Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
b649517a37fa06f7eb5848d03cb8cb87_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b649517a37fa06f7eb5848d03cb8cb87_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
b649517a37fa06f7eb5848d03cb8cb87_JaffaCakes118.html
-
Size
67KB
-
MD5
b649517a37fa06f7eb5848d03cb8cb87
-
SHA1
2617142d04fded729fa74b3f37f32921706553ff
-
SHA256
e3bd3dd5d2070fe8f8de70b0db03ca79899dfa622a1b63157966b8b44eb22de2
-
SHA512
4c2eb81701650717a488aa7ebb9962ecf28fc58ea116a039f66b2a853b322d0b839657e20b1ea72b4a53fbce5070f994d92a081f5e78d03a3cc80180ffc74336
-
SSDEEP
768:Ji6WgcMiR3sI2PDDnX0g6sv6KRoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:J/JITzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424751398" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a90e2f6f55cf7b43b1b0e6c004d2208b000000000200000000001066000000010000200000004abb72164f607a476337a6ec6581db999e4405962285d16c4403b1c6f1b8e352000000000e8000000002000020000000b0a2ee171a9babe8160b380c7de56d2efb84f2b552fd8a2df6f2cd38550af1a1900000009deb1cf328dfc5c116a61371ef5b0c5dc3ecb7a2ec71c97637d0958bb2c1ec0c3431d525dc1750631f7708827fe4eb485056e92b838dfe4ac695f5bf51694920b54b2896795a3fc5c6433a50391b0e1a858bb5594c9be54807bd616728e8dae26d103359ef40bd18f7c35919624284d158751e52a877ede97ed1e33461cb4c3ffef4f4e9ace06aa8c60352a659b507de40000000d6de239d3bb1d8243ad424c72c7dc5ba608917df0550e37e32d7c731c21f38751d142036a656418e1ac232bfe2cb3b9a78b05f0b974344d3c7fd6055a0e15753 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2304DD41-2C4D-11EF-A5A1-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05fb1f759c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a90e2f6f55cf7b43b1b0e6c004d2208b000000000200000000001066000000010000200000004d758f03bae056af718184189bfe6bf9620b5ad74c78f64ecb21d33023c19b0e000000000e80000000020000200000008e4348d0801322a475692bb0622e7f3d4b077c19b2bfed49c920e328542c83202000000098c3c7697e12545510c251e0e34639667c2d0999587ee6a8f4b30c287d2b3b584000000006578aa3589447e3f8291f692663b66e74d91ccd2932166c40965a1cca5f2a4d69c5c2c55715b92d072ffe76fcf3060387d14fa29f880f737d1057324ed25060 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2748 2112 iexplore.exe 28 PID 2112 wrote to memory of 2748 2112 iexplore.exe 28 PID 2112 wrote to memory of 2748 2112 iexplore.exe 28 PID 2112 wrote to memory of 2748 2112 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b649517a37fa06f7eb5848d03cb8cb87_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582c333dd3d033722c9b3991f54174842
SHA1c5a0b5b85c94a97e60cf7566f942c03774e86f45
SHA256b2681acd575b510c55b554eb62157f5a85dc2e32de728fbadd28f4dff3bf27b3
SHA51249a7ae4908640dc2ab046490b110236a7c6a85bdda689ffe89a88a3616c29d4f2d3c3dd9ea7b43ba9964d73242b613573f7983a5248cb8f52c9349abf42e5514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596c44722db0c56cbc529e6f24a9d8fee
SHA1b50177122470e213999c0c928354f8bcf2496f8c
SHA25637b29e1c6681b1adbd5de733b4ee671a379585f70499a9178070cd01eb6a379a
SHA51266fdf08c1a7cb4e372e3b741d1441f0f112706cb4ce0f0a64ad36e4d0c26cf6c160076493d43cf5b5153ae1564bc912f7ec50a0b042ebe57e4bccdd6e2699570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed1cbbb03c0755a4cd71b85de02bd210
