Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
133104902841935e7abcbad35627a0c6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
133104902841935e7abcbad35627a0c6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
133104902841935e7abcbad35627a0c6_JaffaCakes118.html
-
Size
20KB
-
MD5
133104902841935e7abcbad35627a0c6
-
SHA1
69a5c190b49aaa02a884da4655603383b077f051
-
SHA256
229c22191e677a5490727695d1c90afd214d3101180c48f6f23128c329d497b3
-
SHA512
1bce48f283eae58fa4dc3b99fb4dc9e47ca9b0b35b002e727879910ee8f0aad565eb44e93065188fba84ebffd319b8443950b8a3c4f8220aef38feb57b76b97d
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84OzUnjBhC082qDB8:SIMd0I5nvHPsvC3xDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420995985" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63999521-0A25-11EF-8356-E61A8C993A67} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3016 2972 iexplore.exe 28 PID 2972 wrote to memory of 3016 2972 iexplore.exe 28 PID 2972 wrote to memory of 3016 2972 iexplore.exe 28 PID 2972 wrote to memory of 3016 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\133104902841935e7abcbad35627a0c6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0fb7cc870619e5a0f94d95cb7e5768b
SHA1c411e1ec3da60d702c41dec616e084f32f3b05b3
SHA256f080ca7f4ff91a0fe43b94fe74b104489f4329b871a0a559a5d56b162f52ea27
SHA5123de8b8c9c1f2688f04c3599297d81b5739e7d9ab5cd3b16f1bf5b2b2e6fd876991907a3284f0cff6b53dcc0f01371e9796d5a9b3583b04beb511c0323ff589f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7420686b3eae2855c3eeb2ecc685794
SHA1e5a640123bd544b90774a362cb2151c00f17edef
SHA256a5f7640e30acf786ec645c1904ea717ee6b5d7f78d53d3832e51798d3cbd2175
SHA512f6568ac4ffa3995a49298d433bcd99cc4826ea46d584fe68e189b8f84f98507030ea9175facadd2508ed676de6f89b33458dc91d5a9ff64e5b211b1d35a7550a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52965131eb9b9de465db17a5c8470f810
SHA1dde6d9d2348fefcd6b81edc25d3312e7bfcab5d3
SHA256584553c24472b91c8ab0a59f907de1fca8a9798c0445a9a0b52edc4531b4eca9
SHA512f20277c4f03d973aedccd7b992be82a95d3f4d0b5632b594613a6dbad788005551680afa21ac60bf2a22c648ad35e6ede87884e173d81905773ecdd3e5b79d00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f1f0c22c8479993aa9dccfdd334221a
SHA134142ce0087896575d337e01a58a4757acbede5f
SHA256ad0910fcb712b960b870987171e9afce25d99520997ec62542b7031c92e95b3c
SHA512b509409bbc05476a0c5f48c7f6dfad4e675fef8746fceded1c76485572efaf2d2bb6fa9389754c25881383314ce8392688e7deb3c99d7a3e7c74b63588b46645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9053987d7f1499f68ade45e8f7c3342
SHA1043f72294c7f4f990c3c6cb3005be77fba078c7d
SHA256f76285fb5e632a4bfda36a28c53ce8a330e880013f1b28c19ed23c6f669ad5ca
SHA512248ef292cc8bfc3b0da2e1f98a42aac59f730e6f56a5b295153e6bc2ede23676b2c5b36232f4a9b3e49acc0493de467bdce620788d6cd4a1851df3ca1987dc41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b8cfcbabe7146f9231ac93736a23781
SHA1462a2855418e7cb8155bf9b8e005a2becfd4c8a0
SHA256db0bd3f061a851fbc952aa41b04f80121f44ce03080fd56ccac7e9d199209614
SHA512a2a2a86875b3528864770652033689665f8c4f125a826f3a23d66e60d17e2f48097f4bfaf8c6be64c501d742991210383d23823ebd3405d166b71ce9439d731e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad6b5fd5c59e68f2c97cc11449bc9890
SHA17fdd6d2d65cdf5e5616360b68ee71a0ba44283d2
SHA256e7fdcc33bbd49f00eabea6622e1a381ade4dc0a1fa001147db0fb29ed3b64f18
SHA5125b4cc58ffa974a9fe0f940fea179d4cd2b1773ec45056dbda2bb679cc8e8499b5397ffefb3d9b54584002e2b4a2aed4ce8a92bf63f32a71c9a7b2c38cd694fec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548576d338dea8b22808c1d1886a25dda
SHA1e8a9cfae0216d083ba624bd271c246346896e053
SHA256d4bfb8eec40292fefab8b0d5b61819ac3c5512ba77669e3760f821ddae015d20
SHA512a5a047250ddd903de501fb2a9721cb46a60e21a68a66ad772310225365ca024a2e6ef0f09b8221b91385c80bafdbc3484662bedf24dcd7285271b9a1542bebfd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a