Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
a97f6a8ffe309583a93f65fb7ed8e361_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a97f6a8ffe309583a93f65fb7ed8e361_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a97f6a8ffe309583a93f65fb7ed8e361_JaffaCakes118.html
-
Size
29KB
-
MD5
a97f6a8ffe309583a93f65fb7ed8e361
-
SHA1
e0e2d191d1d9b7b33362560863888d63695dadd5
-
SHA256
7283edc8c72701a8fc6daa65adfa47bc67069e05328ba830d46f0715420f6620
-
SHA512
57562605c41e68fc2adcc21f1e13d2328de342cd6c6240aa759d10b5ac754576c335779498716850755369e70cd21808d9e31e82890788efd645d10a0b6a6c6d
-
SSDEEP
192:uW7/b5nNfnQjxn5Q/wnQierNnOnQOkEnt8OnQTbnZnQSMCkAmH+OhgamdMZR9BLY:oQ/7Wt1xZ7BLP9QjfkiscgOV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63970601-2A43-11EF-A3F8-62949D229D16} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424527307" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2856 iexplore.exe 2856 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2116 2856 iexplore.exe 28 PID 2856 wrote to memory of 2116 2856 iexplore.exe 28 PID 2856 wrote to memory of 2116 2856 iexplore.exe 28 PID 2856 wrote to memory of 2116 2856 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a97f6a8ffe309583a93f65fb7ed8e361_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5703e84feaacfbb3b8ecd3daec2eff405
SHA19209688acb69c4d8483d4fc43312000f0bce7c60
SHA256556ddb593b0e1c523fc069abdc6b193e4a57cd0c84fa4b7562789408ffa84e48
SHA5121c333a11f4a53ce124be8c18da41e2a08265e4ab5606d9ab2947995aa9beee2b16b19892ff75daf836e8a055be17f5cd64d98092d640f468e51e80dc9197c179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a1e84d90ab73bca59b606e87e8963e7
SHA17f17d2c0247750245596c8f5fcdf69706949197e
SHA256c9ddc75c5cb9407b33cfc89e82c4c22ec9b394f4ec009aba7ab0555507328022
SHA512e6d9bd8917b3eb97e736e15e5a9e70f57008f94e01f397d35e0c99d28d52d61ef6119b82f6af4aa409822f9e9f6d6bf28523c3ecd0bc403cdce1813ea00e7f3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c36c481c1edb09c8d100fe9d6468094f
SHA16dedd8d98b91377d3cd13d72ce8af5c789f12e48
SHA256b95014ac1b64440a499798ecfd0e9163606cac621150a8763923564eef2a39ec
SHA51222e8a1a4d97fd95b1aae3b8348cabb94a43fedb43551b7e261cd1ddf21a0cc846d2db588bdc96db78467ebbd9d81c42103dea4ec296b036a6dfd311f71d11e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd8b05a98742f1b9b184e56abe69e003
SHA1b6a64f96ca2d100a988ac500f302fd9104298666
SHA256b3869e7ff2ebe991b43d79960e237f174c5eb4b98405529161344f84825ddfb1
SHA5123299d511ad54bee3fa20d187a69ebce30b6de0f016121e99736e8440d08494629453c391fdd77707ad761a86b27919c711713ee8840cd2fefa9fd1ef50d281d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506f086ea7d91901928ec1110989cedf4
SHA107f9e2bf79a16fcd406502c7f29c5c7ad82d43c1
SHA25627db991e7a9a1d90a9a419df1a69d42308e7169c713cfb16c9bc7b26e4de2073
SHA512caa535d7cd0b1c8ea44d2a41fede2a8ee08c4920a96645fc8e9572e63a54cf727b766ce470452f80b6f51cdb064efd938908c4eab75441302a80eca68ac8f6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59645d1ac2f0016c8ff56829a677800f4
SHA1da401ccb5caaa432aa9a89e85c8ad1483e221088
SHA2561e2f4efc3f18c2594f34c84793268ab04e07910702b156ac6ebcf5ec09755af6
SHA51253fb0b471b89760d9877d6bc30067cc24955d9c773522a11c20808a4442ab08b4a85f1314e0866b4f148bc030de3b34c2402048d53b9348798d93f263409aa98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9147295dded921eca5d49f3d3d99f4a
SHA139a7857ee33c43ef062e90de32c40875ba2434c4
SHA256f5de08a80e0c4e8986549ceb58b16f85d83034cc1acbce5b9c6fe3d08829689d
SHA512c4084be640cb777dfe84ad6da56359be624b062b9ef79d0667ade0fdc7e408ab1e8a7a78e9d6c9ea963c6ce4bbc833bf15c28619456e638044846d28e5229d39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513daa8072b78c5e97a297a7b3cea89d4
SHA1db32a3048fd5a8bdd3fe26669605bbf804a6de8b
SHA256b9b2b9478a6087e4dfc733d55ecb370e8cbe38a72b8d17724d59d0b7a987b278
SHA5120c7d882503603431f9171c82063979f528c96c2a93df92ef3f7f6fef8a717c6238387e8f23138e098f695a98f4196feffd6c34966dfef6a0447b1fe715ce4234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f82bcb690645131dd11e89b03dc861f6
SHA170c35562ab8c4b190dba6dcd91095a9da485a3c2
SHA25680c1cd14eb96b25a45d4ea446d1a2480d9d2244c2eca618aa763f341557cb211
SHA5124a77d29d385d67040c49b7cccc6128ad394c007007b3e1da3871d491b034dda4265fdbbcd821e5dd0bbcde5a9688b3e3347ad514bf5c5ff19dc40342bf798166
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b