Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
13a0297fa37befbd3420a58a850176a7_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
13a0297fa37befbd3420a58a850176a7_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
13a0297fa37befbd3420a58a850176a7_JaffaCakes118.html
-
Size
19KB
-
MD5
13a0297fa37befbd3420a58a850176a7
-
SHA1
a0ed3daa53a6ba0c515b4cf9c0ec107446917a25
-
SHA256
bb820d0474603bdd13d89692e5f8febc535e4ddf2b0d27c8bac48aded74ce634
-
SHA512
468a03b3fd0feb82aa9d8677d3b4bcc709328cba7adf502d3dddbb6cd24f9262477bc2bf691897c11f6d8c1c9e17f5459e6a0c6154666f19d6f587b49a2240d9
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIV4VzUnjBhLt82qDB8:SIMd0I5nvHhsvLWxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421003262" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5506A001-0A36-11EF-9479-523091137F1B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2040 iexplore.exe 2040 iexplore.exe 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1940 2040 iexplore.exe 28 PID 2040 wrote to memory of 1940 2040 iexplore.exe 28 PID 2040 wrote to memory of 1940 2040 iexplore.exe 28 PID 2040 wrote to memory of 1940 2040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13a0297fa37befbd3420a58a850176a7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b5e35f63a1dc09d3755c194bd6a35925
SHA13c4c881106278489c369536beda9d631ebf9130c
SHA2561a76a8ae6640a089564dbe85d4a780d63128a30733bf188f6fd2575f1727390e
SHA512cfd7071dbf90a7055958a15c8716c88924a7684103a94cc093efd92c1ba1496272dd4046297a26a78f9630395a9f763ed4ead415f8bfa16ae4cc2ae9e1d596d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c50dce80c29d57e7576e1da75a65fb06
SHA187452b8ef2ce8c68b25392b441561569ef6bce4d
SHA256a8c1e40555987929da76604668f91b732299136c0affbabf33eebdda3aafedbd
SHA512a0493e1819824eac5cf9000bd6017654b2d5d344d9ccb8b259bcca23196ea1db20de69c1bae85127e5108d24074d1705dc16a6a2fd767b8c1169033ab24cb245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528f6b8d79796ff20a755e2a0cb39864a
SHA1f1f8fdea6be36931163743c4b2f00e3b5493bd46
SHA2563ee110914c4b6c0a2f786cbb23da43f6d6e96e81103bcfb23d82ac286f3c78d0
SHA512e7024beb10add6f06f0e188da51e242c3b60ae9cf4df877409fc3f1dfa01109a6ee0f459beb977f63e596a4cc1d1ddd1c84db1e039548edc0aa6af742cdbe80f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578be99f89ab976f471c3e70bda953bd0
SHA164cbec5db49bd7c703f4203880bde9cafc773e22
SHA25655bdf7fc341efa07c3c3735ebb1ca0984463041d06491b2e29499210aaf73560
SHA512cb79702144e9f38958f671faa2caf121344d1af373e2625004db64485f7a14026537fb7c33f76df228e53969cf85c68e3750497bf051ac281178501ba4d5791d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca974dcb59bc3cfc40982d8211ad4d18
SHA19a51cf16400b65c1baf135ba5076d95268f6fb3b
SHA256ad673d14be68b82edf2ca7725311def5186c3cfe7cd3594f1c9887f88fb4c8e6
SHA512275cb939f3c4f98e8a15d8fe860e58f0ebd8bf55813b32d42e7d285aaa852f39fb78a1815e3750682290e17112b8c37f8c7df6de0ac5d4b9d7db90d6eff6a8b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51016bc11e97ab03683f19b3b7a447c52
SHA13721465c7a5063ef211488dddfee167872a496b5
SHA256e7036d489a9e006fccc1008b0e3170c88b7dbdf0e5c52f53f681bace1a24bdd4
SHA51240d75fa4f9c81c47e62bd242e41a0e5e8b21051c23d4ca20ed348fa2131a39533aede88354627ec1badcd67e3f8b96aa91097090b10331d6a1537ba7a91affc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a52bc42c9d5caa032d345be8b9478a3
SHA1d1b20433bc88ae8a46c0b5cfe4bbc03bf8102ffa
SHA25603b636797b0c55ae4cb382f35b43d48e1927151fb3641cd8d7865734eeb8e3dd
SHA5121bfc0fc4ba637f484803fd5ee96027b92ed48ef364cb868707aa355880c309b49c4df84712f9417c9c70721763cd0bf9704572cf3f41d25a968f7d901400c7ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1ec7209a2fc70b7bec4947e0739d68f
SHA14523a8f5a4c7a9ba2ba49648c21bdad6dba94621
SHA25646650ba0977c317cb11ad7cdc2d16dce15c1f83ec02e40301f1e3fc2576c703f
SHA51255e5c2e598906e8cfd6615b54af12b1adbdf2e0c281e4eca2254cf39602db61d3bfd551c324d3b60f15102032193dba92f883dbcbd03565d930d2dd96043f24e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea99353f4ef3c3902b8c7e9c157e3105
SHA18809a50e8c5823add8625f44e121267d9e577f86
SHA2566291bef8e88f95ae16a9d31a061c632b3d4346ef8bd4c869f31cd18c2608ba50
SHA5129e76d2db7443a60e8b5206abdc68672b5ee2a8a9eea8dc92387f4290ddf7abbc3dcbc3f13141a9b518593af37da134d722e8cec5b14153f8bcd885617413498c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541dc40b76570524606c73a9eaac07190
SHA1aafe2c65ebc65f83df9eb6508bacde9cfc80d4cf
SHA256d6830c5d5501422471719df0efeece436c8f3c28bfe3d0cd434f7c3081854fa9
SHA51273da7a6e04c3ed948d5ada8700446092055bb884eeb744e25cadfce8e27d0c3980cb00d467ed6992b961ccda3bbe3609d6d095ecc6caa019e647148cb719ea8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58abe4571b53ad3c288c5130ca5f4cfc3
SHA10cac43100fce318ed3787d612e264dee1e76ecf0
SHA2568cd5f6587c8055a641e13c3a7cb34a0c4ece1d13bdebd5feeafc652bf71cd3b0
SHA5125023173256c13a5df1b4cc9c6033c704314f9e14f0351c7c0156718dfc6c3b062c76abfb38e1efed71fbfac9fc4985e91ca0f5d8e506116a6ec211d3f0ece62a
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a