Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
93d514cf770b9fcfa69f64507016c81c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
93d514cf770b9fcfa69f64507016c81c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
93d514cf770b9fcfa69f64507016c81c_JaffaCakes118.html
-
Size
19KB
-
MD5
93d514cf770b9fcfa69f64507016c81c
-
SHA1
62393f1406138f884c5b2ec361f543ca5bffd505
-
SHA256
1621ca19c614a27b95814f63628882f8d901cf870f8e31f519661f39e98a6e4a
-
SHA512
b25ca6790db1a185394618064154f661c5ae27552e88a04f61352a6aba42b3131066106c3662b99b1e95684d9af1a36d4566d8b5c99b3c36a6aec1e97397cda9
-
SSDEEP
192:uwLcb5nwbO3nQjxn5Q/GnQie1NnXnQOkEntmonQTbndnQmSgHMBVqnYnQ5wNnlnn:FQ/AqpqG
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DCD69B1-2239-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423643393" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1716 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1716 iexplore.exe 1716 iexplore.exe 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2236 1716 iexplore.exe 28 PID 1716 wrote to memory of 2236 1716 iexplore.exe 28 PID 1716 wrote to memory of 2236 1716 iexplore.exe 28 PID 1716 wrote to memory of 2236 1716 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93d514cf770b9fcfa69f64507016c81c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6c453082b94018cab8da26d19fc272a
SHA13638576c2d35a98e36a65386a02867806adbbe7e
SHA2565df98c29a6a4a17a6656e7de989f9d69daab22e28f385a2bd0af68b53866833b
SHA512bd93257479a204a487c57c3fa8d89f855c52b8b101fbdcfb50b92d5c3acc3e89d51e74e04de7a845392c495599d04247cb7416b504dd40d97b320923c3103463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ceda1b6ad9e43cadd24b51d72606a2dd
SHA19e7b0786d9528b2ab3d52f1272d8861485bd8b77
SHA2567354e548a8b823ab8dac8a9717d4c2926c2568d918d25980fce308be8fd29aa2
SHA512eb769f5e3ca35103301ea5d873ab350ded8dd9fd8b7d8e6f2c95ea4d1c31bace64f56650d3ec6cb46ab89b5a976da0e0d9a58d76e044303e485a900c6c841b6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f211b4167449ce760f0e0270abcf2f02
SHA169202c67185dda2394a22b716d5dc759bb054da1
SHA256702bc4400e1943eb039df6c5f90181fcc5be38db98e43fa6390df6fb57ce2bd6
SHA5126d67e318c3ff0613f35c57711c87d7994ff34f4e6711198f0ef3242caaf76e7981516daed3ddd026eed3247f8d7c64af843329054e84c89b884c31c8232787aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a13811d3f4d1d91c09fddc74321179f6
SHA1ccc6eda1f186bfec6cffbfb072ad1a0c0c62e5a8
SHA256217a790140335fc602abdb2ae3f19cfa12be63de1ff16483ae839177362e913b
SHA51206d5c442de9a395d31d2f357efa811bb69b78381e4489c4b5a043d7108c483a61d4a257688f7e0be2cabf39a087e579b975f5c13ea6d07b15dcd1c2cf91b909b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532ce7a790839dd3ee6594c080443d4bb
SHA16bbcc1a24557683d0cb4b001c844c0d0dc231590
SHA25622f7a710aaed50809466c87a6e4e7e45c8426aa40b1f5f099323125ca59cc121
SHA512297aaa82fffe8bab646e8668a662f7dc34b9f4e6bbe0894a8d35331feb48a7ee38060e103a412b6569267ae45ba2698384bd12bb267c77d10ffe1d5fc9c943f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594bd3433e6f4936b778ad12987003fb4
SHA16ea6d72d9c9020309aedd090ebde654faac5650a
SHA25616ce433b2943beb90c05412f7f977aedf675e6f7ed35d15319de2ce838843747
SHA512ea2152e3748cd3352feed3b1c9a14750acf454468188d88eb8b96861d7f4ad3c6de0394152b4fb7f070df10746e70157c581e2ab583c266e38da616070506a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887352db7d1519299a3bc1fcd02bae11
SHA102d5bad71c9f0eb8892004a01108c3e13916d387
SHA256693b014b960442312d664444ac095d189ee0eb29a3eba81adab626df736e12db
SHA5129ff4c25504fcfc9eb95ffa0fc49bc02e263f62603d60190934adf4945ebbe35d6f8a9c71d2f76907f3b2751ff3d2635ee5c1135fabc74453d2eb07cfa7ea29d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3db4b595f7d5779c9067460a97aad2c
SHA108d4270c1b87dde160a59b067a1fc0fea93d273f
SHA2568b7fe8f4efb08b6d30ead6f5dd7cef23fa4ca603f2783526f3e8ad5d68efb51f
SHA512301107b5e73458fab6cf9bab7b76e1ef071d6a41c0333861005b98a52b8ae72a5bfec7dd5788982c1d13ab0ba7e1f14a4873cfbc28e097acfda9139c2e7c8be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ed1944094e93dff0565784633f91345
SHA1ca8b1cd083b6253c8611465949c6c5d99d77d9a7
SHA256e3509fc92052c7be46817917392d2ec446ce46b7c7c8e85043b004fe35af5ce2
SHA51253611a5a39b12cad966978f69ce2864842f50b40b0dae62ffa4a691eef0df58fbfb6488059811bfc1e40716470677f5a1ec45b9eed1e11e365651539bd2a67bf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b