Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
a939c63f39d95bf6968986609a14cf02_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a939c63f39d95bf6968986609a14cf02_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a939c63f39d95bf6968986609a14cf02_JaffaCakes118.html
-
Size
23KB
-
MD5
a939c63f39d95bf6968986609a14cf02
-
SHA1
1bab69efd12c3be08983a1ceb95fc8c485508377
-
SHA256
11ea387b671759fd047ba2cb447f91980d62f470ce6eda50633e64a3619b076b
-
SHA512
dea06068f7a5cd06511ab198c97e9a55613632bf5ca7f6308fa68294252d711e5afb04507948ad85f8fb6bcc51b419c1b3bd0d1fd361299989df549db6d41363
-
SSDEEP
192:uWTkb5ndKnQjxn5Q/snQievNnynQOkEntc2nQTbndnQVCnQt/wMBPqnYnQ7tnIYV:QQ/69O
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424523285" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{064CC921-2A3A-11EF-92D3-66DD11CD6629} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2632 1460 iexplore.exe 28 PID 1460 wrote to memory of 2632 1460 iexplore.exe 28 PID 1460 wrote to memory of 2632 1460 iexplore.exe 28 PID 1460 wrote to memory of 2632 1460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a939c63f39d95bf6968986609a14cf02_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3c0f858902979c3f2b327741d43b902
SHA17727b993d69c79902ce99caa1b4c87e34baa0cd0
SHA25671a83ae22422aaf4d83c7d1121872480322d08003be6fd6bc7e4a74d554fe568
SHA512faa5a69a7bdf088b1ced2e3ad9a612521ddc904fe7543c6205a82a63eaa68b28c5ee2021069b3ef1e4d4aefd78640259985acb64574a9f9653b557e09aa44756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541604d6d18bd1cdfb1b8ebc3cd22bd31
SHA12dee326ece14e0f7b6d486c2232d2637809c38b4
SHA256aac8c67e2dc60d59c6b797b25a8fa4bfd4ea0f5c7617c1024bb53e311da58a2e
SHA51293440569a3c120270e2cc32f181eae6c6e2f94988aa204f614aa7dbaf7834fbb6ce86e5fa1dd956d9a3f91c9f8e4c7cd71be265605809b920a56c362ed51b392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5687785cc96e642dc379db375851475b7
SHA109a634328db76860d9e7594407674d7202d2bcbc
SHA2566f12e7a3de1dcc491236d646a49ce4a4f87c73d99f70172411f0a722b9118808
SHA512e208e2878bdfdeb6d78e2ec91f5e2fab5561e386a795d9a131c20b97e34fb02cca2cda0cd05d3b7f84b967151eed9d29b013f25ded6dfa92eeb434874fc43311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556dc2135a9bcb2d2f044607f157cadd8
SHA126898eff9cb85d0ddf7b56f5c2b3f663efda32b9
SHA2568bac8bea2d9982e8e6ffca77d04e994b6b0ba412b70df91cbfbe521c15717f99
SHA51207b61e8e4753ee4e4e3896f883ea0bd498b3626abf066e4e1f639efb9fdaae3259bdc8f251adabd9842b5badee50fcda058e1bff9f0829cd60c6282bc13f0353
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53db01f9f00e623dee7643754a7e89204
SHA122760c4841aa6c2163a1236f45ae2040f9870819
SHA2567cd42e6f32509772c5fda18ce14711b378d55dda253727a93653e69d33cf7cc7
SHA512b3830a8d851fff8114153316a71adaf6e9448b09dca6fb4845d1c749af45c64e16db501849dbf6d09f90b8b019715928eb46aa5d8e36593301306f73fb01d34d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515adbb4c421a776d00e9740a0587335c
SHA1943529ae147222c047679bb43a5820cd5042d5bc
SHA256f632aebac6b747117fc6e4dbb1a178d5f96b4de537c949a5f6a17e0d5fe91dae
SHA512fb99c9d38177665f93f8473a7786df1036d87a08c951c823dfba49845075553a373abafd17826e8f8861cb4c7a86d96b6333db2b8419e92aaf43b29448eb382f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58de611bbf060cb2f2863afa529539f05
SHA13dddf38333f061aa6a2c5eff42dd7297be466a77
SHA25635975028a70aa00b3d3484100e790b2533faa5c33b3c567aa9a5b7922c0a2b39
SHA5127b5c8e0ce27fa2c44b731fefb8f2fbd6812f38540d633964f5e7c0d825e6c578edba58f3a0ce3513ba573438e17bc5da1302473873fb87083111699d1ed88b04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559a8776af9a20daeb7697b9342d68b65
SHA1e2ecc329f41ec35842c85ab37008d5a85706d36b
SHA2566be2abc60e659e4bc8b5caa099065a5ff4a5a9aa49cd2f9e12599b4bd5711b97
SHA512e20dbf77f983b28fca9f1c2f30d15d9df738783b52f25ef30b0e317ca2c0f24be9621282ff1d222d43c126d5485b4f2f22cfb3207ee51388597bff026efcb00b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1a90afdf0fd867d4d2fcbaf8d62156f
SHA153ff5927a86c298c91764ffb09618b943fe94812
SHA256daff6c1b45d6f4ce8922f16974e7b64ef9cd4f188d140835b8550ff1f5977a62
SHA512d3e15cc9b2fcacaf4b36b9925067fe52f310ba9ee16322f9458ab2ba8db4c2c99a8756abbc6ea53923ccdf8ff504548d7961abb959218f0339c9fecae5d7d815
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b