Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
95b44707bed74923913188ae61308498_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
95b44707bed74923913188ae61308498_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
95b44707bed74923913188ae61308498_JaffaCakes118.html
-
Size
23KB
-
MD5
95b44707bed74923913188ae61308498
-
SHA1
74bcfb939862a821d9fab23b2b44d179b49f960b
-
SHA256
31965f6ff349bd1a12e577e12d84b784956134b1ecbedcb880e8a84290b99980
-
SHA512
b88ef8f08b911e73c1ef878631e0323b6767661afe8b890eafcc67b82076504bef59e41dc0bb5df4270f0f286a35876a010e4dcb20e27d9c4be98127be646f9d
-
SSDEEP
192:uWD4b5n9enQjxn5Q/ABnQierNnenQOkEntsmnQTbnhnQFCnQtbwMBLqnYnQ7tnYm:4Q/e9/e
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423684367" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C42B34D1-2298-11EF-9371-CAFA5A0A62FD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2500 2088 iexplore.exe 28 PID 2088 wrote to memory of 2500 2088 iexplore.exe 28 PID 2088 wrote to memory of 2500 2088 iexplore.exe 28 PID 2088 wrote to memory of 2500 2088 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95b44707bed74923913188ae61308498_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581076d92f42b07e1c5ef457f6cd3d8cc
SHA1431ca5e45333488b4d247e7606b5fd9b43e0436b
SHA256eb381aae7a23c75f9950fc0d68a8199c18d5988f1c19dda9809d46e179e0b059
SHA51227f8a3dd33e2a914e4fb9eb1921b63bc707fa3f4504966de41051f0d62d9086f52fcfdec5be0829ddcb714d60b607f9824a7ad136f7e337efb71e696f14ba1d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe84a8c558e5aed20cd57740efd8738c
SHA15df8d4de53b2e5aea16e48bc3ffb8c4660ada70d
SHA25613167903c798a686e9aab8f6025d77c5872539b2c2b78d19f466f96b4b3956bd
SHA512d2a3536040bf0a3fa7581f00afab10a9d63b7a85e2770e397a3c41572cdc0987a3404feaec90a9f8635ac3844b004cf7b0f7db4b0c442fee863892481163bf0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529fadbd6928b184cd1446935c0ba2a3a
SHA1128b5f246964f61b00ec038839d489326d064450
SHA2563ebd5d140f6f5e4d86297a2e3218c96747980e9824f8aa9541485dd68afd99b9
SHA512499525341c395c81fd1ce7080624fc4632f74fe58a4321a5fccacd0b3de7089aac262fc6179d44d7ce595654fa6e1be282110a8f68d3f4d750ebe81077cf754d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a434048f632c330d2a5b9c2b48048e46
SHA188ac51d3864bf3842fb217b07e05d420251e063e
SHA2562a19bf91ce4250ffd2edf60d7d78752a43e0432c0a196d2178f2e29f9934a5f1
SHA5126a5b00a3e6cb2104acff99c8b38d504717c3f7627675d34c3b2abea43aaf76e32e5d815d7715ae6c85e9f36474d92b70ab74f3bbe42bc75bec98a178be23ffed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa369e79ab6d2088bbeb4a925dea082c
SHA14b742013ab056703e174f82c53db2149a54461a2
SHA25606fd215246a6f37a14ed809f33491a1451d3e3506a4e8f29384881bfa56b06c1
SHA51258825ae6629d0c71f62c9a9392b687cd8a409ebc77e6b42cbaf9320c5c7dba8388f1e55b781590f7a528dc8f615f89c4e7ea35cfa25cef5db4652faeba7f68ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bdc7edff8bc9f3d47c391896f4bb166
SHA114a95395f2f326d051ec6f85874b4f8690a5a285
SHA2569f5a60bfabc1525bfabd25f7ad9abd89e54b39bed6b92b48fad71cd025c41722
SHA512ee5aeb45b2e2b4075312ea42bbd31466fc4a0f7b85fef40e591162a7c40e9bbb3a4b2bde05f1289bf3f17efb726a19aa059bc7f304037d99d712c0a4b8b53d02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b4dc77efd9ab68df4908615abaff8b3
SHA1f422564ad871dbc14b7a29e4bf0be675a67cab13
SHA256c41445bde954f0f00e626c660df71fbad004282450baad896be26ec4880f6ffb
SHA512cf3e64e0529d64424de85883be7ac0b2a188183659628d679d4196ec15d51fcc984ddfe4261f66f1c42a0c2a9015a261946f6d795566ba3bc5edb2882167305d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5398251fdc47f626be78a8ce44e5209ae
SHA1817b27edc541383dc006ff243788be3b604442b7
SHA256dbcbd0d6830989ebf2e35087559b5bc5be4924317302630acabb79cc525a3bc2
SHA51249c6bd71a25b5806426ce71b96bbe71801950d4a6d609ceca22ee113ec7b9ff3425dfbc7731e04af5eaf6e1acce04d3fcfa67783d63e2b2a36ef78596ef773a3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b