Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
330302235b135a6995b26de402a6a352_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
330302235b135a6995b26de402a6a352_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
330302235b135a6995b26de402a6a352_JaffaCakes118.html
-
Size
6KB
-
MD5
330302235b135a6995b26de402a6a352
-
SHA1
912c28ae3e8629846b883868c5688f84b3308889
-
SHA256
c173d1fafdc433d2c6e02c412923285aef3325932be40fc52722b03a712cd3f6
-
SHA512
82728db6f9f5074089d9f2f8fe07d4a8ed8c8bdf9d566802f5b55c117f3276ed38348c0abe85f6db23c109e5c97367fcc5fabe3cfc87f28ccd8c6ebad21d26f9
-
SSDEEP
96:uzVs+ux7B4LLY1k9o84d12ef7CSTU7ZcEZ7ru7f:csz7B4AYS/Gb76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000640f027fa949c97624b832c7c4a4664aace857b958663da6b0e867accf2b49f7000000000e8000000002000020000000ac6abbb766af2e66064cf233de32d96f235c034d3fd35554b4e7ce1f5aa13c1420000000377f91e00f470b5804d6a71fdb4179bc5e6f8442e2b0a9c0ffc3268c58e2f10a4000000090320e1d7e90a4349e85dc2a388676b9633485c7207547bf2960859237215fd0deaa4c9a5a2e39f6ae508b41e02786cbf298297c9d240d0dbf0c65b62916ccbe iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805dd21775d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426742168" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e2af0a72c99700f1fb4983ac62a6a6a9362eacdfe3ce801dbf2d558f5cebd760000000000e8000000002000020000000b7a4f70557d09eafa8860b393922690df16ebfff345222fccf7b6094077e4ea69000000096f0edb2cb590cb4c0a4933f4834729f4e2033a5ba67750ff86dd9dab4cd0f755c6374af8e5c6dea310c17ad92559c03532afddcbc52543b4ff11da657b305daad45dbc044c51d7ae40e25fa16d3bf78538a1d862b3a5ee7eba3b4f9f50030e74775164de0d37577705d32eab547453ad7f80aed37333d09d9ac758197ca34784d2f51a319369b1239ff25fd7199438d400000005210f736dd9ec7c0b21b1680973e2587239d06475b6bc78d2c319c07efc13a1d509e1b0f6d64b27252e94b9bb0cb8d864fae8d34e6966df9ccfdd85c7cc1cb73 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41A647C1-3E68-11EF-A74E-76B5B9884319} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2788 2928 iexplore.exe 29 PID 2928 wrote to memory of 2788 2928 iexplore.exe 29 PID 2928 wrote to memory of 2788 2928 iexplore.exe 29 PID 2928 wrote to memory of 2788 2928 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\330302235b135a6995b26de402a6a352_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a25b4f402d3ede1f80f5e0e3b897c16a
SHA1e8941ba8cbdb5576f9f8cf8b2d43eed690ec4f42
SHA2560843443d5999240b97ddccbc3dccc273dc711746705738f0d5c6a60d22f1b844
SHA512b3960bb40dbb511c71508fe13eb08d99663a1ee4d8050c4e4af37b1b72b393800736b24b5d73d33d78e91d9ca5ef48943788bee83f2a878593da967b31efe17e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b39200d007671a0d56cccf33b2650338
SHA179c83abaa92518aaadf72fcbdb6a4ac1c06f207a
SHA25643b435a1db52325440be5a8fa2322a2ffe483b8dc83903fc776a0b77b120a798
SHA512a41bdea3703d19d895900b948848af74b2442e73c153f5bfff73554d122e5238f20b4d09f2c626bb1e32c0373419d4f2f0cecaf1bdcc8d38acfd41e1e7d60e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9095a43de0c89d09401885a2416d8c0
