Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
9673382220d09a74809df5aa38b70c08_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9673382220d09a74809df5aa38b70c08_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9673382220d09a74809df5aa38b70c08_JaffaCakes118.html
-
Size
41KB
-
MD5
9673382220d09a74809df5aa38b70c08
-
SHA1
1086b0ad3b55b32cd7582629a6e5dee1549ff36c
-
SHA256
8469840ddb77e84156c3c61c8109b991daf1e8dfa45eb2beb59c394df2ca6b66
-
SHA512
ec3a2d20976850efebc1a3e6fae13c8ae1b7f81019674714f25ac5a152f2d4f9c2216049e9333d7a540dd0905938a1ab9f0e9b0aed4070a58994cf8e2379a99f
-
SSDEEP
768:pFEbM1bgJ+b2vbnuv67/29bNK9uDtGoGe701JH4JgYAX2V4IrP:pFECEJ+SLuv67EZK9uDtGdXtZGqUP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E89DDDE1-22C0-11EF-B837-5AD7C7D11D06} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423701608" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2444 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2444 iexplore.exe 2444 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1676 2444 iexplore.exe 28 PID 2444 wrote to memory of 1676 2444 iexplore.exe 28 PID 2444 wrote to memory of 1676 2444 iexplore.exe 28 PID 2444 wrote to memory of 1676 2444 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9673382220d09a74809df5aa38b70c08_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ddf65704e71d427c2ef266cba378685
SHA1a657764f6d2c7a918ef43bb2153f12493896eb1f
SHA256c87cb748ffe3c37fdf544f59e531c32c6f7b89d8efdc96ea3491ac3e717a3fa0
SHA5122baafaa15ba46f513f979510ef447380249709c99bc57cded5f2478b0671f95186326889a77140612bcbfeb84c3f4a115cbacb61a03f4c30f025cf33f4f0078f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525125dd45d9213566af3588ddf4a14ba
SHA1c556a8b3dbfabc4b1375bef565986edc1e0569b6
SHA2568c0283dbacb6e510ec95fd536c09edf2822b666629ddc087d8ffad857f8ed334
SHA5125150f5c868afa2be7543f91d5e6a4dac2b3861f13f948cb8809caaad27c18ddc78543de1410c0eac62b51c7b8eae46bff3d1cbf0b5b668234ca8959eebd3cc48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cec38836683fa51fc8c87cf2d001575
SHA1650adfc0eec71e6f37f437215e9bfdcfa5eca883
SHA2569442162c31b672e1ade28719a679223daa825362ea9b0407be19880da161a37a
SHA512980134041e8440e5755d6b03a3430fb97d7280485eef714d4f8b84b0f18f46f40d303082882b4a5992441283b329b32c430b82b797e29520cfec709f1bf9a13c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59663a210641f2e39457084b9dc34c457
SHA1e178cad85decfc025cd54b757de3b56c68f35893
SHA2563d6cd387874cc6a9b1d60b11cb09b1c2d9d1c18ac070428359adf7d07ebe016b
SHA512fe5044d42f4cbac0206fdb858af227304bd9b20f2080c647f2d23c5ffe3689f1dbc08844fa8b4ae21b420828a431906ef3bf0c38b57bfe23c374b0a9d7d743ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dbe2cc115ee8cad2d791ca1dfc2bc85
SHA16212a60eca2002b4565185ebc3b63a5d342a9d13
SHA2565a6def6eb5df216cb5c6c41301e7c34eafba95eedf9acd8e0418e28a12815021
SHA512bbdc4123a7ab15f583b09dafb0e06b287d708e2836bce76fc2dea720cff6c0902151bd2e37c1cfcb0dc8645d5958ce1bf4f76f300c6bd570ecd79e5d406b7f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c906e448a199b1845f052f86b28ebccd
SHA1b8759cb5709e6399a2461f408b7cc588260cfba1
SHA2569fec09520bec6b309bd7380fb2622ea1c75d6d07e67825f9b41ccc5addabc27a
SHA512a58b472823566d928da4232f7ddb5a797793e847fbb7725a45980cdb7103c7104d00bc0bf9fc46ea8676798a04d8f5f90f404b39ad03052b985421b64e867acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586db61b69ec2865e7385e7693418bbd1
SHA14ff6ced05f5041009d3a48cec14d31633041010b
SHA25672865402f41477161f69d97d8ea5ddcdf7087cf5586b3630378ff1595a7b6447
SHA512b2bda80bb048eb3687d1ea09471934c89581c963e905a4df2b6f1c2ee8a9a9cae8ed6b3a308e47dab1a73794e403fe8f742946e9dca444d9db5e2884ba9a7559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5227cb7a021c215005d74418a60abf15e
SHA1ca32fe2bf5722780a2e670d05caf3f89dd7f5cbc
SHA2569729aeb8df376d39998dd69e6fd201f119cea2d8e0f5bcdc2f83c08651277268
SHA5128a5d5f9a865feb244cfce5dbd4454d6aaa1d4ee04a53d98b3ebf46e26b84ebd70ddf61222c34118a453206b0e7e7195bc70b611aa9a1e0b2a2e05f313a6b3c78
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b