Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
0d61f8dc657e9fe4e45acc265185065b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d61f8dc657e9fe4e45acc265185065b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0d61f8dc657e9fe4e45acc265185065b_JaffaCakes118.html
-
Size
37KB
-
MD5
0d61f8dc657e9fe4e45acc265185065b
-
SHA1
659bc39dd206760d0c6ed69195db2aceaba4bb64
-
SHA256
61e0738ae323017da578f88f3b92ec7f9bc036e9b526994be75a973ecbe6c106
-
SHA512
6c9e0423f82f6426e5288899b3558f893432b771a9f46b066110ac345987d895de65bfe4e5edb1b5ef274bf1ecb626c2a0a0a42711a8a2db2394096b7f4eaa88
-
SSDEEP
384:fQ/gzocRkrGtEGxd5mPR7Lbe0UmL7upe7xVpJ:lzEWNiR7Pe0Umse7D
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{267C1FC1-32CD-11EF-917B-C299D158824A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425466085" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE 2428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2428 2916 iexplore.exe 28 PID 2916 wrote to memory of 2428 2916 iexplore.exe 28 PID 2916 wrote to memory of 2428 2916 iexplore.exe 28 PID 2916 wrote to memory of 2428 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d61f8dc657e9fe4e45acc265185065b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59766094710b43ba7718730ea91529946
SHA1cbd356394541b73dd9ac787c9442791fb27d0315
SHA256ea9ee38addfea6810a19ebd407923c513074f676ef641acad0e2fc29b797411c
SHA512d0f0b2d6a46a66921b11dcb19e192d9fd87ca1a20d8360beeb863c624a0dd840fb2c2d16722bb7f503e28ecd15f48d6059936305f521120befa176fbdbd86777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598b8d0e73dc0a0d99936eff77f05689d
SHA183daadeedddff908b01b57bd4e6c28c529621ac2
SHA256a5a3bfa562deeec32df0dd228a2387ec9eafa360aaf7492add143eb6c919c641
SHA512a567746b4ad0ad852bd58fa57ee90d6143a549374ce1255f37508e1da5024f689eb1c50e8637689d44e2455df0794ca702be1734ff61792222e26fc1cc6a01b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb8380c7cda8613e2f8a8e0a90367ab8
SHA149584c1c4e4529a8e353b0489ddaf8b6aad900b2
SHA25640f52945aedb82345251384002e6032874801b7e7923bdec46c188d119e0841d
SHA5122aad4abb18ae92439dee2dd865f44cc0866f76a63e7aba5f561a494fc6fbe90ae4dff4c02374ed08b25365df5d866cac7f030f447c1b16c9cefe3477d6600033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52815e99535ee37bd31a011831b45a718
SHA1a4892b361b8fc28d36a6e9cae68b11a7b0637517
SHA256c9d18ecf6405abcf1e560308fe5a6c3ad68593e55607c8c19feaf356d04fc50d
SHA5127d5e8762cb62c6854ae8286fb1043e7d69a164762d0a0733b8b428b939163ed2fb8b1ad9d160d93509f9cd385bc5b9c33204f8a16f44a219c67a8403bb3459b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef4b60d1a6550ffff7e8cdc7fa6d80aa
SHA1374e73ea40c993dba42c9507864e1daf264be911
SHA2564b45ce60f34c9e2ac23c07fc2d87f0f28e03173ba24b6266a1e1758c930cea15
SHA512b1a37e947cd9ea5ac7e9fd8382d3da6291c63a2de356125a3076ecd3051899cf835e835f5e21ca07534ace63de0dfcf8c14265c2f720838bdca146773e502927
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5157033d59eca8101e56bef4bbb0d8f47
SHA1b63671e0690bb8a684330c20a96720032bbbb3c5
SHA256afb0d1bea21972767c09d81fc940e83221d488c805c6590f6eb1c69aff8204a3
SHA512c71bf9fdd435d6d61b39f26eda527fd3713b4f7175fce664de6400e949186094b407d07288d613629cc60cdcf7aefd72345d75cc7c754545a61500a73c108d2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539e9c6c0fbcd94b9af820cb6f4c9ee20
SHA12dcee5c31b569baf67b123c005d5a3bf248ddc57
SHA256a1c5be1d511b501db1bdd0296c53710b7c0a00cbfd77b6ab9ba8570a50502ccb
SHA512f267a03fb8d7cf4b06beb9b6e72371f7a48e9841fe3a577a27363fc7c714a08b010f242dc2bfa66d7d3edbf5b32c9d4a902dddb4d42c270ee53ac592867fe53e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54434e149ff9c2c42ffbf9f63a02e7347
SHA161db2ed282f8898429216355f2b385158f0aa6c5
SHA2562882ed1bf547129d2483b6ad5436cc9942b0b9f36a8410614ffa512752b4c9b5
SHA512e2d16976d9198b4c49263efcd1bb38aa75136dff06c3c499952fbba2bbdf4a091d657552b7f44894583d0757a082852ac41f5556b09d27368f06150bd42f473c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b