Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
b75cb2ad8263210fcc0148a9bd1ce3ea_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b75cb2ad8263210fcc0148a9bd1ce3ea_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b75cb2ad8263210fcc0148a9bd1ce3ea_JaffaCakes118.html
-
Size
19KB
-
MD5
b75cb2ad8263210fcc0148a9bd1ce3ea
-
SHA1
c952c92c1285443175672778c6bf2a97db58814b
-
SHA256
b27dc3c9fabe02fafef37de2e71b8a5e8c8741e19789230f460ffe96b52d0deb
-
SHA512
1e0611ba9e236d4e7b72fefc4eb2140a4c9de2bd8fe8beebf7d922f1bdbdfd8d37ea6e30fbed1d27a576ecdf4e3df93fb9030b37b9b7a359a50d88ba430572d4
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIF4RzUnjBhj182qDB8:SIMd0I5nO9HVsvjOxDB8
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{442DDF81-2C7A-11EF-B73D-E693E3B3207D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424770779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2508 2156 iexplore.exe 28 PID 2156 wrote to memory of 2508 2156 iexplore.exe 28 PID 2156 wrote to memory of 2508 2156 iexplore.exe 28 PID 2156 wrote to memory of 2508 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b75cb2ad8263210fcc0148a9bd1ce3ea_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5056d49d86ff70ef5f6e506f5b3319db0
SHA1a7cd8d5fd607cb4ff75cf0c1fd7e77e8316f7513
SHA256c948d1ff2d55a9aa6148faa059b75f182bd2d5ceda079746b20dd2d849cb6638
SHA5120f9bfc2bc7df311e6af9c36be7a600f3765fc6a66f0d413c14831014f8ecb8a15645475b6790b06d9ee4f2a73d7765028bd2034f5ee65dcc26a282474ea7547e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59eb60a26bbd735cee6558fbcdd8edc0e
SHA13dc7f016e775b6b1930c47a2dc0e6a42705f10ae
SHA256f8b687b11d75ff0f278349e4efa6f81658476038d0010ecbe2240f3641ac1db3
SHA5126b237f7a11f52c05d1820d17c02a4eebb81686d85623f66cccef94dbe2b259732375830d2f4d49487b0e338f195367b44c9f98e2686d864127522a9577c1cff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f85fb5b07dd19d0488b61792872fac2d
SHA1a63c8ffcbbecdf50657f2037cc3cb770c614c919
SHA2568eb1cfba5c03abee754569236ef737ea345ff738a1b95c7a9dd51a1e258b994f
SHA5128e9b58b3d275064c9c30cb829fedf514c6c62df05d3ce51b279734c1ecc5f51cc9228e01096c59d4d6fad67c43b4c557dccdf5afe163dbe0710e5120803fa68f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d618aeabfd61ef6193e6413f6eb4c9cb
SHA102bbd8b506ca5b7ee339b42c3654e84c64d34f03
SHA25610b17936cc1cad923d8ad574cd2ba6f3f98fe7334ad7a7411096a741cc27ee04
SHA512b62681bf266b835e8013c6af001915916fb200749385574b8a5375a6bd17357f718e347f8f955686397c9844181585ccfa2c0884fad3df3558723feb6d9c18d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfe3dc541b14dd747ea1c43d323f7347
SHA1e0d8f83e841e71fdaa6fe08d1b0d1642b14974a1
SHA25669cb6a204b6972c0cd54c69a11673afad3c084293ec3bf1c61123e512d9904f1
SHA5122e09e6447036010136f97edadbdb4e62f5b59bb7d7a9ad7a20da581e4e11bd109bb092f5fc6a788e0626311f3fcedd99c1758dc8232c26d5bc9e9dd9db7b7d69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd7454fbe79dda210d8df7e603d770f8
SHA18e4a092b558c48b3af0b430a98dddc6c0765d63f
SHA2569af6dfb1c07913995ab1a3fb7520121d3558e052a6e49835895de1051c311465
SHA5124923109ff92d512d80690c67fc22863863c5beccf44a5f3c130c183b6f9a0d2f74219f80f3b2087ddebfd4a86aa8acd3de38c411bb809785b0d89c7b5de66ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b18e414dcac3da54b6e4c181f8aec77
SHA107f49e46f7402b5dd0b80d6cc8809b38c7a79c43
SHA256b8139d99e0b6ee6a0737e769d0fd17f4f81eeb1a241263d27a7462cefefd2d70
SHA51257a1aea03a3f7c452c8b9d6968c38438a9b2bf5ce233a0f14ff4c8374f289c5d67a8ce7131d36d0d90c3740c41b01e6a54b706164e1c82a36ed5e9ba2f5668fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590d9f640991a2caf586fe5d25a5dc455
SHA183fb6dcc4eeba016d7a2aa3ba1ac202d70392fcb
SHA25651a89b62921ec21658a539619e1b002eadc1a59d4c9890f659e760683dce0492
SHA512dbd9de550b79aa36d412fd2424acbcd42b937a2c77349bc24324ebb068ff7484fb1f7f3aadb63b1cbfc117314f31904081a8bab41734bb06c0b11eeff44b6013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6489681bdf42b50e1badc24a7fafa1a
SHA1ae9f7372382076f5a487f262504dc654e6488699
SHA25695350981f408be16a22cb0155b2b8b0460f2ca8f2d191bc2557a6a597bc28106
SHA51201b62f48b37034a677c3708543bfd70b4a45c70de12e4281edad4d818770737366da53a404755bdba43d111257464e441b34afb284b9da7ee0a56c20bae1aa9c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b