Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
ae55168f322942dd4c955d84c177e376_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ae55168f322942dd4c955d84c177e376_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ae55168f322942dd4c955d84c177e376_JaffaCakes118.html
-
Size
10KB
-
MD5
ae55168f322942dd4c955d84c177e376
-
SHA1
34a64f0810e9d0b2e8a5e42356d18e7a13554a6c
-
SHA256
a8a20425f6ac6fb9ddb90bc76fca48c324954c4ca3bea78005d7630f2b9f3244
-
SHA512
3cf7b0275495ad29c482f8802ebf46868b79c3c2e3d589d990c5bb84c783d9752b2d5966c7ea08104ac2de89c83ba49eb52c5ce70bca3cb06cbd73006a5d3b2b
-
SSDEEP
192:SIJfs/Pvwj2GMlysMhY8MU+i/coHoToVoSToTEZErL/DfhCYVd:SItUPoqGI3MhTMdGcoHoToVoSTogZEr7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E75B5E21-2B0E-11EF-9FEE-EA42E82B8F01} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424614716" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 2860 wrote to memory of 3024 2860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae55168f322942dd4c955d84c177e376_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fbd63dcb3aca8bb564454733c4b50d7
SHA1db5a5aa27cf84d811869abb318da03cdcf727952
SHA256c41107559b4223cd661d8f155dda9b7677a9821a0d6e13d8742e6c3c9ca29292
SHA5120d4ddcf68cf886d060aa83bb224ce4fde9212d2f6530b16d5344fb3f64879718e7913c47f673c0edeffd7e85d5518b6d0c6fea30d5d09095bcf1b4e462c09fd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5237d34aa0045dcd9146150b381dfd873
SHA1f7abd5c7897c750bdd4355a1bc572f7e57cda756
SHA256d06b70d85e52c9084cbc5e45aa785156545f8f8bffb74f54157b2ab5a9f2c2bf
SHA512dd6892bb104c14437338147fd6842182e050855981a6a7d2295d3adb7d293bd703915ded67f54819c22cf7a0318518723820a141206320694120e83d2c73c91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593cdb55e3dda59a93e082b8a4e605e70
SHA1fa6adc1d915516b7eeb8fda9f6ecc439388b7a42
SHA256c7eca305e01104db00e353ac6d2dd248cd2cff2b307fe547c65daf55fc14b897
SHA5121458e456ec5de9f88a877a626291c02cf18db79840f3e1e9d52aa884d449a7572fb8bc08e2b9d5d0e4b0b19cd8818e0aedadda5d927ef34ef14bbf605b600d9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de59942cb3e7df0c26552bc6aaf6b4eb
SHA1ae39394ca2fc5add5b3248d298ea10cc418a25ce
SHA256d6d67bb48462516f2668377c53260d76b267b1ee780bf33906697792805e27e1
SHA512bbfd99493fe7251db4347f68479a5180a61fec809833197800bd48ffae66dc83a4491d949198293e0fbfc9b9145ded30bca8ad90ce2814ec79ae5389e8bfac1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d78d2d6e7689bad35cce10b30851248
SHA1574565d74ebefa7d1a7d10fe2549fe79f7e4dc90
SHA256b8aa5ee5bab6d23231e701006e1d265bc18c46a37f3a82b88999b274193dd18f
SHA51277245146c90abe24f076ffa2958ba8a46082cd2f98811233a8e7c3c5e48969f5d06afb71bbe15adb73a9c995608d953043137dc5aadbd4ca84a0cec8fa0af2b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5669ebcd2a97a9eb5dacebd17354c5914
SHA16731414a1e3c142620ea7a0a6be885219effa306
SHA2568a3f831019a796c6872798b34409e3dc35ebcae6f30093e48cdfdf1e36a250c3
SHA51255a1ffffa0166bc53126904f3175a59000a611815f9cac8d831cc137162606a322b0894b7d6b72cfc769feaaee93af63b31801fd3fcf9c170065a5430b857921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5706a36934e0c1057cd686081f6b6f885
SHA1cece01cb192ec9b35ce4628d852ee9e9d88773bb
SHA25623e39cbc85998bada4fa4eaba7cddb21a3138e5a86999c00f7fcd4a9ec9683cc
SHA512b2a0ffcfc8a2b6cb881e9fd56b651e4ff2eca563af7b4ded6b54d18957a9d0382af8449f798b8d0e8c5807d42c6034ca85b07a4cd05e00a4e9f84fb4581b1184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566f88996e636acba640799e8dd6dac59
SHA14772f080b9f8093f41184a93b2d5e7e568527d90
SHA25608a7ac802c0239aa65379cb87b6d1e2a65e63307d661471967298467349db720
SHA5123476949b30dce9d8d0a84ec1ad0cfdaae48e6e17ef35f4bb32b9dc69ef72c5e93975406dca8def7025723f53b16696a963cfc9c9890e15c6abb900fd351badf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576d62cb619197a1214236aac5c350a09
SHA10b496384d7cdaf386ed34516b16f3a23e12a5655
SHA2564204de4baf265ebcc8625a077f082cbaccf1f7620223fcf5b34f5838c9fb6b61
SHA512886a5e44494b2474e92c222abc675f53b037e8d3af1c1bbfc8d96c0b2859eceb6f47056e6bdeebfda14a246b009de6747e01d60136e51676a617b460d5f9a48d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b