Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
b81b8fcb77e86f616e108399f520f230_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b81b8fcb77e86f616e108399f520f230_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b81b8fcb77e86f616e108399f520f230_JaffaCakes118.html
-
Size
34KB
-
MD5
b81b8fcb77e86f616e108399f520f230
-
SHA1
77f6c71047e5a1369a27b3960634cc9a81350b23
-
SHA256
0450087ba1f00df83634684c67bc2fc494e6c6c162a50cd3c2ace4b0490d9f01
-
SHA512
f9413fe30a5e9aa743762c6b7324b14baf2b2877c8695eec9ad0b770bb7742788f44eefc6124a5200600d93e67015f4b25aec8f3ea55269616e0f4c813dc5196
-
SSDEEP
384:nJhSI0JXm6P3LFxhDVJstr1TQ/kqS7C7M+o3gEC+P3w12JhGTRTpzBkOwfdyT9+y:32r12fIpz+s
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{333811F1-2C93-11EF-AF3D-DA219DA76A91} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424781488" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1684 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1684 iexplore.exe 1684 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2600 1684 iexplore.exe 28 PID 1684 wrote to memory of 2600 1684 iexplore.exe 28 PID 1684 wrote to memory of 2600 1684 iexplore.exe 28 PID 1684 wrote to memory of 2600 1684 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b81b8fcb77e86f616e108399f520f230_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a20eb778eb96c5a13f7deec8f4070a6
SHA1d831d0efebba1571c53c6a7c70514c27ad5103c3
SHA2565759aeb343f13f44236654bf3dff369cbd37c9a95f4bd7bff0ad273f2f46f300
SHA5120efec08409a6574343bd86274dd0e65ee698d4c47510f7700951fe851516ec8c91799730f7c66fa01745af86e990b5c309cff64f4a1c9e11a04f6f7e85bacdd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e9f0ccc4ff2987184b5c99015950b5d
SHA1c27f3d96e2cb1023aef6b022ea9a875653e9dbdc
SHA25628bd30e23ec1aab7b7664eb6f7073c834d2c9b2b12cbb4f16335b6f1323546f6
SHA5121bf95d6cfcb6e8cc9dc08c946e37d7f769fbb1dd22a3a4d9e90ef075636ad55eba1e30065d37b41db2506444744b6f09c23eafaad99ae3f9c2a8e84474ed26f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba88a6cf04465137185e353765dfe86d
SHA1fc2c10392cc495f44665b64eadb07c5687d70530
SHA2566db9ea2bc93417e008c10dda2dd22f79c7b67347ea7a9d24f0a591553c69d2d0
SHA5121715184738cdcc51bebc4cceaed0b21b024e0729cc60428543e8cbe51486d3426e9cc0f14b567aa8d5b509253ec19731519e571e0b8437b4b5498a58e97c0780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c8d58e0aabe25dbaf1654b196c5e6e9
SHA13c5229b61002c7d848e32e2b92cd9e6303eaaf24
SHA25661d00d2f68eaa1bfa73be01baacfadbcce8ee6ac5519974b2f960aa0a9f8d83e
SHA512616915fb72c321241618cb00c39cfdaaf6c46ebae9acbf9cc4e29ec1ccee4a6b49839b30aa5bd41a3c197acdf5151920e06050bc982c0e1f4fd2e4608e12a939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5939c5006b016681a694bcf9b79b28f14
SHA1042f010a0b01ec10ad11866b4795adff4fe0b94c
SHA2568c4ea0550f69a37db063acef12ed20ac304412e7b7965d2230861da9fe324000
SHA5127d30b1e1bea7c9c8ac52a192fbba790490730def332f42ee2415bf953d7171c63a4f44f43a6b5fc94f60cccda352df306e7ad0e4291a57cfa4ae2fc5b8704681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c236d234935e04eb40fffb78ab70702d
SHA1e8a9897605175bdfe2646db9a821c439f96c6798
SHA2569e377b845a519d210c4a5a926d9b96da51921705a531a21b457bd4dfd034848f
SHA512d7d8ce8bd709d6c5dac6c4a49c28932c0cf43178e9e7351dab7bd1ea8c945b025e9961dfb5706be03ec25fad8a51f5fce9b517f2dca55247ddc9a21b48b17b1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8bb75974f47b1a8431809571dd5c1b8
SHA1ace28930b4c548165a533af3b8cf5506900f8094
SHA25665cd463638858dbf5f1c97ff2016a93bcc3bbe6f9338b5af96ba0adeb9adf240
SHA51266fb252b0284b78f7a0f9b55960d7d6a4f05e36c571eb3ea4dad73f3c16cef77500a445c967f31e65bedce2a64194b6c105c525821f348e759850edaa9a2ad93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7f55f36efa0e1b6e433f996fb637b12
SHA142d92d5fea0caa35b61af9e9871b5ecff2a7eca4
SHA256c1e8bad2d5ac0a6a8eed8c76bafcbafc25d7385fd87a66ba143e431b2fb69507
SHA512b57790dc017d8f0eada75c56e6dd85ad94be33505c03db048b57a366d2aa29360c5de3526177100f209fccba3401488cae9cab8bb6ca4b1d686a3369ce28133d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b2d775d2aebd791c7d37437271deefc
SHA1ec0a4303cf147704fec7c2eaee5a0e33c2a63bde
SHA256d84eab06f0e3042d6b3c2e8f1a74df103083064f852b16dbeb274a9664eed21e
SHA512aa0500b20db340d707f03ea5a86f1eb4bfad31c5a25c49ff60acbbcd67fdf86c4683d09820038af0b63d919b166916b57cc3dce818cc6bed2fcb291d8445ca9e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b