Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
a0b498e9561e08de732f59487e9bf05e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0b498e9561e08de732f59487e9bf05e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a0b498e9561e08de732f59487e9bf05e_JaffaCakes118.html
-
Size
36KB
-
MD5
a0b498e9561e08de732f59487e9bf05e
-
SHA1
22a864ce39e94aaf0014dbd7ddc43a688fba0f73
-
SHA256
1c70b8db998cac9783778612b9acc990162a5b477d17d9ebd1e6075c4e555519
-
SHA512
3bb33ecbef74b106192b3262e31990589e633a64016be0c0f72805bec1ff5f2e8089dd56db7d3f9f2461432f61dbb12db465fb56e18e8c4e411f5ba8a9ccf193
-
SSDEEP
768:LKHpKWktqFCPHmAIASmVTx43N/YWKQieoZA7JCktQ7VB:LKHpKWktqUPvdpBxUNwWPieoZA7JCktS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25FF2651-28B9-11EF-A38F-E61A8C993A67} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424357982" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2356 1704 iexplore.exe 28 PID 1704 wrote to memory of 2356 1704 iexplore.exe 28 PID 1704 wrote to memory of 2356 1704 iexplore.exe 28 PID 1704 wrote to memory of 2356 1704 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0b498e9561e08de732f59487e9bf05e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569f4e972f75e441bd152311691a007d3
SHA10d7df5b52b18871d8289b3979a7a0c1a8e8dfad2
SHA25622f9b9f454b056e79cd2c8285d7b0ad174648da6370244d1df403ac135d2c896
SHA5124dc1fb126a66ced553a14d30e0a26ee283ff0e8f47ca97bf9d1923ed5b6c5851da1b1fd5f6dda11a58f6be92a823062de96eec833b0df0be9d72de05596649d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0071fe2a25c262e0788d65e45ef4c2f
SHA112ef3aa67befbd263eca4838ec7771d79a36b929
SHA2566b2c92d22fe5bc4a8ed3c3ecc1e712b6c25b7fbc61ca32482c3adce86d62d065
SHA5127f029bb266051d445ce19ad02e98fedfda5c580d1cc81194f7992b2a9f8d83324efd6e500cdd79b20c190a726fc83f70b2c215e3d899fc17515d037d1df44f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5502a0a921808bccb09294c610cb49ad9
SHA1fcbdc97fb3fd5a55b34aed615c8be6369540a611
SHA256d419c8aade4daceccdf589bd31170833505256bf2b2cdb59dcdf776f9098b8ff
SHA512bdb0228590099c5d22266667c949d173ba18548dea356f0667aa91cb009faf02e3e429fca64617bd6bb4ad1a0dce97fabcff646a796b5feca585b0d95f61d2e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58588e89d7568b86941b9253ff550a441
SHA124ded271f0166030eb00c3378745a802e8f2e19b
SHA256a45e8549515bb810f968df05a4592238fbf24ebbfc8ed6793a65144e1ea91704
SHA5129b689fac7b7b187d4626de7c36a933bd3727f8f2d6bec677a6e5afd6d115c4989a42ee87c9016cad6570954e097c2206b4588f8166e61df70ba51b8ef9b2b0e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ef3495d79320c1e07080cd2f52cf2f7
SHA15dd94b0f68f2b91d2d1a6b11587863a41da9011e
SHA256a6451eda71fa58149900325c1263e02a88c827ec1d5a2843f8647e8e6cb9bbd2
SHA512cda0619b2ee0c7e24b231b1b9dfb3eaebf023530ea59f7fb6460f17cd2c5457cf48599c540c8308ae52c1e5b8cbb4879fb96d317e6270f0e509f21ffc3508f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cff28976f76a4e8939edb22ffa5fa82
SHA1a1f15baad620d78993b21ce09eefb8842b4bb9c9
SHA25620151b31226faa73a316f5cf7a15b59b9e98276ee7aeae2d00a156cacf4ee78d
SHA5121875390a7ef0826d78a84a026422e3f65cbfb6c1c24392f748ca22e565ab9697446e4103ae0bf649b11cd95e7fb0135f0889343121923c188da9e59d048641ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500801919b6fd14a8fd91470b85a2b0c9
SHA110bc1ba3f5d20d92818f9664b0259b4ff9f7ba5f
SHA256eb0e001c187697e9a28d8534f0b6b76bdaa108d84dac90e5b87da131865d1f88
SHA512ccbc878c4e530775cf5d46c462d65adc512f629971b59f072834925e0fd898b6c06677880ee6a42975aec76b0d706f51c9ffe6bb98c58da2293a23ffe4873a8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ba61b92309bac4324369ef82a8b4677
SHA1d3af1197cb731672f552de5bfdd06b07e84284db
SHA256463105009c71e060f5b443fca55300e394515e191a2831b23c10ac8212e61109
SHA512c90a913bf1353e4630aef380799835f1316a129a6d323a8721bc1c00bba7652fc31f8e4c06d8f7bc77c3f5c6ff3ff464722939f9b90f3d73ece17b6777bb1784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5996ac8f38416eecc297da40ad32d39c0
SHA1aad2722826989563cb0174fef8db3d3e41cf1c31
SHA2568aaa867eb21608a74afe8ef93fb90f958fd0c2bdfb2c351a4fea1220c6dfb1af
SHA512f04ed87a6a25c24547b5624e8b82e923f29f20b8278b0e47212042a2b1635f12e3c0851f6e6d5bac789668c53eca90cd375f9f27ac15cff8dbc2817abed56e87
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b