8f51d00502a555a6e4418cce
SHA1d92c4d06045f9cd710db34d397b8176dbff34049
SHA256265dff59ac231dbde2426e93e6cf8237ba62ff72fbb4d30ae48fbaf6d91cb34c
SHA51240edf2a09c4af22c3330494bd8a05aed1836f8e216837571310fe673388d4efcd15f5ffcc397863a7a6905ebfa862d1417fc4266cae1fabab5b1af4738aa6725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5875b97d8e6698e672e510709ef5cb744
SHA1827a0d5708e8e7d5f930b7d3a8c5b16c25ecbfdb
SHA256259042f4aaa22ca6d7a8a496a385f6c76d45049bc5878e46523fae1979626222
SHA5128dabdbabf344fa51e78dd4f8c4245174ebe68c5d701970a229b679e003742ef809de044f819edb117e77d3acc5e623d6aeea3562da8f31a4454fca4fc6899460
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563840f465168330909a5aa6eec0c88ff
SHA15954788240331e18bd0afcaf60654dac42765eac
SHA2563f39cf8f6134a58ac2ef7777bdec31c5c5bbb9c42ac6471992eacae15b0e522b
SHA512a88a34679aaa63cfc200215bd427c7576e07c1cf9631cc916976462af9c587a8b71bd134f579734a8cc9d41ba368208a36280f92462c9e3bd49ec18b4cc68fd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c8a71853b09596e4b12cb3f4a34523b
SHA1661e5b3cce59246bd5647ce1ee92b5fc72c2a634
SHA256f9b7a2415e06cc12cd5d0605514e3d754f4f18b21e4c4a66020ff7f9e1a4e7f2
SHA512c9a49a439073e0a2c87a755df60db26044da20321227fbee2776deb9bf80889f3f3504385e4e7598314fec8ea30f38c3b299bbc5a2d94ab4b9e502691037a6ca
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b