Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
-
Size
27KB
-
MD5
9699487cc03022dc276e3e084f55898e
-
SHA1
c4697824d8b5a5481b89c24b983c33f1125362d4
-
SHA256
57eb45d263c30555a44e0cb1c61d75751f27da794253723210096e9ed5a76422
-
SHA512
30e5713a1929046e494b261014459a34a828ffba9f37e63493fffc10fd9f7dc59f6d5f06520a8f87698da29f07b65cc27bbb15daf2f361c3413feed2d7aa4f66
-
SSDEEP
192:uwb8b5nUmnQjxn5Q/fnQiemNn2CrnQOkEntdJnQTbn5nQ9eUWm6ApCEQl7MBGqnc:BQ/IC/N+qCvSYx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F5D0CF1-22C9-11EF-9969-66DD11CD6629} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423705108" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2964 iexplore.exe 2964 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2944 2964 iexplore.exe 28 PID 2964 wrote to memory of 2944 2964 iexplore.exe 28 PID 2964 wrote to memory of 2944 2964 iexplore.exe 28 PID 2964 wrote to memory of 2944 2964 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9699487cc03022dc276e3e084f55898e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a1599d532c29b6df4d6ae1cf7ebfe5
SHA1305a48eaaacf9869aa7ea9a181a79769b7ed7367
SHA256856899570a9a18c518ce4b83a5ffe39aa7268af0cc6b0f8894eec6f1a633c109
SHA5124ba203a8b1afb78488a2542c617dd28235aa387dc07df3ebb25bce8318672c186ad7175a90e3a41f28b9f91e504e6710675488a51b6804b56866155355699c31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cbdbf47bcf56fded0b180d773a8b54a
SHA1067103a1b9e3f82c84493b703a57d6b3bd53d574
SHA256de2a63acdffe3778e9ff71314f4e741a60430d238defcb8a4effa64aa066ac99
SHA512c041c1f36c590592d264825c46cebc674c2bf9a7b4ef53b73ecddcb1da6f8acc93f201866cff55e845b7c712a39f96e346b8f759e623baa376086dd2e48c2279
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5564589d23f98f3ce7f8a1ff12d810c50
SHA180647aa9ab81295c90ecc97df022a0613e9b89b5
SHA2564f9dd11fa7540e653034cf1511ecaea75ad6b84814f024259a8efea574636907
SHA512df648764929adea6bf2ce5290d84f5c7d19b5556040997d62f7559fabbe51425dead6dfffcd5c44c4a5fe4c5868df1c57c146ced85821452a7976b5bd2d5240c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2ed4c0a157fe869c6d838f230ac77d9
SHA17f2040aab66e7eabe42c44a69351929013b21ffd
SHA256f1f1c860c31fb26b4ff9403d3b5fd6591b4ecc91d343d03c5e3d3a76d564a7c0
SHA512c795ac09a2727ee6c6119204b18632859fae678234ddb1854725d45b92f7673c6c3aaeb47795b7e3f84d0a1784c95cbfa489a963456677ac97498ebc2d12be99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d2d1fd7350865871c7c4e96dcb0ab5a
SHA1d2933860b9c3019e40cde05072ae6c21507df57d
SHA256b5b4737a380b4b692752cec83d6bbcc27530c9d829a22065db28d257fc180f00
SHA512c7949f0fa0c7d9a892e19b38cc4e2c4834f6d89507d193d3fb3bbe3d29978d6203184a0dc70824cbe87a84d779e8dd195d04a1a105c5808d106d4e35998eec4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5616f5b836e04a6eb8444d6696a7fb27d
SHA16a430c644c1c2e3faff5d132beaf5693870f7ea4
SHA256baa8f9778b9c43dfe4109900d1c649a3c21460e4d97d6283a077348c41f347ed
SHA51267b527e904eec54a90e4bd6380b2afbdfc3af29b97e774e2f991a49f43f08e37a6e897327506a857d49061bc879899fde027bec5043bf6b1467bd5430d5c5157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55086572e2e8a728f2e694f94cc8556e2
SHA195e25ff75c66595cadb6f34dfc359d2e5002aec9
SHA2566a3c5d4927ebb51134eefc983629b13e028e87c93958e7e0be87d742a5935ce7
SHA5125e872ea67580099eadf5ce4132f5d2381ada6a0a568447c29252de4b66935ad5c49d3cc359e61391f6a38b54df01f303fc9ddb576ec1ca725a00e5e08378cf7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503d1769a8b354f24d4121bd5f537b571
SHA190b86f2bf7f99943b857b24eb4d21fbfcae0f4c0
SHA256cdc4deda544b755757679c9f335bbf9dd3bc90ca892bf6d28b0264ad83bf378b
SHA512c0219b8f4f0abce2768a6a22b73b4b8809edf574a4e6b11309d2d8e5b7a0db49a52b841306619769644cf0fdd2d9a1fc0d97367eec2751fcb826d96157e62243
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b