Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
a42ecedb5ac860d8b67785524c193ddb_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a42ecedb5ac860d8b67785524c193ddb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
a42ecedb5ac860d8b67785524c193ddb_JaffaCakes118.html
-
Size
2KB
-
MD5
a42ecedb5ac860d8b67785524c193ddb
-
SHA1
743cb095a0c1bf3c7ec389a4d9907208987cb6cd
-
SHA256
15e0f41c940e1047ef4697f1cb1be1ef8bb3004c2a8c05c7884dd241abb7a887
-
SHA512
605a1de0b49395209da93cbf44dcf255425bc299f333478f780be3425d54f9e86ba3e2474826fd2af6a92bd19d055894076bd11a02af9e55993dde480292238c
Malware Config
Signatures
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 00382b305abdda01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424421667" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D3FEFB1-294D-11EF-BCFF-D2952450F783} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2228 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2228 iexplore.exe 2228 iexplore.exe 1900 IEXPLORE.EXE 1900 IEXPLORE.EXE 1900 IEXPLORE.EXE 1900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1900 2228 iexplore.exe 28 PID 2228 wrote to memory of 1900 2228 iexplore.exe 28 PID 2228 wrote to memory of 1900 2228 iexplore.exe 28 PID 2228 wrote to memory of 1900 2228 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a42ecedb5ac860d8b67785524c193ddb_JaffaCakes118.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b90a45b6ae0293112aa5e8e28569d28
SHA161febadf6325d63a329b0aaa01e3778956e508cb
SHA256adfb617bb871185804101293e8989942b766cd4ebdec887c886d83bbe794279c
SHA512f316b8c30a125d369ac16846f889dc7f741ea1de944623e22225c11c6f3f98f195ca4d9ba93a37836656962ae35c988b2607448a8b6732d1e3c5be5ce3934426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd51088f3b2fb0db18d7e1f6a94fc74e
SHA147d7f2883b0d0d9569a26e5335cb78ad338bd4cd
SHA256d0f5eb786d18115242ae66a2c78ea7eea3a7670b6770cabfcd6c76bec7840fd3
SHA5126b30785e095d569bb8f60dbfb1361921d80c16833c25309f4953d72ec761ce33c8b3f3ff9db2a1f39dbd0cf20b9ccadd6264a3ad84b9713b1de4e7f59b4add2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59844291d3bdeb942d7ebfb9fa3e87f7f
SHA191c1f13a0919b5bb5469a988e0641e20b1a91bdd
SHA256bbed4a53f79794ddfa588de07baa143b90302da606db38ca664a1629d7a1e363
SHA5122151a32d5c08affd1894d5bb93c1bb78ed1432752fba66f02896b9f42934ceef7dc386d01162af78bac1bf2aa0d9fd5c2e1ae38b0420b7e71947ef842f6df7ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5432a2bb567b5457c30495bb21ae9e6a0
SHA1d99a44ca7c60ccdddcbefe61a3bf49514d3299c4
SHA2560a15744a98b17164ea58c38df62c423e0a2f69507e0cfa9b3d296364672cf294
SHA512937f55f2f61d2822c3fd543c79ff6577109ec7e8db2923d85f0400ab5dbd08ccef2f50ed338e71b68e5c6c0ba11e814950c3bbdeeea5a87928f515974e2b565a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc5ba9817a776b3ece0997fde3247fc8
SHA1e24797465a202be9aaef0f5c48ff3f3a86fd9286
SHA256f2a7add72c8e87fc50b627ff415cf53b6bc6810f9d813096be99a1d28197a7fa
SHA5121d67ab5c569ff55543830ce7fe261860d0dc71dcce75cfa1e72538a6bb90cdbf6e966487525e70878cd4be5a0384e6d3fd9c2b4e39b1a883e8902847ff4519d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5825a196d7af47f49906459739d516cfc
SHA17fbcb0ab221198ff2fe5eaa6b2790cdd448ce597
SHA256fae5c261b72bd8d49e1ac69a76bb629ac407e60ed1e1ab5262127146c09f0065
SHA512cb86dbe60ca31598308f29d0080d62db4934ed23f27fa2ae0d6b98eb13211293912a07692904a2013222b9572bccd9fa14001dca784f12ea5b37882ededdeb0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2d543b0cc4fa90123a676c81266141d
SHA1119b95a385343bb327e5ae29a3a514ecf426e712
SHA256dbc1446e6937e2e6009b448122a1716cc1c217812b8b20dadb1f7668ec3d4000
SHA5127ec01a1cca79a275699edd6a079137aaf05b363a20a7a3a6f4a28b4dfc464cfc7aed22bf0423f69d5c585e2d8af690b3b6b53a37967a32a32d88ae63020f90b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a13f48b8342edf0c1ea70d4cafe95662
SHA1305dc0ededa00006422874942b975db127aca3a2
SHA2566d5f0358396a7bf2179afd091cb86856de8daf410c5cf9579b56d4532fbbd1ac
SHA5120afcdc3309214e8f7a3fdf01a5d835647d1ac7ee9bd7b20b3df26dbbc15187ec4e7678f3249bbb9fb5db72c79117099ad6ea653120392b37ee458d8015750149
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db8507a73d29243f60c47ee75d3b1cc1
SHA1eeacae57c5b1e85270e23f1c0327f19a390f2eb9
SHA256e43a9e0b1e7e7aeaac7d7627ec5d1d3f020fc959e27df323ddb7bc9104b9fe32
SHA5126f6114a46b28f33234a4102c895f5019f689bc6704588ba4debc4360ea049f12a254a0e2dd59c8b76a1ee73624f0dd732d4d660ca40715c4ed4e7e458e88017d
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b