Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
930d0434f043632f51e8ba16ab019270_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
930d0434f043632f51e8ba16ab019270_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
930d0434f043632f51e8ba16ab019270_JaffaCakes118.html
-
Size
101KB
-
MD5
930d0434f043632f51e8ba16ab019270
-
SHA1
23d17ce9d1ceb3345fc4c481f92229045cc93ab4
-
SHA256
1531a168a45081aaf35a37c99c379f08503e4cba54ad01f0fda3bf312a24ae39
-
SHA512
c8362812edc28cba280721fcbbe4a1ef26d69074f003ff08c183bc6950e5eceef80364d7179c09bf1b3799221c39194475df2c217c7d4814dab0170517fb5372
-
SSDEEP
3072:xsCXf3uTlHIwVslTQ9kEWzbjfQ8Fkn5XV3e5R5F6n9DKKDpnSQDBjkcilRQ:tlTQ9ce
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423621011" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DEF71D1-2205-11EF-8706-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2080 1612 iexplore.exe 28 PID 1612 wrote to memory of 2080 1612 iexplore.exe 28 PID 1612 wrote to memory of 2080 1612 iexplore.exe 28 PID 1612 wrote to memory of 2080 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\930d0434f043632f51e8ba16ab019270_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD592e81688a353ed7ef6c85fe82001f21a
SHA122d1ad2eaf407a6a23cd0abc296d43af9c77f713
SHA25608e1b732c3d2c3fcfe35c1971cb01cba898098cca48fd48aeb5ac86fdc86362e
SHA512ef567936c53a7e327e1737184b5fc7bf45bdcbab629f169d98050bad204336ee42ac5541c6b5017cc585e1fa07f72df57919c7e5c7986a997ee0239a96fcf785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD528fbf92bd561be42e317d8c30de9b0f7
SHA1cd4d07d4dfdec69028450e987c1c2d0a4132715d
SHA256e6517a1cfe824ebc044087e88ee0a35d144a4b4fe73e69f6dd1df47a9103959d
SHA51240e77cb1037cd738477f3afc1e3c00ed1f4292237524efe0ccd1f709347710faae486794180cd57158e58d891304374daa819ffec7756a99866d3fb1269406a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5499e9145b066e6bc50e763aa70be1cde
SHA1f9980e85583a618990a0a6be409881d08374f6e0
SHA2567c64a781c172845cfc073f8faddf6b4a37c2c256fe80c4c267a1a49fb9eb7fb1
SHA5128317010a9ae7a5a248ca0fe655ca6114e5eef557ad53fe76453ff528e2e7af830aabf8503e49a00e3b09bef2f4711b37bb754a6dde556782a3de292f17bf06af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD59438eaae0cf8727fac389d49923d2e51
SHA12789b69b341f0da642fd33bf03c47ceda52573b6
SHA2563f85fcfffa671227563273b362ba9c218c103e44a382c1010b3ea68584da3fcd
SHA512e77674fe514d3b8046694ddbb4d4fd84a7a213f692ef646a122aa1736e75392ac8b7a07196a03268273b60fd45f8f5599561f2a0686e43408d44da5cdbb1c69d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ecc5cb7b84ee3259ba03dd6bd186a036
SHA1539c47f1302f1e8eedf1ac5a96fc7cfc9787a92e
SHA2563a1ea6d8b31aea44c3b407c92d74e546520d91fb2c6ac42ccdbcb1573d7fe4a2
SHA512eeebe6dbaef054bc5d8d3e1825fc6777d52e3bfdfecc2a3b1aa94ac5485d570e4381ffa21eb0673e7e17e5d4a052ecdebfda63f2f23f8acb6d1989d743bf589e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD545ad06a1ac67fea9e18b427b69a50690
SHA1623339482cf63ce222596d774b4a7084462c5fe1
SHA2562477c173214dc3cde795653da4c9c73a37d27a9c0f3ee9f9eb15814de933c20e
SHA512e3a9086964ff67c56f2d35cdeb78c603f1bccbffcf4063706b9c1d7a2e8f2989c7529d5c02c6656f532ce8d2d94bf1ab2966afa1642670f9e59b0421b1828f0b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\css[1].css
Filesize1KB
MD524db0cc20ba2dea78aaaa2c634eec6a0
SHA117341609cb72e12ee5b50974a2382fea78c9596f
SHA256d04e5e707b79c12f3a303746144b9b261e8ed4b3343f8c98d0067e8f74c9d31a
SHA5123d043cc467e3beec086e9668f5a01a00d36eb029a7be3bf1d3c4471630dfd50212f796638cabab1235b43cb6de4807054f4465cb94b5c53b76b25f953d892242
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\api[1].js
Filesize884B
MD56c70a42410295cf720bf7f3775f304e1
SHA131af2a94e210dde9406f340bc3e92fe0128f5535
SHA256f12205aafc7b1c8a444b2b6280201434b3d13b677ae353ee7d8577dae1a096e0
SHA5120ebbf0d582a67fcee3fd6d522639b7d89b48efdb0c40b321ca49999c3cbaf0f82ef773e1d17bfc4a24704e57f952b679079108bfa068f415011caa8a4ac35f9d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\css[1].css
Filesize412B
MD5a832de91713634db948aade72006123a
SHA1508c4637f28aace88a51a2d91d44a62796d148a7
SHA2569177f667e9cf8c8f89291760353c04047926a3eca7ca7ccdd49ec882b2ce271d
SHA512702381ef3e6627e9fb7846345e5448d5dbfb3ad09c4069cd5945e1e00de9e993d3b215f762ab0b12dca4fc926c5841edf16319f3534d5fb10f21fcb032907630
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b