Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
b6180b18096371a9ff844aeeb9895e96_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b6180b18096371a9ff844aeeb9895e96_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b6180b18096371a9ff844aeeb9895e96_JaffaCakes118.html
-
Size
18KB
-
MD5
b6180b18096371a9ff844aeeb9895e96
-
SHA1
ebfeb53827f10806e1d995976524a085645f5e5d
-
SHA256
ac4b6a6db1c9239bdadb0a427a89d6107b0a008a7eae4c670584eb0cca24318d
-
SHA512
34c5440059cc752856dea8a988cb407bbbac46f00888e34a8b21ed47469b0cece9377f9754549ea161de36b8157081738b62dfbf559233ff3261a45a0c14cf30
-
SSDEEP
384:SIMd0I5nvHq7TfbA+uuEbgrmGsvgK4nxDB8:SE77TfbA+uuEbgrmG9xnA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{998EF071-2C45-11EF-B3FC-D2ACEE0A983D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424748160" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1884 iexplore.exe 1884 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2536 1884 iexplore.exe 28 PID 1884 wrote to memory of 2536 1884 iexplore.exe 28 PID 1884 wrote to memory of 2536 1884 iexplore.exe 28 PID 1884 wrote to memory of 2536 1884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6180b18096371a9ff844aeeb9895e96_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a48b6014fe68b644e20cb80ff44eeae7
SHA1124bbe5f1cd498110d2b363570bca381023964eb
SHA2565cfded75c3d04f185a1fff78bb39f93c81bc326a188673730c081e793b9bee54
SHA51217695df465d9c653bae2856616d689d37ddc54888f5eac6ec83fee37de7ac8f5ebb718dd32d80435b421756407f40462f5aed7d75e18969528a8d4232860e8c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c12b07072f6632c346d9e341344e448
SHA122986ff64e5f79b7f616728c90271a566d4b5487
SHA256b849f82f0fcb100e6b58ab9ae83843004ab3429aa8f68e427b1435a2448ad872
SHA512c70431aa3a271f140292ba3cb83021afe974fdfd24e380d99a01779e16bdc0492a18fdfdcc8f8c9efcec798f91f838cdc2c7383287e56be0321e67e44bd5d76d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ff814175aed1d59aee91c318b589113
SHA1674e14d3fea11019d5b4ed493fcb4fe8ae17523d
SHA256e40e3ce41b5f5348aefa60c646269b442d5097bc2d5c4a87ead9298ac7d1b28a
SHA512fe68806891cc0f3520577f476e197ba131d99467895be3d2dbcacfa18eb8403c0696b6b747e65a572abc769ce9fd810db7d1dc40e30e539e8f1aec9c9a43ff96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d789355093a06ad206ebd902f5867104
SHA1cae88e8d9c5eef5f85383e19708988dc59289104
SHA256d227fbb941cecf3cfbc35d678508d6500659debf9e83d2167350e1006bdc5cff
SHA512b2636c2ad7df7c2ac7f3619591c5026079f78c0b35688a49ec67c21c01f5d0e2e2e6e370e65698b91d47f1bd98770a9ff95ce698b3a04bb04207b9634e454c62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ae0c1db04b818c94e080d39a5cdf771
SHA11e3db94ff9802376c30c68c602f2ab5bbb2cc92e
SHA2561394ec36511b79c472834783c2f2f50e9c71d76f3a282bbf368cd1bc7c54fdee
SHA512d06873698ca20d209af1c9b52224732ed5ba9cd083208f31f67bf9d99cbe1a4e4978e439f461433de33e8decc5c130480c9a5c65778c97dbee9dd590f82d9d7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55391268b6673b6d15c2197228f6220d9
SHA1bc810f3fbffa4dfb305f49f4a6574d4ce29f7e54
SHA2565783ed0f3dae94bba0f5c05fb66a933a2fc23c70a3b78304d045a174f381b366
SHA512cbf25ad31d048201eae4e143272a07aaaa6f7f1478ce9e4775f3392034675d28e8bbd9fd80ed2f3fca31a8956069156815526843eedc3909a56fe1a0041e375f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52603476a87d1986e54ccee0c201bb330
SHA1d66cdbffef37ee85c0ac0a95d387bdab951d76e5
SHA2568233a3a2fa46463e6de15eba6d9adf6564e606504f84b3b3682212d1fd580e3a
SHA512c638996bf94499c2b6693e651215cad3e103a76d96002904cce9238b6dfcc8c73228727d34bb55804350848deaaa83309c947b3aba7b3077ff8c6bb8b40fbdc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5327e4903847ee2b3908c57925ef82e8b
SHA16715e3e48754392e1e000ea687984e6daa0f9a84
SHA2568e9fce106a57d00e880a9e989f11fd6c754562803bac87c84ec48e821b30be7c
SHA5129a8d2b9dc74edcba3b9261b67520d37ca0922f8a2f2c11036648fe693ff2e00a7534bc258d5dbcf02f47449e18183f0c84669f7ab8c8cbc7d927e5538fc85325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516b2355fdd4adcd6220c80b8fd89dfa9
SHA1fb185d29efefb0a7c9c654a50fd85aeb4fbb7f2a
SHA256b63c943c71a66851fdfcc5c6efad01add0c1577543d2d1831be45c7cb6fe40a2
SHA512deaafe876033e763665cbaf7acf88bdd82b189a578e6a05467b9505ffd39f83c5e67d2bef30b2df8b44a3ba9beac9132c4417f0607df4556f5c73ca9d021d998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5672999c51e106175f5e85ffc34823d4e
SHA18446a40fde5b6b145fa0e39822c15e661fb077e9
SHA2564ed4798c3033efb89ca8304f46d18bdde6db8463a0acfa6f683dd74ff168f2b4
SHA512737ed05b9e4ada5586ed7f75e8b87ffefc2abafae027d63802f7889a1be8057b87ceaf0aa8b1bdee37a149393152f355f127c2a4bf5d74eb9d2373473e724d20
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b