Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
9ae3e52a6c77a462e9a69930ed8dc387_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9ae3e52a6c77a462e9a69930ed8dc387_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9ae3e52a6c77a462e9a69930ed8dc387_JaffaCakes118.html
-
Size
27KB
-
MD5
9ae3e52a6c77a462e9a69930ed8dc387
-
SHA1
226fb390ba3a67f5a5c4c0089a31c1f9f3555a40
-
SHA256
bb28af6c10549c66efe8f1edbddbb40c4425667828d79873e726ac447ae37a2b
-
SHA512
ff4304f9e60d727c2500520468c2b875effea0dbe430b3b05ac9425a1d0e45d2ca247272a8521e7561ddec02de3b724a102e32cf4fcb8f6e4cd33da034aa42dd
-
SSDEEP
192:uwPob5nR+nQjxn5Q/onQiejNnanQOkEntIenQTbnxnQ9e/7m6uvxbQl7MBDqnYns:4Q/0eNuxiSFWz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424189516" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8687501-2730-11EF-831B-46E11F8BECEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3036 iexplore.exe 3036 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2884 3036 iexplore.exe 28 PID 3036 wrote to memory of 2884 3036 iexplore.exe 28 PID 3036 wrote to memory of 2884 3036 iexplore.exe 28 PID 3036 wrote to memory of 2884 3036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9ae3e52a6c77a462e9a69930ed8dc387_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e495108b1247a9cabbe148047c750347
SHA1adf4036e2e79ffa05ebb94a699186d4d6a18723c
SHA25658bc7a537165ad39e7dfb3626ae1ead194bd09ad8a4904e9d120b3907fc945a8
SHA512375986ea2dd2b25c080a2af1dcb01c523f7800e45528bf46e82f7f283e123713e573e864ae76941b34be3169efe566b75e7b112b80b0137a2fd116499b274f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e297686faa4b857e75fa14866c68a871
SHA1e96ad05517174745adacd7fc8b522e8ffd26db2f
SHA256db9ee69c593e8d98d3f4ec216b6ca91eec47618e547f0b4f99f8c4d93e51ce9c
SHA5121a81456aa7751886fde61c10931b1164995858544f99478080caecce0dcf2c06bae407fb5c26100080c7f0f064048dea191a83ab0ba6789e61b15f098b2d605b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507761f137d1c5c3c54e30c12dffd7821
SHA1dfb0cd587c861688364805e8134596218f7aaf12
SHA256f33c672d8a4d405bb80eef430ad820663c20963a729c2a708769f3b667c671e5
SHA51245a2654a0dcd8c0401ffcca00c1786963d0ab70d2ed92d49405fdfeffad1a53288376f8241202289aaf054f2cbe5bc125f9ccc2b26f7a9f86feccc41d9a630ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530af13d8ce7aa600a173f14d9cbb8d5b
SHA13aa5afd9401932275cb1c233a8f5e1fc933713d2
SHA25673799c937399c69d3c0b0fbf42f67db308cd6e2064e66e9cd4daf6ff58a08c75
SHA5128e86a6e5c1c64e06959428ffe3a9260139c49604cf4a7015b33d96f43e63a10ae7464a2811b2571eb495bc00d325e990aedfd4517d7c3a90d3ffcbf27001c9bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd8a25d034e293d48885fdc92a498d98
SHA19b248c826b8dd83121c9314f6017245de788acc6
SHA256ef54931e286dd32d16c80afbe5e9bfd16d10843f06b6f7d22aba534b81590a28
SHA5123ba34f189f9539c70b6b7e7d870ee27ec7d479edea9669e0067d75f512a74690a8e9551a87fa44d9f9ed466153a37596f1c8cc867a0ff0bc44fe3c3bb487c0ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a9cf181b45ede74c91c24b65b9fdef2
SHA1218de35f5e4c5e5bb21360a8759e3344abae5a37
SHA25627bcc5ea58aba10fd618105c16d16a134b165d2c2c29e0add4cd3919dfb47f13
SHA5121e73dba4d9085979d4eeef8101235304c9aba8acec0dd82a0d4ded4589e0bbb7512989b115ea9eecb05e887c4b7825007c7acf8041b384030e7e63b2306572ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1c9d1f942ef91e21fe48810cf388641
SHA14153655f08c962a28836df0ecc726f9deecb116f
SHA2569d9a75413682ac592296c155f4e6e706f8bb7ac65c6788af3f1d3e0e316d8a20
SHA51230def18b4191b62ef294f790cf1216b57698a9b55c0f9d688294446ab20d01c93675b17a031c62b2c88abaf82cdece17cf1567489fce084ba20b455e3996660a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f626269a5f0c5bb0f3ee95cf538a8e71
SHA1e91866d9bcc6d3795dfb8851167693668f76e255
SHA25637ae9698b2b745c723e37e2fc93263d0bbb74d555b9ebc0edfa4aebde2ed1bf9
SHA5123413cc157345140d8b2417b0fc744f3ccc7072f576349b547ca854aacda0019bfdd4bd3bd7d97cd370170894f062d81673a4004bf93c3ca97c25ff6f13838417
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b