Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
a0fa7214274d04fc62dbb8f14455e4d4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0fa7214274d04fc62dbb8f14455e4d4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
a0fa7214274d04fc62dbb8f14455e4d4_JaffaCakes118.html
-
Size
32KB
-
MD5
a0fa7214274d04fc62dbb8f14455e4d4
-
SHA1
9001630642cf0bc7663274471a18d079f78f2b67
-
SHA256
89253f3e81e24e4fab05abe69187fca18e844cd1a20a817bb80240860350390e
-
SHA512
78fac595e2aad09cf73d44b4adff72de9d5f161c6b70782f9d3716614ca3d787fe97f65497045df9b05b76601468845c180eecc89aa6e605fe7190e95d68bc0f
-
SSDEEP
768:Z4dQM3CD022C14LJm5hm1WmMDbb3qs3rVS4sx3e8yW:Z4p3U01Y4Nm5hm1WmMDX3qsU4s9e8yW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424363938" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04072211-28C7-11EF-92D3-66DD11CD6629} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2916 1976 iexplore.exe 28 PID 1976 wrote to memory of 2916 1976 iexplore.exe 28 PID 1976 wrote to memory of 2916 1976 iexplore.exe 28 PID 1976 wrote to memory of 2916 1976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0fa7214274d04fc62dbb8f14455e4d4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5325d3d2a7686ac3fbb98988c504ebf59
SHA18106a3867a8cff51986ac7bae36dc27918369dae
SHA2569782280fd9b1711fd3ceeacbf2c06be453eefb43dadabda7a262793d7e4acdf4
SHA51200f580fe47ed9cf971843b4348cda24f2399e272fbb3eb71983632a82ff845ad737c499a80781101a49da027484084343e1fca82ca8ee39037be29643d190b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553295e5bd2cfc45a4638676c8723384b
SHA181aa648ce1cee30e36c98cb2b17edea61f1c08ba
SHA25688d6f489e535fe1cbd56e8e94e3be2bdf3f48012cb4f281168f85dc3cf26a328
SHA512f5c0f2b1cb7454f80fab9615e1e2595f6c187477b89b91a9a2cf6230873975d6a156fc15c5ed62f03a580e7b7f3716b9f861858b7c1970fe009aa5665b915f21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da79a29dbbb5cefb0673cf211fe25a0d
SHA1553bdeac8630ff011f1e7d9fc4ec9f7dbac2f84e
SHA2564f319c6fb76d78c9b9db5ffd1abe32fb920e89859a35fa80554b65f5d3c940a8
SHA512e05ac55a544ecda3f49ade13c222305e454c637826276e7264c5236dc24ed2f3866fd37009fc196301ad3bcb716e553ef5ccca08d845a9a6559b02191c7ec179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf16571ec025f4e9a8742bc4b7f25a2
SHA1e52c1f624ff5f7dfbee3f14fb72c8f973c34a0f1
SHA2560dd79262dc59b94abdaf8ad0aef98a49a5744b219d1dea5a70a973dbd42c83a6
SHA512e068018d1045c6653bb1d2e4dc73f12387b589e15218f42a60aa39d6c04c975a9147895d9761b9520c0f7d43656695fcab1e7701e72fc9c76644cd33c0b70f03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c54ea5e249fd912d881b94c7df4ffe51
SHA1a9b2fcd08a7a56857354d4bce55577f3a2be6e6c
SHA256eb1c074852d414e6dd46d18d376b3b2a1f074d9ce7e20e4cc7946a8348c9df84
SHA512cf11337a6478410ab297082da596d679293cd06aeeb48e3fd3bd9a38a73ab2a0d7a452937527285376491e9693bd5bd125d5dd74a67d4da9cfb0a15a651f8b72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590bad06851af4c68eeba7a8be73b6aaa
SHA1734d8ad839021dbcf899218ba5c7067aa9958fc9
SHA256253e6186162b81d355d5242a87939245f85ec89bb0d31355f33313e98f918623
SHA51217f3f72733108268420342b990aef52999013c94a74410ad53224dafa4bcf4cea9b8cc007e3bcaa5ab83a0bc9fa6ec0c030827831d4833a0c516eb9b9c1c0242
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b3b3e38e5ef4c8fdca67371a98cc6de
SHA15f964d60f9c6141220963d6e3c0e7a420c4d5a0d
SHA2568c79fb5b405b4011b542f783f97eae5f72a3b2ac74d7ca50f87bdc060faf49c3
SHA512f7e5740851f8819e0ba4e500a694d3206c8826ba70421d28157f0f186c02711e9c3e289186154c77b950f661ae16b9018e6dd60759204290573503ff2674930b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad4a89f2df98106118cea533e4b20514
SHA1c89cc6a94d21b7da78ac65d45ddfce8ca5644d4e
SHA256ba124ef8cd4af77f19d480753f72c0eac2baa784a3719cb67c45c4a94efafef7
SHA5126a807878f1be2c04b1772debf0a09d635f5018af74c111ea73de3e1625db23f2246a0ffe8ef8cedee77762523106145ed11f3321ec9a9f97682b98c096d3d2d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0ebf4e44a8ee1b5992f3cfcda83e087
SHA1c9c62bf648bae59f80539542b2d5dd21cc65dfb7
SHA25677dc9ad301d866daec4be0a85d603a8d0ad91daed50b852a57055af20028253a
SHA5128ebbf78dec5ef2d7eea4cc26ccee9a328e088a03ad628447510149e880f457e7396440ec891e38623c39ba84477432f352f60704107331a2e0acc42a9e5fbaa3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b