Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
130abb5069358d5fa5099aab31dbe139_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
130abb5069358d5fa5099aab31dbe139_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
130abb5069358d5fa5099aab31dbe139_JaffaCakes118.html
-
Size
78KB
-
MD5
130abb5069358d5fa5099aab31dbe139
-
SHA1
4bbfe2da5eb513f9a77bbaf29a0eca025297bfeb
-
SHA256
7937e4b6cde0f73d41201a4a4699964f130c7ab809303cdc2449b1e3a896604b
-
SHA512
cefd2953a02a2375a04359e4e49eb5835de400ba421bf2a4f2fdd3ff4593df9abc04af45adf775510cc5c03ee6de65efcc3649832e6ea6969ca4ca90abf311ae
-
SSDEEP
1536:bm8kEtdPoskClF/c2BFRnjyi4KmK32JYKqcuplACkej3vDj87:y8kEtdPFk8F/cmn9M5tu2Ki
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420993169" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D528F2F1-0A1E-11EF-9891-EEF45767FDFF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1756 iexplore.exe 1756 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2640 1756 iexplore.exe 28 PID 1756 wrote to memory of 2640 1756 iexplore.exe 28 PID 1756 wrote to memory of 2640 1756 iexplore.exe 28 PID 1756 wrote to memory of 2640 1756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\130abb5069358d5fa5099aab31dbe139_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD519d8e1ed757b4146e5a016de7580ab78
SHA12c167aa85804241b9ee31bdd08f3572dc61c76ae
SHA2568512ce40bc87b5bf2b9880193850cdea09ee2d94975dac5e08a8c48befa2590b
SHA512335c84a6ec1fe4e22a181557b3d97010c02c35b66de1a191b2b1b2491b1146ed29615a9f1816b69c04c88f2bdac3c6449bf6210b666c20c3a55d11cbe119ebb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c8dbd1041b362cfe542f77c7f490b01
SHA11b48e29bbd5a5d47ccebe4d9654daac20e58b725
SHA25641658751c10b4d8a04680ad96d1ba1c09151ab6c9d441779591d5aa5f673b214
SHA512057a03500fe035e5f0169829cf9b98b17824f289c8541a03d26f7a005ee41ce9a5f1c5eb2f1f1c29ee69d09e62a721cb3da481bb086e4507c4cde80994f0a058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1f9d374117100b1a497ac4ea42fce57
SHA1d2be4a0b4092c4d6f6212720f39265ffb61fe78b
SHA256d669c11fc10c5daac8995d70b74fdbfb56cb79471ad974340de7966036bec096
SHA5129c46b4f89e995ab8ea9519d4468cc2cac225bbc97890cd0801156d5e2a5be410be0b35678ba0e6c1967da5e55fc010245ace8a0fedab0a5067c11f04f0a8d55e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfbbf7834c2553833172fb65253de464
SHA1f445a2f5c79ec644f0b67b0404d1ce1e04cbe8e5
SHA256b28cb93ec9c7e4c7f7d5c14d4019d9d062222ef6b2492a7c62c722ff1000f512
SHA512cbd3d831014827582e333a4d795eae2ebd10ec896b8a92bca25f8a3dcf2212f8278b08bffadde063abb2f1d6d88134b70b680309fd426225ec331ef60cc3b856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7242476315e211b812807daf11945c5
SHA1347945e61a869d9fd861b46829596cab2e12d16a
SHA25660e52dd4eee9c95cd97ea34075194581f457c1dc0a6758f209f9919fb5e2f79b
SHA512aae89f3bdb74dc0f1f8727a8694a2f460045dfd8310333cdab4b27170c8b8d16f6b5d827abf803cc36db4966562eef7aa72cb2d59381f8ae11c304543c55f1c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525b8aad57632e5b73a8d4e49536e37b0
SHA1a2fd5f81d02e5bb9e0ba7fd455ca68e1a5ed215c
SHA2565091e59902b68905937712061a45009942e8276a4840a06688ea4cad6ddf786e
SHA51235ea31818286c6e77a299ab3d89df169b345c7577da3e9623f2857ce8fdad7bf973a0700a6373b2546eedd79f7a16d728108fd77d3904f4a2f0eb7edb263733b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5723d2a30dd06c504947e4b3bdc09644d
SHA1257b37df9f85941cbee817f7b00917e0bdf8b785
SHA256b3476b630ed560787f36931aa1e951a09bf4d69ca5db3981ff7630535da3859d
SHA51213da285fe5eb2b52bb459929361705ccf0a2c77df813bcf2b896ee08f8f292f0755af80ab052ad424575d3e9ecc0990bbf549ba31f63c105979bf6324703c9a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c377d7e8fa13d0654500a1a42166c98
SHA172f8aa06d0798e1e2f4695b54b46d34efa385e70
SHA256dbe3937fa5cdac7d2f632df288b38462fc501fe6600364b231f2dfcfefbd56b7
SHA512ad6832b80a7f8b29731b8309e5d6c9f42d1c5598fdd043058d350122f0a081a114b1061b497a0ef156b6feef1b2db5a85acff60d5a723e5da5b2f07ea065ffd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56707821c1485aa8e416a77b585bf79f0
SHA13f8a2a5295cf65ceecde43a602eb9d0e58f63378
SHA25620b8bd4e78f60e4f57f914db5c6e1b4d94cac0498d05876ea7dfbdd0e673419b
SHA512a10afee2b811176b40a4089f1d8e0f7c161f94f18baa78f12140d9980d84cbf38dedd6492e85db5c54c425728596350b1ebf7a57b40df0783400d10a2384c384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ac6d1c3691fa8301f212c32fd5d96a6
SHA11322d141eb94f149db6c83642474c7515e444e44
SHA256b9055e9f27106bdd4a268ce574452f038a5a14b6c81e865c452093ad8622435e
SHA5128890f49a9a5dc13208a7a809223db2c98a3dc973e605384fa3cee5790df0e4d57246b43ec36595f02a650c8ee9ae47b32ee53473b98b79518765fe2f2a7d5d35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5105ee00fb62eb256e20d8bba74b5c976
SHA129fd05465593a20e84b776fa68a3702dcfb40a16
SHA2569d31139d5b2f69b4da83ff5add7cb4540e62d827e53114c1007bbe3a50369d85
SHA5123714ef8bc8aa3daaf0c81e4456707fdc351913a54d530b31eee23baa7dff9dfc717ccd1f0a19e138d05763e8a808d754980e056fcde5d98c4f381932aff78859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5db24eaad3db857712f0d635d170eb615
SHA15fb82a0e08f84ad5f5b8cca7363469ca65e16491
SHA256dbece0744a988c6a1aceffe0e76d150090f3c1e6f723d076e7d2831b1ea28fff
SHA512baecc0b89cfa4a915fdd7e81d4f5c1214657048f2e9d972f471834b6dbe63a75e03808bdc024c1fb99af7ec606b7c77b802949bc214f81daeffbfcc1b437d874
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a