Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
97febf5848929cd069e3abe21bea0a0e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
97febf5848929cd069e3abe21bea0a0e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
97febf5848929cd069e3abe21bea0a0e_JaffaCakes118.html
-
Size
128KB
-
MD5
97febf5848929cd069e3abe21bea0a0e
-
SHA1
94c0d3442070b7586790193b94fd14d131f1cd45
-
SHA256
fba0ecba51af159af1d7458b0e584699324f6ae4362b366d3e8e7eb529894b8e
-
SHA512
5f566dea0330845523c45de16454e0f62cb197e1b23a53fca127d2b107361d9b84996c8acab5a88d821ef280c21d35ab81698f6bb885c3dba98c64d1305d6bc6
-
SSDEEP
384:SIXDeSyQnglC7uJikfc4yHnT/IzifrGioKLLFvoEuDIVlF:ScKSqIuJisc9wy1bblF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423748461" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE7A40A1-232D-11EF-9F01-52C7B7C5B073} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2804 iexplore.exe 2804 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2896 2804 iexplore.exe 28 PID 2804 wrote to memory of 2896 2804 iexplore.exe 28 PID 2804 wrote to memory of 2896 2804 iexplore.exe 28 PID 2804 wrote to memory of 2896 2804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\97febf5848929cd069e3abe21bea0a0e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea866b310d33585593fb01350316061d
SHA1538e87bcf65ea60207ae02a44ad02079539d9e2d
SHA256f240b0cf380a125d6b1a673f3e4941690b625344c16a7a650fe25d6a5ca6c4dc
SHA512bad3b42602b748b5180e57e37410189ba0bc55112df83590acc8b9f3d3017b2a770ecec7fb58310485415ad33e055d28deab3e11e0e330e4950b34227b376e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570aa1a33d589d5031522c61bfe611adf
SHA10b8a63658219b5cfb50d2076708fc28680584e7b
SHA256a62d11f3017bc72d1cd0f148a12f4d0e0d65007ee2eefa4f44edca1fd8886c96
SHA512c3cd92ec4e8fcb76c9111445364d1cf7000569eea6dee282fa7e5c59a30ee184783b06e006c05cca95226df85d9578d35c9dcd30a3516d71988b1f2d5eb9148f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cabbad68ce5c237c7be72f2c9ceb698
SHA1a698e111c20bfe45022779dd52e7d9b3d1544cbc
SHA256a6d297aa4c9e991206decee2d69e21485f829186b50a3672fe9d125a4bd603b3
SHA512ea0ff203d71c4aedf514975ca24de570a037ced2b321c223423a2ba0368b413d221d7fdbe8646477c41ea41323c7e4972946c8f83598af8231519e7ea282ba7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5406f92cb13006e59903fdcbf74ff3d80
SHA1cdf9c0fd279c961aae7696eb373c48a51180fade
SHA25686add8088223441617bbc539b764db5475066bafcfe2d7d81e97805553fdef67
SHA5125a74311338c50091a7d8524231e22d4be079d490df417a1b1e602a1127577595f5cca9b80e661be4a5c06ae9bcb690a3be04ca573677e30aefa043788e4cc233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c58c2fbb7b8a5cdb188ab4ac2ee1fbc2
SHA1586a931eba5a3fcaee1017ff480f753e11565a40
SHA256b624657514d1b236a0ad100039b3245c34aff39c1ddddd6e7fad6192a0651360
SHA51284a1c6885d9b7b36bc0d9f5be28267b0bf492aa7ae06637d97d8ea7fdbbc7c60aab7eb0d76743ed9b83293b8df95060702b0a9cca0087c1d3ad308fcf643ee8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0ea01d4cc549fdfe502748766b2880f
SHA10ca589f2cfef5d787dba43971b2b5430423be17c
SHA2567be03223c403ac20f67c51062c003485bb0826eaa1a991effd144ee207840a55
SHA512583e883d90f1ab60494cb617be153d76efd4d448c1b45ef079190f5864b6fa83ab62e231896b0dc7db789f2acbf90edb9f8c88dd83bc25359af5e60a2134cd3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587b25496f75c0f64ceb3ab8736f8c867
SHA110737b8252ffff36bf0cb3ff16c7dd301cb74301
SHA256ac336f5f7624228d4a92d5a18136720433e4f98d64a5cd0c1be3e5ac9b9ceeb4
SHA5128f7955dfa5a9dd48301be6ffe924804056ab476e74a7e5479106144d8631796b6109fddc9ee8a837c96ec131e2f839a09b0783bdf015a694d4e7926b29ff9e35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e10ee49743c36e3c1d70f06438423d8e
SHA19fb61b93d41860ed9637f323e881406f29ab0b52
SHA256ed7d90c9c6ef98ce7bb761130267a1801a12941756fcb464a43185fafd4fa230
SHA51274d38105ed499c06f6487a850ac9cc94d56e32754bfa4f1881311a38a33c84b9f9725a1e02122708cfe8e33a153dc5b54488fbfcc326b6f6dca0d5e6e3ff2951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5306243386045feabb53316879327572d
SHA1e0ec4827c09b3d3a90c4d82c32a82e36dc451f08
SHA256964dfec7f8e16d677928bb99b2ff99113d2349c574eb642181f012e5385a9d6f
SHA51231ab24ac3e70b02fc5d0e59f8b4493a9a0cd57364c08067476989e51266753b53ab4f7968a0c2e46016209f4b820e825962bc0ed07cef9fc1a35aa8a7dd88299
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b