SHA1b09b3dcfe156a0ca6c656e88422b783cd9ba9e14
SHA2567a88abfdab0cf8ee45ba7332ee168ecc21b30eb9a100e9ee7637d7c3ace40f57
SHA51286291825c1a25e099963abf544b9a454f35482b6972f2bd2ab45c7003884241d095cf0cebcc5d9b1af9953ce730f459674c46fc0e7f526078b135cec3c84b653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa2f09ede34e11b64442cc49a09ddd4e
SHA123751b7a8d3cb16f314546744d74731a63cb6a02
SHA256f3ea66d542adde543f5f34b48db038152ddd7f66c744394ef58d2880e09e866b
SHA51223849237163ba902205de7780390454d41a0d7eb88c78c8a25bd0582e961dac2b07ec71ce90f2766c85ece834978d6df286801bdcab53d44cfd4bf3633dbd608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec6b67a7a33e7e4dc5e947548b9e1d6a
SHA16760ebf522b9e46d383be4f18753d0cd5bb38065
SHA2564ae99b2506d8f3348c3aed3a869f137078eaf73bc6834f09d38d5f0fc7fb9759
SHA5123b18e6369616dcbc6c112ce3b66ef87dae300d8749c5996bffdd3a9d97a84731251f67332943dd2024600254c89862fe3ed6883c4b89a1b192229de932a0bb03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5638196d95b2e4be37622470bd90f854a
SHA15c7f22b69e38ebd97b7bc64fde9f5e3cd44674e8
SHA2569eafaa7e0596d851f444150b5d7f7f340e3352fb76745774bad85bcd3fb12f4c
SHA512d1235931158e9200dca82e500fe777ec3632756dfbea5f42072640847374887e1c5afa0eb241e0c2eab1e0b872f8803c6a76153ddbe744c44746de5f8d507bea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500409133f251e59ce11bf32edb390829
SHA156b07bc6f9dd481dbfde6c4e6c461890a6e8b0b7
SHA256299b964a914dbd87cc9416549fa3f2cc3f08844a15222f75fee8eba9736ef740
SHA512098cb2100e8c857e9c8e4291ce4a5295c18c36d6eb2cb45ecc23020623abc52aaf0c085d28dc17f335ac9a542efd9a31a09b06d20bf111cbeba089adc154dbca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f827f7f0458e1d8142156d6d248df9ce
SHA19bda393c05eef25993cc73fc77def71b7774e459
SHA2563f21e9f0a52849e9a0b64713afefd7cb3156d019508af92cc42517ecf17aa62f
SHA512339afea495ae3047efaaac2448eaf0caacd69b1857b68c1856fc751d30dc79150f63576c8a4ebb94ce86e7b159bf1b549faefa7afe08e801e12f07ff1238809c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c34d861e3b36c497db39be4e01bc609
SHA185364a4e96bff005b628532fa1eda13d6405af9f
SHA256ceb47bb99888aa3e1986f58d759d0aabb81874ce4375a92da0b6b7c7f24e11f0
SHA512e73cb1e3373144f93305ecfb11b2e563679f1b96830aa3d7498e95345ff174d79dba20ee7c5ce08c379eea3549b1b0dffc0cd510f426c06990e8fd4c65024855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517efb53cd9e2cc2456268c7911be5c02
SHA19021dd9e7ff0440987cc6a861f82e2576158b6d4
SHA2563b032de991a6eac717ea734dd774eba356f1d7e35d85b08a6ef68a169b290308
SHA5126cd2409a340c0ea0974d624fa76bb15144b13dc7c738d9612fb00963f48df004a58398bf7847902fb2374282d4972853268b7fe69526092a6788ae5a9e38e1d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504134ef396f7485b4ffbb3affad83848
SHA1fc1080f24ef7e88d92da710416479ade93af1e84
SHA256f48fbd9828ed679cee36f970cc233889db7369600fe2ad2ef4ef0e9bca0adbc7
SHA512226821937f1f21a3096351057b1fbf1c7681129849ff4dc7b00366938f8453b4d4bc59cf1aef0275e1a4adeb6873982f2ffe56bc86dcf86fff4721438a841473
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b