Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
-
Size
12KB
-
MD5
3189ccaccd3b2520c234aea3991debf4
-
SHA1
15880f2b92ca16320c35300cf98455bff5643e19
-
SHA256
c134f36092af503fe964d8b23f02fb33806afbb9c2c4fc0c8b7b19fc8f3fad8a
-
SHA512
ee0fbeef993f7a79a21ff908305bada44a35edf3ed399944a674b81a58a37476cdb2a105f9487be7470ae9944afac21919185a2b835c62647a3fed74c7fe2044
-
SSDEEP
192:2V+lIsr0KXyJnVCBN54J8k/w1wvqyX+BX9ZXtnX7XuXUXnXw011AuBuLbdU8d:s+lIcEVcj4j/gcuBtZdnrek3A01AguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03231281-3E2C-11EF-838F-D692ACB8436A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426716290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2596 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2596 iexplore.exe 2596 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2440 2596 iexplore.exe 30 PID 2596 wrote to memory of 2440 2596 iexplore.exe 30 PID 2596 wrote to memory of 2440 2596 iexplore.exe 30 PID 2596 wrote to memory of 2440 2596 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e35a51d67c5c5fcf1680945cc184c8ad
SHA12aba66e95b1859f3fc82206a628e76aa247b6bf3
SHA256ff3c091a4fdd9667f5c74b7d8d37d6f5e8c9a10287513ee30c2ddf0c882ea1bb
SHA512e4dd31c40889e92497e995e36d3a77049647644df3c9c59ec3c5331260127cf62d4332609f0951b661b2b279a9f3dbb86dd4bd80b527dffe0eae09c36e7def52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e2983f36a61e40eb08d8dfae62bd8a9
SHA15b95069aa25430c9a467f470076fc4114be9bfef
SHA256ce2ca71a3fc55567c434285e104b7fc4c8a90bd6d28014f694866e536981b619
SHA512d185102f04d0eeee7ddb708d5ae01990a50dbc11cf7ea528ef7564f1d6d0218ded388aca025de518fb12038c0546aa762169a1311c6fe34a88f9aa73896d56dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52de8c9dd11b5aa912b4623d1d303af5c
SHA17eb5dc3dbe5ca3f16b1a67bfabfc0bd50ae82077
SHA25620cb11c6f9339226164a35fd9310de9fc503d1fc43f43d88f97af662f252a646
SHA51271894ec4dce67b5801868a2b1b0a76ee23f469416534af2a3779876602c8e477b627902148313263d589e2511a1fb420d3b9e0d5060f9bdfec34a81947d7e1e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eea8ced0f60600e43302047d91a3a0e7
SHA18ea2d2c5f6f3795a2979ee22e9e639f68b487a0c
SHA2565f6213e32148e0c17221c9db66067b282ad1359746a1b96d3d3d32a8c88a5a07
SHA51224460c89dd5215f2b6c0c432967bc9fe022734926d50e9a1639cc042d92954f178e86ac12b852e6c832e9228314b406898e2a11a63aafd398e5f376a6fd2fedf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566f1c0953be3e2cad65c0e103331b481
SHA14c528bf37ec4b95383c6e12c00e9edb398370524
SHA2562260864651deaa73b2a8121c001ba1004baf45be4578de8bca5dfdbc547585d5
SHA512aecb1db7d07901cf2908139a213f0c8a38902223831283e4c47705016a499c791e53d498d60267048d7b35f626afee9006655d107757bdf59a5376881a8b72ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a37ef6710dd0b5df016cd636fca16780
SHA18c3e5203fa1f373095a3fbbe68c14dd5b17606f3
SHA256945b7ef904f01564fdccd01157dc0e032bc84227cea4842af9cdcac60837111d
SHA512a00ae259e7c9ce2a3b6a40ae40e6094069c506074349b09a0e9bff7048dbd81314bc66394e31f3945811a32f6778fa5cd31a1fa66b55160de99c01c9f9b9a091
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b9c082bf1e9777a24ef1f8309c7f68e
SHA162424c4ff58d8b99f0f7f2a1c925178d84e572e3
SHA2562a3a2398be979d30faf7a29a3add1730f88480f5e5a69cfd000655281b838c9f
SHA51216e6e7ccd7907069e1175f277448af11f1467e38c2ac55392fe43016f231eae8ab3f9e7f032d0722ba82a8c6fb1e0dcbbc6dfb0d6d1246daaae95bb3881aefd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1b5c76109aa6f8ac5adc04b70d3cba1
SHA1459dd9aaa6ed6bbaaf92ebebb49208bc6dcc5deb
SHA2560429aea9102e451f9161a696c2f38a6e2f3bbf28d08e7082df9504384ddda504
SHA5127d5128dc8acdda12e91a9bde17eb44372f96c79553426595c6b625366bf87c379bde160d163ee30234b72e680bacaa99d40d7641e174efdab7fcc8210e6371b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53226d8cb1a7861638bbb071466b1d65f
SHA1802f72ec212b21ff3d0f5ca2230215677e099fdd
SHA25660374fc672cffb67354b204a1ceddfeb94c809f9056d49c386ba30b01ee20d66
SHA512bac9ac9e90a7ebee5baefdcf7daf95fdde3ad982c71fccf07e0241de31361e2a8eb66329839cc9f406d7cb1fb09f0f88d9e0e25266e0c26ba4c5c4fe67f646e4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b