Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
95702fe44c7e58df0bb7eaab299b0853_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
95702fe44c7e58df0bb7eaab299b0853_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
95702fe44c7e58df0bb7eaab299b0853_JaffaCakes118.html
-
Size
42KB
-
MD5
95702fe44c7e58df0bb7eaab299b0853
-
SHA1
d4696adb5ba715b31d2bd4019d511b66534783f6
-
SHA256
0f942a3ce8c439fd51c715f75c8d0ea1af1bd26d91e8effafd7930075a87c739
-
SHA512
36b643cd65b3b0c9ee49ab0819fb2132833aa3535c81d0016d28eb687237439ec88887663b9685d8f4ec36e1033a66fc6d0db6b80bc107ab1666c9f1f5f7a8f8
-
SSDEEP
384:3Q/xgxAMaiZVVWd2GziCYx52nsUI3hKwkMZBKWimd0xX:g1sTRfsh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65141C31-228B-11EF-BF93-66356D7B1278} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423678624" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1636 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1636 iexplore.exe 1636 iexplore.exe 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1332 1636 iexplore.exe 28 PID 1636 wrote to memory of 1332 1636 iexplore.exe 28 PID 1636 wrote to memory of 1332 1636 iexplore.exe 28 PID 1636 wrote to memory of 1332 1636 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95702fe44c7e58df0bb7eaab299b0853_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ad50eb601f0b49bfef7ed9b5fae1a32
SHA1462490c557161a9cd57a026ea70cb844e8eea815
SHA2567636dd2d9eccd315b3b293001051d647e01d7059ff97a38e9077842107adcd1c
SHA5126014d1291b5a4146ddee8c67e488115bac7f0512c684bf33701d53f927d24cab671fb404da0c32c38150fac6dfa1196f5a919e864f3300dffbd8970ef773de95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55770d05d202f956c3a5d68eeb9c57de3
SHA190b28e56d16e6ec835479f7c72d3a433947d5d20
SHA25639f2c68c9465de3db2518101df4c2f95bdf8ac81f9b42081ecab186d8f28c259
SHA5123ac1f597319ad85b82345a2c5e8752e7ff550080f7259e08304a3f603a371fc0a753bafb13958c1f624f4d46d8118d7ef2717e3db0fe8419017ad19696d6a90e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b6a7b527e18a383d7370334d31fee6f
SHA1acb3a8aec84b2b26ac665549e2660e4c1ea7bce3
SHA2567892159d33d078e6c5bc9b102ab058c4e70b43ec5766a2386d04d8202370e166
SHA512270d863274db5bd6673cec1226c0284dbaf4fd2ee3931e359562a9ffb58f0bd31dfee9ba1065526d5315339368e75fdd3f0a1512e6feb125af088472eb667a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525a053ae0ddf55a168272bc13a8f86cf
SHA1e03a9d50b8af94fa2f7c4d804cad16da07c5e0ee
SHA25664b51e19d843bbd8c5da54ac74bfc47b5de7d831c05810e9d0375493da660eb9
SHA512c08e0aca42d89b988845ed74be795e25ce531e4335faea8e2be9282ebd0d98966d847e3f56ff9032bec7f16323987be575ea90c63a3b8f023020d3dafea60e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c77167c56703bc75b319674c7314ecff
SHA16d548d3ba083b96f433e4efe4231a4d6791d24ac
SHA25629d414c346f1a9cc68fc6f376039be8db7dcb19c5ae5d8d38f92168c4c2e79ce
SHA51228bba3258b5f3a1da2d0b5a3b65685796fae7ab5db9d6959918af847b0cb68a82564c6c9099dab798dd340fc78957555826b11870580ab5f17c0b976f4ad6fb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533167db1d3e2f5d07604edb5b28e3d85
SHA13af2244df97bc673a35f1b103bb523382f676cff
SHA2560a259e88c0c214e39de35b33bb098bec35503e9d9de4ffb3abd3593e499a8e53
SHA5127135d3dea5a4734eed99177e67db7c1ff0a61af24939fcc7e556f106fab9f01c8389deb11dcee5be3efd0e01bfe5bb5650f7396a39c4efdea1c0fcb5b018c125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579466ab048873529f32cf32f9e8d5a00
SHA186daf3b932906ac8b496ac4f6de1161386fe06d2
SHA256d46ab08aed9ec883308a96bdbff0561727e886fe289e0c5d4bce96da9b94088c
SHA5127faae45557c1f11f2fd509157e308d00be7392209b18f1c2bbedac409dc75247383bd72ac652c8b6a81be86b1b6d5118ec4df7609e0311dd6f5164eb3e5d398f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c11537709283976ba30b308e81c9b75
SHA1dfb87d517137db92d800f44efd1775ea865a3990
SHA2567bd6c5a28d9ae8d3bcf2bf5326fe7adb1951a80f10e4b963a5a5f196a0751435
SHA512f379a05274f1ab6502b66b531a943aa89d2a3cd95ce5ec4a51f94cfab3238213fbac76aa6a04af22bc4c40dd57054b6d7fc26ba3083d4968b8c6f55544eb4f29
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b