Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
afd9ac66e80603febf8d899f10d90a4b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
afd9ac66e80603febf8d899f10d90a4b_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
afd9ac66e80603febf8d899f10d90a4b_JaffaCakes118.html
-
Size
18KB
-
MD5
afd9ac66e80603febf8d899f10d90a4b
-
SHA1
d5650d0684687f00d55230f24c185f04d2151afa
-
SHA256
165c47f52896d2969617b3e11db1857b907f994c62108a22175f6e45926ef995
-
SHA512
b765385f3ecbc7661cddf05b8d47247d84a62e799899d074d62afb99e704720909fbb453399411fde0bf396139a045f587ce7efb6e41a9940e376d48264188fe
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoA8V47zUnjBh1P82qDB8:SIMd0I5nvHhsv1UxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C283E981-2B47-11EF-9E46-6ACBDECABE1A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424639138" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 3016 1992 iexplore.exe 28 PID 1992 wrote to memory of 3016 1992 iexplore.exe 28 PID 1992 wrote to memory of 3016 1992 iexplore.exe 28 PID 1992 wrote to memory of 3016 1992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afd9ac66e80603febf8d899f10d90a4b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52647d74d44a0637aa3f9ac48699598cb
SHA1eff6e3f2ac00ff7633d5dfb35e36e948b3420895
SHA256c4b5ed9796ad89645c0b41111e82b1cdb0776a5835d6fb58547e7e6a269a29ca
SHA512095025153de271a82d298b310338428b2943eae02c3bddf0e4afb82145552ae6ece4a501581c4477b5689982b6eacf2d5c36e67aac76ce5cb1d837d1c3b78f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c0437c650534b03d05359c3c3d23c3e
SHA1c375cd23d023cbc306ffac104faefdbdde946276
SHA256828fe637e853e8c9c35f05ddd39930f5d3859a115e6d2296ee840a7e2d3a3e96
SHA512684a71d4b20355231d3f90726a4dbc4d3a0ca433c56d978bc3504b56029db09a438e3ea5fba08c76ac09905898a5cb92528e92940afcf97f922b2063fb76a063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc6224b2a6f279fc51e07e9f9d6fbd83
SHA11762406fe3a5caf7c7fe6b06f4ca61f25040c6fe
SHA25679d51931be5a5fc13be63caa9245ca315ad751a95686548c4689e3978d7d4a12
SHA5129c55934e57b45bc1f220b0e87245c470a89b1197014ae1b20a2361bb70a99098a8268153916fbd98f7516a3a61a01237b6e7dd4beb7241d374ca757878878022
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5566fd98ec8f5d11758eb746ed9480434
SHA1325868fb71a502c35b6488acdce25bab2c5a6f12
SHA2562b2b4bbaf2141ad752ad6899a9da844d23d7d1aa5168d49850b65b4e6d49b856
SHA5122587b801b5f7c3edfe5439a2793b80caf7a9473efee06a21e0643e88d72b55cf64bf386392bb244c13565cd3deeb994983d6ca04f9316ce61963e4be4e9702a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d02ea35dab6df4104db84b9a5917393
SHA14c0ffa405190f63a1c304095d99251a9bbad1577
SHA2564b4f929be9c131305dbbd87c708d8f578482da66b264a822137007949830efbf
SHA5125d02a53da3c2367b4558c0de61bc5d1b160f26efc455dd1bd3eb207db95e04dfe219272af831430d0ceafaf701468d01497d6e22844a4200ec58d53e185e450c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5772deb03c00929986f8ad93f12f01261
SHA1bcfc49c8b2f121ab259294f030283e1d60b13fcc
SHA256c1626abd7aaef5f3d3f87374da78bb6283a55de2c115873faed6234ef05ef394
SHA5125ab6afeaff96151892938c36cfde1350b6bdb0502ba4921ae17953878f82cefc7c99cf18fb6efa34d4357c456fcc576c7fc391792105f1933c770afeca884d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5209d95d93f7977826662e2133ae64379
SHA1a85afbe391681f8d901a6f5eb96ca49f177dc084
SHA256b8d8d238b319434901215f85e230c4c1a38bbe42a0cfee5dab7ce7eae70d4577
SHA5126c2e3b8e52d88eae9f6a12a7fa75ce76abc5732810193d24916adc07384b26cb92cb965f77baf8de120f17f3a7b914672975d0592c1922ff3be644b636c6e0da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5256959c760dc3e7a99a1debd78a44988
SHA10bbbd7f771f631a056b21678aae0cf9d11833859
SHA256e509a9f54c55864258373af1a87f6148412885d825b365cf7294ed643de905d2
SHA512ec34972e23c1c5efc82438ff5711cf331f8b4ade73b1fd4506fa57d4d62ead933d429c8e9eefe30fd2a472a36e314caf06f8eb638ede18bcf9c85978261c51e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5077618713e9700e13ef5267ea2c414ce
SHA1607b09339758247d881e177a757b8a1953e90c81
SHA25658cad13d0adf8da05439ac19ae8ee96e0a605480205c7c0e8836c95ed507549e
SHA512ca1cc4bc47e895de136c652bc7b2508926b271524ae51f0323f64bd0cbb89d32b22a693aabab76139afce07c45f622beb3a372dfd2ddffcceb6f76d31a15cc5d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b