Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
aff3a9131349dcc500bc88029a2dfea6_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
aff3a9131349dcc500bc88029a2dfea6_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
aff3a9131349dcc500bc88029a2dfea6_JaffaCakes118.html
-
Size
23KB
-
MD5
aff3a9131349dcc500bc88029a2dfea6
-
SHA1
7cb0df2090c47ff0c26400cd99ae1b10f437d171
-
SHA256
049cc964244fec4efcd32bff9b5d4d8db4d49a992cec622465e0f53cf5d331b4
-
SHA512
eb09b83d6f2a460658116b0ae737f22883ee18e6444aec3eea06159d53079f6a13a49988a64c12a81840c880c000a459a4e611cffe2bf2e0d979cea309ca92cf
-
SSDEEP
192:R2yoC9zLb5njLYPvcjsjsZTcnQjLntQ/VNnQieLnFunQOkrntN+nQTbnenQNnnwf:IyoezZQ/O9E
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424640965" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04FE0581-2B4C-11EF-882F-5E44E0CFDD1C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 3048 2916 iexplore.exe 28 PID 2916 wrote to memory of 3048 2916 iexplore.exe 28 PID 2916 wrote to memory of 3048 2916 iexplore.exe 28 PID 2916 wrote to memory of 3048 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aff3a9131349dcc500bc88029a2dfea6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52c7c1065bb504182ce0297bdc78c3fdd
SHA18c3ea7233b415a5666837fdcf7c7ebc1aeb5331b
SHA256f5829cf2c0f632ebb4050662a3125a5a86812894e5a22c6da88a854972f75526
SHA512fee67cf389b63c763a8ed5ac95e1cb6bd4887df12de993ac46d8148003d98a691a692f19dd2f5f756a4c41fa0f7cd2417e3526ba847bc0e5c98051e43e5e7d85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563af408f1b4a6991c1cd23b8e5ef4868
SHA1018713c4b349833be80a0c141adcd18c77d56211
SHA25657b69579a8272425e721d28f972cfc5d86670e2f5e55e139e482b3efc8c0572d
SHA51280d3083c8528cc60a95fcbdfa824fc15fcee56a93daa4f8b032fb1b8764eabbfb9d0def8b399abb7aa38db1abeaf1cda07ab4ad48d474819467064f9131a0f03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d185fd1beca0be8426a587a8e0a09c52
SHA157fa07e456406d91ac189bbe70e1087b07ae1bdf
SHA2565957d1ba598b6de1072641e1f2b008b742d0e3b3f13a7e63491113b0fc9c57e4
SHA5121035ecc69731c28349871b1671a89d104471a1b9d1bd6298716ee5061110faaede7cbce40feb512aa0925f0663dcee95482313ae0c58df24c5cb22e58286d6e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f47d9bca298b3b6aa158390fb324f0d1
SHA17597e9302dc6f0478a7ac78621d77b17ac4c5bcf
SHA256efad71975c0bb3354fb3f28d4844851d409f56eef2c7d9c02a2f92e1f278b4e8
SHA512d482f3e9565b50f7e3c7e9d3efedd1648a3c11c0c4c6af700bb0bf1b91b55fef060356fc6dd2cb022c019fc449ac64b40570581eef891701f20bb4dff1eaf34d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577ad303c7b7f8af18d4a1cd299420b80
SHA112e63b625f08fe68712d46d3b9c8f640aca41937
SHA256a1f8b27874615c2cd5ae532bdfb1fdcb2d651d2197df8fe3999120c58f264687
SHA512d7b4a9da64f18817c18b945df0840890d66033c287ab46b001886fa1cb45b6ac3b8508de2ce1e2cdd6081cd9e70c1ec5776e9a267ffef272e46cd23b90b186a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ec0ea82b1cdb5cf12ac850e9342c1ed
SHA144979c603950b5da9c16198f63ec080c1382c117
SHA256102482cfff3419c1089276b66afa30cc3a82b0a3842cb3dd37e6c3270b966ece
SHA51261b580b552690383757e799fa6877423e11dabd7fc9391776af3987dded46d1cffdbad27f6fd9f52d7d9b2222c07d3676ea306716262e77f032e7723832abc20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee2ee7aa037b09679c20a2bcb1f28b76
SHA15b27f03c58f4a2c562f0aa1c2a5b8cb233d8bf9d
SHA2562c9c5e651f10396b19293d5360ec12d1e4ec5ebea9753b367b755bf3d5a7ec5a
SHA512d21fb44238a1658cbbdcdc1c5d9b13b62eb7bb6f66714bb5bbc30ce011e907271509c4cf2376626962f9814d15278d8215455f3c5c1ea865c59096650cdfcb9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5664a40a0fcf7b756ed9325ee704405be
SHA12539f789db29f8e9ab93c9f5801b98ec2f675a1f
SHA256733f122dc91e5973bb548e51be36ecf651c07c606ef2cc2f52e2dd94fd932f5f
SHA5127028ba5f54f6e496d28ae243126a9858a2c3404dba909aeaeda9f4074b88d78839c38005633f0bd35d2251384236761abbd24a4dd3d1698c358819499479a25b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c53f38b8b1e6278d476617914bd2af3c
SHA146cc15c693783975e022403cd985ccc9d9a4c86a
SHA2563869d6e743eb395834714e1a069b181afa364602f0ddedc2dd26ea9167f3e1f8
SHA512d3c02df55680f4d60108b23d403e3f892e1916cb19cdc1fb333d5374d843673c68c8ec24031343ab7ef3ae63a173c906bc19311d58b8bde7deaf497cfcb8b8da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512f26e81ff727030292d9c551d2800c6
SHA16fb63e733662c07df33abbc5b7300410917bc387
SHA256667deec140670b6b8d9348237801302253fdf3995b4d3a162638d6ccd82e9e09
SHA5121575c2f3e306e2b175eb3d27dc95d36a4d476abb06b115dbefc485c90de752d69dfdbc80fffeed5c8775626906e5b6ec7659f9fd22aa95b98ebd29f4775fd5cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55a45765c3aecb52657602853f3226752
SHA181a48d543959a77c7f125242de639bd2e2fd028e
SHA2569e4e87aa77c6f548e8cf2c69451aeb392cfff74761159c050401442595ca2517
SHA512c416758ce21252d9c1a5af353e793f793dd2a9f0a13410eb2f652bdccaf9920990dd95ec5efa681ad0cfc009f601113c4259ea903b46cc0f5e629695fb22f9a0
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b