SHA13730dc9a9734560f5db898b1985f93348d3be73c
SHA256926c0bcdefb7e7b04c806bf7fb54408dd5a42c8feba86a3cc39ef54aa3806398
SHA5122cae081180bdbbf9a9ea02a5ba33fdc21e99de4dfef4ab0e2047ff708ef391caa7d3682272f575fb823afe0a63dfb0ab2ab4745978fc05c7403c2289fc0c9dca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f222124c7b002bb0ac51a2baad39dddb
SHA128fc8651d463360c516edae727b8b6360d4f3739
SHA2567a6b898e010984a05d57f0392c84c9084806bc08cd8fbaa269f15498efc276f2
SHA512dc504b79dcfaa7b572545d89136266aa99c402d668dd51d9f9e8e21f573215493dce714b2691118f6c9882621ae582cf4c4bb99b69261a8378456d03aadd52e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f08aa628dde1afb852ef30a44ad4acf
SHA16906bb1b642e5883faa615c3adef9a99503d886f
SHA25612deb411ab14258760d1a1c6d74f40543fc77c5f7202cfe46378df0efd4ff36e
SHA51218ee9127142460a784a71569341ee8bfdcf28e27c3429b6b12acaec20f61e48e2e614435c0658fdc7007d90d366567cd518b454a6c4ebac18f650202f72a5c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5891bc6c7bab15f242ba0fe4b569f61b0
SHA1df0737e5324d25d386a73b7af65bad1925bd6da5
SHA256a9761170769d12fa053f8865aa1620272caf32db04e5fdad9abe6b267b9586f1
SHA512f70b9a6e51d0d124fefdba1d27ac76d9a2f11f7eeb0d467f945ae545666c7433d4a0f83b7216afc069f01b2dc2f6f6b6b58aecd11191442fa02d75a055f3e21c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a8a927f2c08d4c120d17887d969ac98
SHA170bcc7158779edc6c9a7137fc8b7b85cd8bb704e
SHA25641e2c2db421ccf2683c73d32183c28fa8c321ceabcde8dc9aaa62304e2680d47
SHA512e196f478740a86101016afb19e4fdfe8ce8adc01b91fb60e1659561810fb02e7350c63d8529ae5e404c2fe14dbedacb284e15c1c33c1503f5bca1f976510d049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a052620f504ff7528979937732f84ecf
SHA1c4084e803997de257e68a6ea4a9dfd8b34b6a4ae
SHA256ca18d4d1e489f1e3eb1cbd29c80d2fc869fb7af723030639f2bd5fc4ba9680d9
SHA512cebf8fea558d60a7be40c53686fcdb88f0ab7dfe7001a24ceaa06ef3fa385d04c4e11c36ef4a758bf095dd347c57876f9ea3e10b8229f38b5e187d5ea961640d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505da1365d2089e651fa163680730110e
SHA118dc2e508378bac81a432126a88b1bd9f13d87aa
SHA256c4feabf283269c37f4d967bbd26dae012c25b8fd7702866683f030a74b1bb113
SHA51299b2dd8176967631e03a07f701b95304f3e557ed0afcbd289c2236f2b17d2dc0ed93284e4cfd25ddbb52a78bf2d2139002bd2256386b361f6f77b826323f1a0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55004f2468d399c4151b151c0e54cc502
SHA118b19a2edf994f66a195608ba47f6b0a6ced7fea
SHA256a705bf9e5bf768d3a8884d83ce9ef011f69c29d66449dbf1f359673cfa2371ad
SHA512103b8bcf54d9d9be74934162055130365a783396ce9c77a6454ef78317d6c90a0d3cccff1e727f883c35850b1136dc2c144ab42ea843205b2e7fba769d78c0e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516177defd817f1bc01a7abc345f751fe
SHA1baddcbeec1f877d11553581c5aa2f8afe11e38ac
SHA25604744d5aff78a556257992e900cbdc662eaae4a832f29e3c7bfa378717551b44
SHA51290a3839912a73a0c2239ef663859e86106a8ac9b8d10ac557bfda3df13ccfd434800e78ce4010872a00ca265f0222c9bdd655b6ca85f3ea27bd02d634dc9d44d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b