Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
b856dcbc3b9b2ae85f5764154ebb0954_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b856dcbc3b9b2ae85f5764154ebb0954_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b856dcbc3b9b2ae85f5764154ebb0954_JaffaCakes118.html
-
Size
27KB
-
MD5
b856dcbc3b9b2ae85f5764154ebb0954
-
SHA1
796afc44072f106629a8b27d9d1a8cc55543bfbe
-
SHA256
a479bc8da5c6339b7c7d7753bf94bb02d29e5fc335f2b74bf86083b9521522ec
-
SHA512
c521a2d574d2d5936ce4ce71b2c6780825851cd3570e3001095fb0ccbffe1130a479034fbfb894834aa4c65982a0fac491e31a7afbd4e46f79b1afdb810cd0cb
-
SSDEEP
192:uwX8b5nvunQjxn5Q/+nQietNnCnQOkEntCAnQTbnpnQ9exlm6unLVQl7MBNqnYnV:KQ/8I/iLUSX48
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424785115" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4C13831-2C9B-11EF-917B-C299D158824A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2428 2912 iexplore.exe 28 PID 2912 wrote to memory of 2428 2912 iexplore.exe 28 PID 2912 wrote to memory of 2428 2912 iexplore.exe 28 PID 2912 wrote to memory of 2428 2912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b856dcbc3b9b2ae85f5764154ebb0954_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d1b46c0831d514f5d4d50b024a60033
SHA13026a73a11c071d6fd1d6287de7ca81d3c936caa
SHA25691b70e69c237cf8c907deb4b5e6d452601346727ab461d3b597457e1279890bf
SHA5128efe562cada8ec804d6816e3df525ac5edb4aaecf0fffedd8f7b3ae29ee51d221e0597b5945d37eee56465c139279be59dfe54ad82474306c12bb4f99c52aa96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e3a6f5d4de6623798b3f44baf147861
SHA18762007516bb718b2ff7b08eaa4fe039ee015f04
SHA256d09de10bef28eac2d1815a6487edb11a002f790d5baa0c03891dca09a1848f7f
SHA5121373a3a216517fdc43e532d0d8d950c8224a1897656aa432e90a6a6ad76c4eb2858e183ea725776167b551425525d6a3b9583eedb53c3281beef7f78bf64fc93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be45cc9d48a848efcd692bbccf4cb138
SHA1bbc1eb4cef75a619fd7a44c036b05df9cc6b0cb0
SHA256e1c78592b8e2eb48803e1700e91ff5726b2ec897923ee638d6c48b80ce962b43
SHA51270c656450d3c78b3f45f91a7b052fb09e3459243873e2a2df54243a9d5fe29b1437ac56a2f684afedc22995aa29d20a86940b0a014528fd98b38e87e2ca28227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52baa915dfcc4a1c6806cc02fede1a96c
SHA1186960fee071e2360caaacf081056f29edea285f
SHA256b15f88b30d70bcf2caf9464fabe4c2ba48d0c7b40bd6ee345bb72b15d47c4d25
SHA51297d732c08147196145f21cc97657e885062915fcaa3eceb4f0a06e11c7ea088054f1e6a79f12d745714f1aac557803687710e9cf51b1a1a6fddc062926d96f43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576af15cbb0cecf41ba162a872df6faa0
SHA14b720e60849c458e5e646599be245c2da31c67c1
SHA2568da4b2985b2dcb5a5f4590ce1e27cc9fa16ee228421c415a4b71ace99e0ccb27
SHA512c85254c8e42c8080ea55c958d084261a8e31e33a41103b5de8465d1edcd14c60fd5ff06757f834dab28dcb38f72dc16259f77ce065190f5cb1b781c7bbefca50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582b03c7c682355a3829e97b673e1b612
SHA16c6754ccd5f8a9b37f13f7b9a36962008aca0170
SHA256d21e5ff9f897cd72e7f221256b4df10a9d815aca37ae7b3c1aac66daefb2240b
SHA5123836a0f97a1f5bbeca7c0464b43118a59b8d2a4eda5b2abd65d55bf94e315de43e42be1677327fef2b1ef2a562c4ebbc179410e0d4d24108e85acbedc6378376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac9ff1190e7435d1e4a2691dc2f2e3d8
SHA1f03190d949fd7bb50fb794f8ff02dccc1a20ad88
SHA25699b67852cfd748bde00b32037f9035be6c79eef3badd630731d3a990ba571319
SHA51287eebe6c3881655309139bc058321c0d311218d7f6cef38205a0ee2a4cc4e5a1f31ba344c2c68dfbed3a73ad28f657874a7aeba7ac8a7aaecd6d070b15cb704b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553cbd483182af5baa4aed46c20f08e6f
SHA17965da6ed22750680f8b903f1f040b31f36824fd
SHA256e3ba5f770b5c852d73feb3bc3adbfce798365d06ac9a7bd39bc6b45e4f81cb99
SHA512ce0c7ca451b1ff0ad78b0001197235e30a834260b0d98411c4d9cfaf6f416e6e265a415a2d9cf8aaa961e30c5a68c00c084e85b0b7211d040573dad315deb226
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecc05631fb7a1174dedf84c76d3360f1
SHA1466a5fe804aef7290871cae39ce91c669d6049b6
SHA25679d617375f848a9dc68c45397acfd04d4c8b5a91f298a6d59b96540171f9f104
SHA512dd4cadabe58539ee672d750bb9a5ba494b6939587df87272a2c26170dbaadf15e7fee45e5b1c63698b3e3fdd600a9d6ce9c5902630f1967f6ef0f9b4116cb01b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524574a93769c8261a107ae9c06d30029
SHA18e6cf60b3d914b2f7905d58d4a52118824a4d646
SHA256f5bddb6948a82aa8432868deb8fe12f7fa0b5d41b94762704051f957df746b98
SHA5129ec7bc4114f8b741f91d2bd49492d3726d21e66cdc196bd00a44064ae0cc4bb163db06e97828d513dffad7a54cc667f7c6c6914396048db6b96b6cfa40d75f1a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b