Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
917e56b1b9eb4ed83d9a5f17d99077a6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
917e56b1b9eb4ed83d9a5f17d99077a6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
917e56b1b9eb4ed83d9a5f17d99077a6_JaffaCakes118.html
-
Size
37KB
-
MD5
917e56b1b9eb4ed83d9a5f17d99077a6
-
SHA1
4a76344d2123c2c371f8805ba176cc9c9707f9ef
-
SHA256
25f9470e5c920aa209e91b104170dc80edefee6b07ddadeb9e90bbecf2b17d0f
-
SHA512
e868fe897d08be175fca60410212579bc48c16d1efc251cf378ef8c634b2dc7210df71d4a548aa2c3c84f8872a003238ef07e33645a02eba0f7a012905552d1c
-
SSDEEP
768:hSD760dJrgw9f5G1/LPEU8VSedUgzw8sE5:hSD760dJrgw9f5G1/LPEU8VSedUgzw8L
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423573498" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A07F6FE1-2196-11EF-989B-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2892 iexplore.exe 2892 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2892 wrote to memory of 3012 2892 iexplore.exe 28 PID 2892 wrote to memory of 3012 2892 iexplore.exe 28 PID 2892 wrote to memory of 3012 2892 iexplore.exe 28 PID 2892 wrote to memory of 3012 2892 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\917e56b1b9eb4ed83d9a5f17d99077a6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f59fa1f5332dc6443b716d21cae3a97
SHA1a333b13849f516e5849876ca6307725009b2fb81
SHA256863c8b900bacb2c4ad445d752b16b3bb6ac507d76eb6f2aa94d0808cbc40a8f4
SHA5123d35f511227e88613054ded5185f0bf199c770cee8149bf5700600e55bcdadadac57502fe60ea086d1d7ef8b7d6801f6f17e3c313dc743483ad33b8e330a8ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb7c5e6bea815184e8d4b7b19ab50eea
SHA1f126e70f3173bbd51ebacee292c49d949d98cccd
SHA25647bc5929bd11a95cedbd6e1f85832519c5a8f51d80172482825b14ee944d63dc
SHA51241b74aaaa860efe3894d40426f0d77ffe6ca6ed5b08901168079a08270a9047e18330815d9596cfca6ba214629cb7d7fe853c7aeb55216ca4be9540cd5be77ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d0a791f141c67b84803ef8f6a728d00
SHA17b4a5fe09aee4acce507915014df56aa05420b71
SHA2562c5ebbc24e0513241de1977e006977fdff558017d0a0ccf8fe728ec6aca3234b
SHA512aba68f0d5dc399ab9dd21682017d9866f2c6819e22e32452f33a253503861ad2a47df2b585bd505fc979da1958c20505bac3600deef04d968f3d6fc407e96a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e68cf7d21b04a5c17d862e00e57c41a1
SHA14c7f71e02a4190b70c88a32ea271fb1247e51e74
SHA25645d95f61d31ed5d8244844ae6fd2d40c7dbadef9674c3e48e50b406aec72323e
SHA51289b295ceebc5dd7a933acccb304185cd3d8c83edf3ec4bd0198a59b52a1e1da4944052c03464ed9910ad2389e964b9df88d5fb29efa42ae30f178eb9076cd9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b9a958f25a23cb4bed980ee16e3ae75
SHA1cb67bf2b32b5560146249cd3a8061c6cbd375a37
SHA25678efcddbced92a8ef5e8efe7b28431772583b712970e24aa0b5592291cdd8892
SHA512a5dfa4bd23e7cdd35bc80be4f9d69e0d4e9c8498775d2f672689c522461ff2f90df55f436de3d332b2bc869a22bb06d326524f1113906704f4eaba535acd66a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573410cf108b66d97d6b7aabfe8ad0638
SHA16a3c177a67c6b142a374e600371a4e53c9308ea5
SHA256c74d2e31e88b2f7266c0270b86b0e5aa61eef9e5d4b16b21ebcb55c7d133b50d
SHA512331fde7510d3bcf18a27b4fa4b8086a7677c95e8c53777e13924d0821ea303e6091173c3e744c6201d5513abd5e0e6fda6592b283f20d8b06e30cd4419d4cc5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575ee870728bf674d0ae61ad63a890665
SHA103e7a7420901185af2f336a37c267bfd6a18f106
SHA2563db5f6e3d7356a1efe7cb049c04ae0e473db4c6832779b5f18a85986336544a4
SHA5128f6cd7c29ec932a1bd2e71173a51c4cb4c2c115408f0a51fedb3705a4f50dcda60ba42ce6bec8c8819ba7c65a4098aec34282e742f851cb4834ca349bb49e46c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5511265dcbad9b667ef24fe5648f7d945
SHA131f92958079831ac896b1b7bcb71fb2778bfdeea
SHA256e521d6ce1f8990d07f7278b8c1d39ae0ec16d1c0bf0f0b2b07fdf5728176d200
SHA5127e7cd76c9a28d7014bd5dadd838facca4453936023dd5191ec9eee9a47932730805c62280e0bef0133641ec70c531539c0ebbd2f800be04268f79b19d735271b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5535bf0c44b8b9b13c7be2317c16f97d7
SHA12aeab3fa1d09dc95f70af9613c217ff175fc1dbe
SHA256707fc55077aa7c305933b76d28fbc122dc2e12c5129a847c1d9aae65af7a9dba
SHA5127d4f9e7f828634f3fc6eebb2e1eee6358431149468d8fff07a1a2a3e96473e77728339b6fbc34614988274c2ce18e393e571ad8d375c1e86ffd104ad466b4a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542fbf225a0f5d2188ec364393b5b6455
SHA1bded69348bbb7846c06200b932d238d259500a3b
SHA2566ad57d599be64155f15f1a98c4b8793860e54160ba4fbf955bfdaacb3d501a17
SHA512fab904f5e397903449425d1771b898e600eeff02bf354ba5dc98f2ae3b4c10fafe1b648e3a6674bf4470b1be5650ed99cdfc3e205b1028d78dd606242fe77f59
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b