Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
4a540bb2e0b2da07556b21ed8d3afda4_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a540bb2e0b2da07556b21ed8d3afda4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4a540bb2e0b2da07556b21ed8d3afda4_JaffaCakes118.html
-
Size
12KB
-
MD5
4a540bb2e0b2da07556b21ed8d3afda4
-
SHA1
1bb943e8582d2295f3a77629ed72fd4402a28db0
-
SHA256
8ceaed6aed193a891f32f4451abbfdd1dd86470dc0fcdaed590ca6b87276b16c
-
SHA512
4b2ff5c14bb98e75ec15c1c78c0b62f8152c1f4ac2650beef472b1731d270b237f0c85ed25457b115940c4f0dabacac83c7c5bab067c3b5fb75e9610c1cbb1b4
-
SSDEEP
384:FKD/K2VK9hjvFXeRtX+1DPVV26nu/5qXqFo+yPn:4W2Gjv2t4jfuxqxPn
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427221387" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000058dcaedc259fe8900175fc8f8179466a066049a2db69592ba05dbf63c3bf0a60000000000e8000000002000020000000037a910d025968856148c7e6cc314bfead49e7f38e4e23abfdbdc2ed63ac77382000000062c440053637a956d17161e33792b0bdecf965c7151e83f5bd92d43a8ef2357e40000000da22045263ba145b96ee65cb71932c6d7d625452d6455294a9f4d868293bb41b8d6e575fee19d4731949e2e5e90f167a6032e720987086a4226b7f4e742c9cc8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007fa981aa4aa1e8140abbf0f22cec546a63b997be3450dd0a9842f23e55ee5469000000000e800000000200002000000098e5bd306541314fbba8e42f5d099a74d5ac28d80f8565fff8c59860ea8da7dd90000000b4fe75a0464942dff1b01de1caf95e460ec4245d170fb875ee06961f80cb8b84ec65fd4137bff35d6f0eae4275e4fa660f50a2318360cda85f622ef4ac1a470730a76f3cb51ce385c5430990370a6bfc93e75560e83ade2e5f1cdab1311181822a06e46b7922bbb8f94cec463175fc86abbe843ec1497350480c4ac16dc7c2d33670bdf70d379dfa946d9915fc6f3d214000000009343c870901bd9d0784224829d2ecd81df67e55caa8345ff7b13be346cf0876a7f50d29621388f59ab1408c5e1345f62e56a4ad3d8688cf438dc81a558a72d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c96be1d0d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{086143B1-42C4-11EF-AB78-F235D470040A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 1260 IEXPLORE.EXE 1260 IEXPLORE.EXE 1260 IEXPLORE.EXE 1260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1260 2088 iexplore.exe 30 PID 2088 wrote to memory of 1260 2088 iexplore.exe 30 PID 2088 wrote to memory of 1260 2088 iexplore.exe 30 PID 2088 wrote to memory of 1260 2088 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a540bb2e0b2da07556b21ed8d3afda4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554628fcc8e777b7c621204906ca47c66
SHA1e8d38bad6401c8ab7bc9ba3dbf0b70e24af13406
SHA25652e99a1943941551f6d5f08c1cf6f11a28ffa7be6ee7745c92bc769853097b26
SHA5128b553d79f28617e5355f9a4d3277655e037b00a24efda7c5fb5424efa245f408f070df6d62a969354bb63e7d0dc4a3fc1cb3552f38fe765a63a2a3c47a845f7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd1bcfc6b4c8e56ee6bac44f5e6b0caf
SHA14dadeb3fe143a183db2de10cff03e4a03dd26e32
SHA2568b0589baa42b2c62518e757569cc69bacdcc420d14a3f8ef6db73137746f2c29
SHA512e4b96940b2c053efadef7c9d7c6f51eeaa7d590cca6323b74e89d7261db45d82296966d967c655f1992b8025bbe1bf9a299b6263666179f3e4fe68c511c180d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5395da0356464abe329e784641480a26a
