Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
3d3b0d910f542104834215348d652b10_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3d3b0d910f542104834215348d652b10_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3d3b0d910f542104834215348d652b10_JaffaCakes118.html
-
Size
20KB
-
MD5
3d3b0d910f542104834215348d652b10
-
SHA1
eb3277c728078cb68c91ff5f9992899d9c318333
-
SHA256
6aeaecddbae62f35779caa22993a7134471a3887c8e5522968401ef7d2fc6f1d
-
SHA512
1a4f83310e73497e511d702c789901a6cdb9484de773872071721980817c48e5c7632ad205f926288d538821be603c45780f71f6f383c2bcb1112e47f8a40b02
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIf4lzUnjBhPh82qDB8:SIMd0I5nvHVsvPqxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421811421" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F95B1C21-118F-11EF-919D-C273E1627A77} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1652 iexplore.exe 1652 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 3048 1652 iexplore.exe 28 PID 1652 wrote to memory of 3048 1652 iexplore.exe 28 PID 1652 wrote to memory of 3048 1652 iexplore.exe 28 PID 1652 wrote to memory of 3048 1652 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d3b0d910f542104834215348d652b10_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50f432d12d4824dd0169d5f3d4dcb8232
SHA1d690ddec91b11ba95eb3421323e81759fa12df4f
SHA25682d96a340374fc59c3282c4cde6ee4d900c50eef2ab6ade2cca4741693bed5a8
SHA512f0d0a27246dfa03649c575d74341fe6eaab35e5eaef58ad38a58cda7d37008fc94c71dacb257265e2fddab42db754061c78f56edfc0ebfa2c9f306b5c73d094f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d099aec41073c23d23eb9abb2350b283
SHA187553520756a381168aa0d64d209504c6d40c4a5
SHA2561391d891708c7db9704ce2130a55e78263d0e80f8d4361318ceb40d0bd43fbc7
SHA5122572a26b2b10478fff22e50debf233a3765965c9406160fc93320f453d89dfa74712cda092e3bf60edfdb64836611e8a0e5b845b20d932dc61e104f99c7aca49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b120f9aecab951c56a184df47601e63
SHA11ae9c4abf86e76b82fc2e443987d5d39fdf44818
SHA256764807269684f174fc08301797fd00ab7efb3b6b57a06afaf482ec30578dcdb0
SHA512b3e0fd39c934cc7cc2a8529ea8da6875dffc4642bbe53be415bff0be850ea8118e05920a35b4312053a00fa3943161f22fc108b064485d05c538b956a019d5c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3102f3a7792c474eaf68da796bbe8d0
SHA1bbed77ccc3aa8837d4b23f88122613c05e51c555
SHA2563d86723787cc28439f7d2ab48f5d31e582b66216280e775fe93e67a61cec7489
SHA512bfe76b0b16223c1059695f42e0fa1f5130f1104c017ff9d28477f15e734109dc2696daa1e5af944b013466ced080db6cb5dacb356ab9e85d7351b91647b83e5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f181067b9f681b6a2f1579b37ace25a
SHA1c8d826fd8f02842728642fe7f6f8aacd3d6ef632
SHA25640c777328ba3b3a40a0ff9c4f45f338340413b246e0a169f2f942747529caa4d
SHA5123fa0fc359368fac6b046dfc9a72a0c9b773b7c5109b66e839f8230716ebc904852b16d9277e5e12134a7383ae4bdfb1a0435ac826fd1ed4c8dacef2c50fdfb5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e236dc19dc7117f1bd1ffcc15c2383a2
SHA1dc7d21794b3476653a771a187351a8a9ad0bb1b9
SHA256278b2f81ae101dec14ecfeff1d1b77c8c04256169a763a74b5f376106d821d04
SHA5124336ece1564ea29e92a2244e569a614db62305ad8d9f1d4855fbe78566f008acebaa759f175315a77a0c04dcb51a00efaf17024b865a93212ffe883fdfdb1242
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ec75ca66d1ee182dbae21adcd9f1ae7
SHA1de83b38ce3d908e683825824649842f7b307f42b
SHA2560da8a5838afeb4b35757ffa20be4de8c4c6c9fcd3040bf4dbf23c0ed2f29a2cd
SHA5124ce24aef912ac1bdb340c25c170c3b4bc7dee936673a70dd2019e787a37570a87d83f25bf7f4d9ead2a82327f4d6f3f82c21d2b82a1600402ac7ade32e32b5a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3070e4478b1b9237832b05053b55e54
SHA1e2afbe42e7dd16c4bdf665adbd4364ad5ba2dbe6
SHA2566762476126d0bbd4fd89dfa7f4f595ed94a1cc2330cadae87ef44473a44daaaa
SHA512ab3c5b5ddda4a7ebd2f84c67b49ad47691663b265c5a064f09593ac4c6e1159bf4563e4cd66a89baecb1ebe55046e03b2aa7eb87114aee56dfc87042a65f3607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7ea6a3cbe240c6ef15cd9f12d679b00
SHA1ccba6037c69d2fc2a826e956229581fdcb36c491
SHA25643f88103674088b30199f1a4e60db6fcc4c6a99ee5e6087dfcf48eb502e2a7c0
SHA5121bf0b858c39069b81a486ae9e08b8e4bff41084f6a25f96ddadbfec4890c0b02290c1236068b5308dd836dc2bba05feb62c213cd6aa775a870cc757ee2092aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd8a7ea00002b2e6ce99ac993d03ba5a
SHA1c5a3dc09d63be46c5ddfb24ffeeaad3c69ae1816
SHA25600a56dc87ae2d854d4f4a6096eab80dee98e845516e8f3199bac66c11c5221f3
SHA5128850fd81400bc57baadb699d281a23416afb6eddc8f29760de32902e06c9945253dde74dc884c8ed88da47dbacdfcbb1413be7db3a7c5335cbc2443914779992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57eb185f30151acafc01d74cebe88cb7a
SHA19102a9a601cb5c2eb37c55cf003183119570d758
SHA256be524b4c761b27caba447ea1b4bcf5e056661d436ac5b9924ad735a6a7fa4de4
SHA512cef631b6a096bb36121f22f5f2430b426c248d00d2dcaf9db5396350aad8370306cb2a3b2e1863d4e4a319cf4d3a5c8d4bc7ee674477a97b6d9a2c0c10088653
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a