Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
90ae2823be5f83ae1aaa3dea232e44e5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90ae2823be5f83ae1aaa3dea232e44e5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
90ae2823be5f83ae1aaa3dea232e44e5_JaffaCakes118.html
-
Size
17KB
-
MD5
90ae2823be5f83ae1aaa3dea232e44e5
-
SHA1
c1ce09d92ad6b2eb935dea0ac8008ac6792aea97
-
SHA256
a09422a42415f41692e184d3c7d2e93c15f6fa3de87a583fdc8cde8aba26b1d2
-
SHA512
f823185e0a3a55fe64e84456c9c3078376d267114f500dc40f32672579837c64c1185b174b57e6d36eb77cc184d9bb4cd5e89717aaea2070c6ff78d64128ce40
-
SSDEEP
192:/VZvJ66I0eekl/Yt9bDkJiDOY7sG7dCbLZ/oB8KubEtAoRXWglV7Y4oj1JVy08CQ:d9J6dVmfqYq9oUgrfqOFCoN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B03D0B41-2169-11EF-822E-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423554198" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2340 iexplore.exe 2340 iexplore.exe 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2344 2340 iexplore.exe 28 PID 2340 wrote to memory of 2344 2340 iexplore.exe 28 PID 2340 wrote to memory of 2344 2340 iexplore.exe 28 PID 2340 wrote to memory of 2344 2340 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\90ae2823be5f83ae1aaa3dea232e44e5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5854ca2e29a64fcc0052fcdbb421b3c8e
SHA1d83651232b7513c7c4ffdb2e0c019ecc35049366
SHA256c4830444c3ac4af9d05f08e474c7abf5478e151213067a6007f02f23069008e6
SHA512cffecec54d0d640ac113d4abbbd33593f08b3bc163dd5129c82e88839cdfc18584a72a1c68db468e60da6cb0bcc1847fa4c8fe6b7fcbbcd8c9ca622f9a550eb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD547c702fac329dceb2675e0cf20de8bc1
SHA1c14b260b008b27b41d55dd9fd8cb9fbb27abdff5
SHA256cb5a41a23372eaf1f8676f8f5ba20998915aecfca19de449dd4b93017aa9ce6a
SHA512ec771ed62ef5eda7c04f8087c2f0227c79c71f2913507bba88f796926b6f91c0870671de4e346c158127cf2a5f7d732af7dd2e565161a3ad9d73995326a1f489
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bf0626894b1b329d281f9da9aed2a555
SHA1be41a2d0d011b9b30d360a968efd2b6277ab01c9
SHA25665de7abe7fd0e2946b2f3fdbbb508ca75896557acd19c7c52925e8d2d640ac86
SHA512a42f90fe2f168b6e90fc000ec9180f4bf065f8c54f7b27ddc962dd8ddf58d6d19a9fd5b7d4ce3963f22206d97f5c690039c5bcd7aba173c53dbb7335821e8b79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50adedebf5b8785921a8f85c6e3822efe
SHA1c77d61c0f5b7b7355f8740a2aaed7ab9cd6b47ff
SHA2563d3368342606b5d19c247575a2d101e6de6b2804966086f577eb1d12c1f52c44
SHA51219aa110f5cda5265b84975beb96da2fdf00b8e9f3144920b2b625098f5662b4563954f44e9712ad03cec09c7737e270fe2b7742d18ef48309c1fc258246b1adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5064aaba9dd667f1befc7f35f52126fa1
SHA1e8b03513ce577c966152857f7c99a385192053f9
SHA2561bfec803733e84f0cdafd7d471fc0a804aafbe57ed92adb4e02f19ba51a8a70f
SHA51221fc84efebb9595324404c247ed370944ffb7520825e9ca281d07fb6571aa95a2855af525bf7038cf1206335e99e204632e6439421d4b125e9f59d168ba2c5ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58b6afd54dced0c4f877a14aebfa2be56
SHA1d2b3264a4daefb3a9bba52ad9d5b861f638856c3
SHA2565bcdda49502925a261e12d1fb04412b1576ddd547776911e6ce324b27c5b5979
SHA51246b163103293d615cd02e8257a9413d0978d86748ad32b1a25eeed06bd29dc0b5ac21a9c0100fb0bb7e5f836c623c29706745a109534b27e519e6d9b961eafe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD541335d6bf49cebcfd3503549245bf45b
SHA10b07b4d7dd90b80c12f520c36ad9012683f5dc41
SHA256a3660d447e7ab93fd5f3a33aa967eddcb802f823ec438fb5ea0fa1179230c5f7
SHA5125836c1527586f951d974e75b815ac448a5f5bd09a49286483bac92e3e6341092d8e0b94381685d76e957bda214f2e5fe3ad9c057cae5070a82eb8238675a1e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a2bfcb6c8c3b7da07cf5f25cc53cce36
SHA1dbbb21263dfef7748766fb54bb13b76fd859d1ce
SHA256e227a1b884198899b988a6388dbef41d5d4ab0832f428f9e7b2465845f9f6688
SHA512798d62c3d586aa17cd0c2e040020619ae881835113db2c0a3fda4df003592cb1d968772bd5a954ec775f80a77f75c8188eb7e1832ad0bf6ec01f60f4c56b6654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a0473f4daf9e253b5cea7b19248b6d26
SHA1bcf85d198b3959b72440a81b74bb4b946d164ce0
SHA2560dbec332333ce1e0d7d13b61f5e9a5148a72428d923352700253d57f5db5601e
SHA51243c0b7d8c459b24fa7400d4f1a8292260c5cab47914ffb75b429d13d69f1a78c0dbd661b918458542f196913061a79571c1ae23a6e2be6a85b060f57142d4167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d59ebc928ec25e6e86d42904c9db3d5f
SHA1514cf49a29ee171e76c202469b27c0a85954ec73
SHA256ecee66d1b5e39a9b0922a1595a1a782a1101037f920f3da2684f65d46e4cf21d
SHA512231dfa5ba2bfd73bbfa297e6c481ef2fc846cd04be38b21631338626d5d05c1b0c05d3e43a52f58559faedff95b2c8cb1fc3dc9380e6432d5577348b6561b907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53d5bc4961d5910b31383d3e8cf51d367
SHA1b217b0d175c621ba1530d507cda23621bf005252
SHA2565945a73460fffb33a0ec6baf4af9162cf6f1d210028aafeb77b2244ec8d88ee3
SHA512909155a8c862eef73459bbca042c3c68409b89fbc81203a8be63e7968514d9e0dfcfca10a9f07a38f6c438fdeacf4f8b98889d1585f989c234ee35d8aba919f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD560bb2a5cbea3131a14306a13002cfbcc
SHA1b0c2b42f4800acbbaab90dfc3bceba122dc70ded
SHA25608387cea0b2d3286432efda28475a3569ff27d605cdb296d22a7bad89de4c86f
SHA512d90cc744a856f6bd1926aa83a1f4d13c141acd41e2a4b21f10f1642759039238c7b1e67da520986ac2f6c7011378df1c53669fc592f364b1f00cd4776a2c96ab
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b