SHA15f93aa19eeff9e9d01ded3b0d73782eaf0f48a57
SHA2568f7683d75f6d2c12abbad772459ffb7967df9fec31684d3beb8596a7ca0b1859
SHA512eaa4317f697f9336e38708b07a722c57516c35f74373c802cabdaf35616a0397451ff161c0f7ca5f555e02c7b5612fc7931f53080efb0b1ade67617f49706b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5affc0651a4da73fed88924e78c9e7365
SHA1e5dc790eda5e8c9cfb92fba2e4224a00d6f67c20
SHA256d7ae821114a95da7cf6fa0a477bc1f1508a4392ec46a4b41caf019e7993559ed
SHA5123e57e5580a6cbb71dfa05494a8e4fe751b1756ce6577c04d2b8f3f78cc94ef79aa0ca20b1dc5dc0f3075a376d71172715db5d4cc7bdeb5b9049163d43e45d4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d39de01b1245d31a35457b3f0372a945
SHA1cc59f4fbc6b4457402fe9c20a8c658028738f911
SHA256645c2526550b6481efb24d580fed2c9bad123d0a35f89712df7055394c719734
SHA51231d14edb370914b09c57482713516eb476a17831843aefba801c684764d587ae79a5064fb5d7ee3853a365723d0659de1a69e7b4357860d10fa7be80aa1a3ecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdcda06a1dd7412ff8b4256557aeeeab
SHA110b8c4323a76b244b707fb8c186dbbdeb09a4de3
SHA2561eab94a535917f0fb6bc4b47ed1c5727ddcd1f0e9f045a59f7db8866768da3dc
SHA51267b5f2af61dfeea953f5b31dc4309e98549b3a8f274bada625db28dfca4a12f731cd430e474815e74b03a7576b48d828629f8ba2b57c61d00fbfd667896c1423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e704e838ba017f8cf75fa73605c71670
SHA12b2704426478c2f393125a995e6f529bd49280d4
SHA256680aed5609b8659583cde0d2be72cb07609a6f0cc087564f234eec54dc0eaffc
SHA51242171a45edcbea116537aa38ca4eaa6d574f4395e5350412575ef13ed09950078516f5d8d1ea47b4c8f52f6b7c13cfd3298056eacc3b421ba30f0b9fa79c750f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5621d39cf28a7ac203b030f084a73df16
SHA119fcd594c11fac5772588dd8ccefd740817dad03
SHA256e8d8e84eea0a0e995f8595b9b650bee90c81063b35f3d1824e4d5cd15ef6adbd
SHA51207068966b23fd51dba666b696e7a7c4259152a2eecb52b3b42d8cc8fd4455ac8f2f9ba622c47a0489282940be79e207128c93e7b9e17de1843b65759f3d64db3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1e2a282b0b715e2af277484be3efa0b
SHA1068aa4366490eeb1db34e4d1d645213447471c36
SHA256ed837d6bf35ab766bb136c402c3759eea5dad9dc6e17db566395411741f90b6c
SHA5125557d6366291fde5e6c64776876a35c3046fead160e1930f8295313c92ddc549fb4f4b808c7ca68d4566929eb1e7269a307b69aa1aa872c926fdb4bdf6a5ede6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b07b88b190e56dc1b1081d8af2be87e
SHA17b39e8644cf3e22e276f275341d0dda66aed481a
SHA256f2031f8bf428418f5ac4ca0ed9c13940eb1a2453d39c9c5947ca3bc352f97c57
SHA51242448ecde5c70f866ccc7e4e0b8a5824e3d49d5ba28bff9dc155e9ac689a128b98d5a57c4317365bf2369f87e2107470ef7f88d7471de10c3c18d61ad787ce89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5130984159da5cfdbdfab73d7006f036a
SHA18914521d44bbc82c9107dcabb99590d734e64199
SHA2566251be265ad956100be59b06e627d220728ed28162c80eb6972bda8159f8937d
SHA5126ad6adb9c7e6ac638fcfac6f3cc1072b350a9f8e18f065df36be496185c7bd0c25f341197bfa02db587aca626279c7e99d3b51136c5dbab2e3ca48efe450fc4b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b