Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
33348799da072dfb99cb10b48f02659d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
33348799da072dfb99cb10b48f02659d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
33348799da072dfb99cb10b48f02659d_JaffaCakes118.html
-
Size
78KB
-
MD5
33348799da072dfb99cb10b48f02659d
-
SHA1
22c0ad00e324e55d829a2face97b3f3911eb3672
-
SHA256
0cdd4e4592e786c6e516ad2f768db6afcec685c7dfae497db4af65f08a63172a
-
SHA512
0366b91650c56aa7eddc74062bf2eef083c9d8d1853966f69996ad5251e2c177eb81a6c1f9600a7613e82cfd4e27f01fb7c1816a1dd36e71dea260f66d200aab
-
SSDEEP
768:Cjh7ye2sH/MXgyjCKoBfuS/7h7uIuKzNyGsaMWxS+uGIRw:Cjhxb3I+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CCB3D01-3E70-11EF-9CB8-C278C12D1CB0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426745512" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2988 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2988 2384 iexplore.exe 30 PID 2384 wrote to memory of 2988 2384 iexplore.exe 30 PID 2384 wrote to memory of 2988 2384 iexplore.exe 30 PID 2384 wrote to memory of 2988 2384 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33348799da072dfb99cb10b48f02659d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a66d14bda217c08e11daadc101ede6d4
SHA1d11848042fac1ee10e3fd735ede9f4ddfa2ec7c2
SHA256bf9726108fd30ee88e3cde1682394c5a3e12433c062d39b75c85d3c2ad3920d9
SHA512a905dc6be4d2c93b98226dfabb73b660fcd59d3917b85677fc61bc0753e31330fb7f0ef76f5b7a318717b3301415602998b93da643b8d31f092639f7106273ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56426ff6e3d1e660ae6d507a4cc199e8e
SHA1e834c1d25b7919b4d36e77bda8c3bf04535cf398
SHA256ce8ded3ec871adb0a1d50a4286c43d01944be8f16ad4f9876265dd11951f55e8
SHA512d93309ff8a6992fc9154f9f3b164d1f98c6000fa4e25ea7205cd05e48d47f420d3fac8bf7af19eae795e451cbd2ae72dd6b4b62ced2674dd1ab8cd94e83b73c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53e70bdbea5ed48b5843cb67ebe7dd678
SHA140373a830fa36acd40e5d9702299f9ddec8b2ff2
SHA256b31b594af859fcad775bc5564fbbf3e3ee6fffb351d6851e720a5ddd2fce4147
SHA512c2479721cf6fcdd3332a8891e2a9f2497b760b729b94ff0bf3d9b6015fd79189614e10b86a266c350d8bffbb4a86adff9932b59acb5fade54f07d4cf4185c19f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dc5620e730c2e12715cd8bc8d7a9d4d8
SHA1446e98169ac782ce90d161e8ac8aaebed03a0379
SHA2561cb788e4ed0bf0c558032d2389ec8d24cb4b5903c543932eb4c9b3f365a68f4c
SHA512f3d7d996c2ff36db08bebacdeef84dece4b38a6725400530082a780be90c73e151ba383e5dd04af468f94f8b0e66c71e60a90375e66dbae99dc75d031bfdebbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b7faa5747d928654bab55122e6cb8c41
SHA10e1b2851513a1a1950afb6a5afb6d1c7cb25338a
SHA2567cb0c3d44506a16db7cc5d588bdc7482a3ba9ada805477da02dd8c564aa3a24a
SHA512a8fb2b4538551d45b875283f48237edd79af3bedadf42c48991d2118234247f41f633ce262b7f3f1527159dadd235b500aa0b91ed1dadb55be69233e5a46c076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bec514c364a53ad7e6ee677123f42aad
SHA169bb963561e107cdab4add3be177eaa573bd1d4a
SHA2568bbccd345645bfa9ad929765d67be05a625af8c0dcfcff20bb2e324616b1c94e
SHA512ab5b28f515856a33488c3f45803a0876451f5f4894a8bc64e9db5383dcc877273e0d235df11f747531f586efda76ae5f02ba78bda774755e856e317c7f8aba98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD588f0c5ab98bc12f6a37c351c9aa8596f
SHA1e08256ba0759d0b47fcda77521107e5024bd5c7f
SHA25683208aa39003cbc5fe111217e9d6092d8e7ba54de28486ca25fb36ad10a40ccd
SHA512254f2592c26d8899fe15c332982e1dc14c1170cb2536d8556837d26f8b4dcf48e59dcc0f00b57572b0816acf4d59c694ce1f45dfe76e6109d3153044cfa902fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ee237741884eb0c4e67e0ca70d4a0bbc
SHA1b577216942247bfd3ca1da310f190bb4d6d05f40
SHA256d3c763bf09eb26cf669161b9682afe9467bbe16f9c4e409f196a01c23472868f
SHA5122af7425279f89ce0bc210412cd73dfdb64a014b0ebe70ff5b8c6e176d421662b139d51bd83e23415288568ceac7512c6797654aad91e9ceec94549e2785f2e8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e4ad2b3fed1f182ce8568171f762ecb3
SHA17e622767347140b1cd7ee5114ac02ea9e1f6a3fc
SHA2567dfa346adb72a8c95113bcd228aedcf56cfbd6908878b17711ced3778dd42a96
SHA512909797db1cdcd3d67965e82cc65fba1e8d4ce3a11e68cf4b446c489719e08c131123fa7d06fc060863f9616138e8a35413d14be2f311bbdc60f089f3d311255c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c3a95bf3b1f115dc1a66704a6eee04e2
SHA1e389a984965b8ff3ddc877117375a67b6d018249
SHA2561fd3ae177b2fa8f47740b11842fbfe14f14b0d20db275bd1fc3aea0dff118833
SHA512080ebbce01bad67bb46c70edae9ef8ee7604de83372cb0ef6336379f5cefb99ac1e329e82161ec62c41268bbe994bf9485ec95ec6fc49feb22d2a6f2dd214158
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b