Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html
-
Size
7KB
-
MD5
2922c6e7c00b0b799ddc2fc279a39e6f
-
SHA1
78d031e2b9010f0ec08ab4818ab4ea4356f07532
-
SHA256
fc7a46eabe693e268f6ab63b337869532a3ba46d83dc0b0b9426d280cdbf7415
-
SHA512
2d44abc7918c0a7522605d47d4b4653acada6010b9b72797b46c60ade89c16ea92e4be9191eb0a92eda5088d6d679b8f712ac857b78d52b40de322cdbfc4e0a7
-
SSDEEP
192:ljVAUYVLB9ruYVLBaeQlpdaTdqs3CTH0uP7KJ5:lpHYLKYEuYvHBU
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D104B041-3BCB-11EF-9297-6205450442D7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426455072" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1668 iexplore.exe 1668 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1620 1668 iexplore.exe 30 PID 1668 wrote to memory of 1620 1668 iexplore.exe 30 PID 1668 wrote to memory of 1620 1668 iexplore.exe 30 PID 1668 wrote to memory of 1620 1668 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bdacb1b55c4d2bacafb27420c8229d9
SHA156a4be8ae479b33a2c078e733b949d095b5edb74
SHA25601a023b23c710a85ddce0cc0ae93ff755b86eeb4126f9783fab7369f2819cc27
SHA5124e6ce277c6f79ee6edd1045ffc7c03e450d5b024099ec10e3cc424713000314c36e9da4741fb2cd4986fd8626cf51455687f85ef36cffb9e31ab789edb27bb6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516976a3edd3d48b8a617255fc2e66fb8
SHA1861570c8b26f82a9426d46254ed98e4c12367b81
SHA256f1ac4b004d95d12bee5027711effd954fc8d3165e6e94ee419a6061ac6610397
SHA51261046ba0ac4b294e25f20b32d64051556ab192f992b6bfc478efff301de252d64645c3a28cc27979e895ced08cf382d31691d38e7fb68f2aabcae65c1afe3a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59662c26a0fdc661a08cda42b9f235b62
SHA1f1f069f87c05053dc99408ff3fa9fae22f6a0c9f
SHA25666d0689047d214cc421f0b56b445e8826ff153a69830f43f3da502a0b8255c31
SHA512b2083298125c8f9b535da82d1a5ca789667553f56354090e6923e3831dde8ba321fe19908cca5dd0fb63da4496598d8f4ee6a72cd6e8b485eb96a585b8aac9a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c3860842aa7a7e9a8430a940f5d8066
SHA1765a847e7c3828656fa6a95683b5a45241aa7894
SHA2563fe66392977dda8e8eaa6c42f837ee45a8a45fcdf743161337836dea363fd449
SHA5128f46332e57ac0a9e4dc1aa2944ad22880e45a9a5f0e38ae210a6cb76c2bb4c63ae48355178d36dc09117c8b65572c1375fef7b6baa83f3f5287e1e5bfd1c69b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f43d08f9be9b63cdac89589a4e059731
SHA1a858cce329181cfbbeacc6404778e643deaaa5f7
SHA256e90cb4185127f1b2f9ab8052b9782c897a147be4b5448e23e28eb07e6309a7ae
SHA512dcb7e5e56b643923867604183f0de8b0bb7ddac71b2843f8a51b9e98c128e9d9a47451698da9d22ee7c5ccf21ddafebe3a4dc070d8f5deb2d19f930f5dc12dcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596ff02ea5c5ce7cb7fe46909bd25a719
SHA177ac6cd62063adc04b893ca621934d1cab0371c8
SHA2568499971205129389b472faae15ce671aeb1a73d6800e19ee99d990ec5ede148c
SHA5123dac607d904884089b825fa33f808c112eecca8dd494cb3d3085c648741f13c3384ccfd6f1e4cdb0845b0b8197aba89887054d37a1bd22435b9a535f9173aac4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0cb9cf00a259cc69a872492fa19a080
SHA1a0fcf79fa6f0bc2c865ecf0ce16c6938ebd76307
SHA25686f0f809d00e391810af1fcef07b169e36d8e891c055b2fe15b48cac1f1c26b7
SHA5121604cf7ee0e83ac7ddd911cd953540d4bfcf1be9fa07a353b6dd316a52aecdf71649566a8cc68d4faee8282063113d60ef1d16faf1d595cb6b0851f4ba9487ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534e66515d8cff35759fca0bc8e697906
SHA131a13fbc094b6fa2bddb5e310b27e3b78a16083b
SHA25622159efb36912616b6219249db0ae196fe9e05bf2fa37d305eae35bb1e7e9062
SHA512874137cc09a329d9ef1363def33681454e8c3f84c8ce5dcd9c7845b4957352efc4c6ac022b67b28f77a16bf63a497a2033a1816ffb1d3306b3ff7ecf7511c241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57faaec6d2ad7b39158eb7e5bcad397e5
SHA15180f7b88b5d64c3ef86c6a6a39b72d9c5e6b75e
SHA256e95a53cac5b2f1dd0f494cb947d8356c82a59ab73e6917f0aa92954bec3eb784
SHA512d2f2af3021fa1a4357cab1541212d660781e52504ed0aa8f6424c34253e423e46f3e66d8cc954dc709571964adc2efce31ed668f36eb496f84cd8ae6f568965c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b