Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
087289865b76e0862fa65a540ab61f58_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
087289865b76e0862fa65a540ab61f58_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
087289865b76e0862fa65a540ab61f58_JaffaCakes118.html
-
Size
102KB
-
MD5
087289865b76e0862fa65a540ab61f58
-
SHA1
36e6397656313fc947db6e98cabd7aec407f42e2
-
SHA256
1d0dab00f9d861c1898e7a0044a4409dc1767c7fc1007910db2b131e2a5cfc50
-
SHA512
9b5044202623ba3095862e1ed2acc1341bb83dff16c786e04e09d36284f7f590dbaac39c6c6d97a44e44e881d32bdbcdd18bfe5a10392af7e3990cc15015e67b
-
SSDEEP
3072:SZyIzgr5bWUwm+WEcLwTNR0WhNur36EREVjHx0cB9D5C:SZeAD5C
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425393230" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85DEAD71-3223-11EF-9CEF-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1096 iexplore.exe 1096 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1816 1096 iexplore.exe 28 PID 1096 wrote to memory of 1816 1096 iexplore.exe 28 PID 1096 wrote to memory of 1816 1096 iexplore.exe 28 PID 1096 wrote to memory of 1816 1096 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\087289865b76e0862fa65a540ab61f58_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c61544811026d7420d72f8705db698f
SHA1a34d3819f88d09e5e23736db99f667bb8a21a579
SHA25606aae1fedc102800d9048b2f7fff21b18598485c5909f51259af3647ec7f86bf
SHA51298e1a30b392109e7744f5f07dab05c5c1dd46557e87596613787cae9ba444f87b01b2ca8ee2c3fff05dda7f7e1dde7e61f2084692d7ad672d091ae59cc02f970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fbfb62744c1a52791e6b3b573d7a9e0
SHA156848fc6bd9e11d4f224747661810de74715d898
SHA256fd0032ac9bfe30ee4abb136478d00366c9d85b06c594dcbf0a00b2095608b359
SHA5129d4da840ee6995690c543a27de30a66f174f37086480492511137349de6e1e08822dfcaa6d206d87f8b8af769382fcb56a6c6b80d8218188bf74922e78befd10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c33c0d4557fec82d195a0861030867e1
SHA1450b943618603928c44252665f3adca5cd966cdf
SHA25649b301f84d7ea6ec4ff8e669d97655e50e618928e03f06af8aab2ed7914564a0
SHA5125a1d9937d5d883342d2b0dbf7c4679d948c8c2371009b5ef1055725fb34c7b3f774fb0bfb339b6331217e93364b313f121dc10d259d13cd4e413d0ca0274c487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b12ddbf53c35224f885aaa95da746af
SHA1da09221fca48385cb9bc2ee01eefaa304b15cee3
SHA25693b557f9ba73d3ef5435d65ec6b7519ba7f907d3b93c7b8780892d271eb61494
SHA5123ffa9c8f9181bcd42d42b6ae2fb1d18d882ee0e81fac13bc6c70c222cf744e32f2bff62b12c8edea199c365d685431203474cfd99fca74b85578e55448af09a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5640a41b147b8768e2b9a3ab27e477061
SHA156175ba7fa783b7be68f9dbfd3c0a6411d7a8fa0
SHA2561876389cabffd5cd09ff2dd028724a2258bb918c10f2a694b58d15c826e3d829
SHA512404e4f7c9534b4e91249d182e368747f37d937320446fd4064a069905432b0056fa35c40e8964c6a3d9a881fb8dfcac9091564dcd996d8b10b56dd256b0cd9b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5747d33f6fc332cb3f1b527dce7b01476
SHA12537af15b1feab42ab84df28eab47ce5fde1e800
SHA2563c9ffabb0e7b538ee86077d1bc3970350a2941d4ac776ca9130e7aaa28f0a58e
SHA512cc5877809dd4a968462c0000472fe2818798612d04a24315c4552333367dbd139df091616612aeaa6010e5b9f7067018895c68c91171105ad62e66c0d9e65f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534fa77f9e6c341c8cba0c01d5a92f0fa
SHA1c97882e27e677571d5d14d765020fdd4fda490b7
SHA256012660efbf9f090665fc333be15919156e82f8f1c22743870f743ae1c10fd6cf
SHA512650f45d38fe3333b814eace96aeeae84ee9231c69e324ba06afa94eae0bfa41dc151d7bacf3c9e795c0cd98cf787276e351b4c40bab5e4177bf862f1963355c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9530574a2905a47b36f43824c0d85c2
SHA14a155bdcadc799c6c0aed6f9a481d6ec1ee939d6
SHA25698304049bef28997f56bb9065747853fe92b24ca4bd840950d831e483098de1e
SHA5127812f82d96d4f3ea09f7be671f4b0ab520ea1aa769dfb330437f47dd5d9aaef5238d814fe58aedb4e00fb30c08fc0f7eae95c46cd88db3f240d699d26cd45a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d9c5230ac1b6ee54acf106ac6cad47d
SHA105e4bd053a6e17c73b35e5a37735916186004680
SHA2560165b8d7635524c9e7a8b47a9b271b231472512248262742ca59444fb27a1fcf
SHA5120ed8f8114b0122faefd60e9dd3ab782f2c22d8c78dbf5e2836a3f525be4bfa320ccef7750af634c6031f9d8786635157aedc17717acb53f3fcfc177739f1628e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b