Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
f207e07a216db391c9fe76ccbc2e6a52_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f207e07a216db391c9fe76ccbc2e6a52_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f207e07a216db391c9fe76ccbc2e6a52_JaffaCakes118.html
-
Size
32KB
-
MD5
f207e07a216db391c9fe76ccbc2e6a52
-
SHA1
ce7026044109f2826243d94af85611a75cc58d8d
-
SHA256
4e67677b5f0916a06c7fb6812787295de74c8d4170b595055aaea2dee1ef9cf4
-
SHA512
b55fcdb65672226e43e97dceadf09a74d00877ec7bb1ab831012ef6e216461d407934a5a46db1c80575bbc20a2a541f44182d5b2c9e11e96e4654a56e117b6f3
-
SSDEEP
768:kNHWsFurfri7Pl1Ey+M4ZHCLw2LeuNl3SEqrUAm85tLM8uNKYXfSlZ2SjWLxgkfF:kosIMZeej
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419380616" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000003dd04db6af0165574bad8f9742110a0dce4c4553eb5f15448fb76047af09679b000000000e8000000002000020000000de60328aef7be559f26be1330c0c9a568f30b00c60f50effa88ffa2e84ee3b6920000000192037b3493ce0e699ce5f82c99a4c8b35a7edc8456c8f9fa96bab917f7f308140000000843686ffc7df6837a319ba1168730130a875f94979b8560b3fde876bc51e4f1361f03f750f41c14ba28d868847c861a388ae6c3ddef0911cbac7e4ba13222c0c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ed8324818fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000004ad7e75dd9274c4a350ab330da0f1e6a4cab3623cffd6418096830d739ed7217000000000e800000000200002000000024d02764b5c84969f099c60ea4dd6b56685b53c9a7698ed1027cab03ca376e85900000000f291efe2b257104d96cda0c199c9995e0ebd609229df7e4a49e92edc038f7c4a90668e348926b601ce332cc465da66ee5d81343ccf3dc4405f552f704a98d37d0dbfa33330a557e9f365f5aeed77d50041f3707fdcefd0f21b068866a4443ba9710cdbacc4cbe04c5bf08c517ee3ec2dcbddd0ec5e8653cf2e5f9ef3dcf2895188846b58024c3f3da676b42dbdf41b240000000ca38fd8d8e176773eaeff0c39a51a3f6ace5922d4f16c72f07ebf999ebc447cab29bec702824d90b97b8687e313eb37a097db6c0536c151db7b5f2641aed1130 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F7F8F51-FB74-11EE-9D28-4A4F109F65B0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1660 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1660 iexplore.exe 1660 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1660 wrote to memory of 3044 1660 iexplore.exe 28 PID 1660 wrote to memory of 3044 1660 iexplore.exe 28 PID 1660 wrote to memory of 3044 1660 iexplore.exe 28 PID 1660 wrote to memory of 3044 1660 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f207e07a216db391c9fe76ccbc2e6a52_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f24dac13ee6e4230b9edf6f398ad58fd
SHA1950be30d25d5c4b42fdc5e81736b6f39b64dc281
SHA25632b2d3322c7f4ca0cf6c1cbf0bb0798905f004a0a31b6c5f824ba4cf080cbfdc
SHA5127e01e3cef765cf74d1da5c04224734e44a698317a1ae7b897c94af2881b00deacec84f8a66a62cff67a6aea0e1a3378bf7ce27b9a16a91d872a15f06eb968d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5100786cbfd167dc1a9cbf71ceaf7facc
SHA1dd4a7c9caa836ab7cb63369aa1bf2829b3fc9d31
SHA256900465ed5067944a6668b99eb0cb24672b47c62db2eaf7b8500fcfcbd05a8a90
SHA512434c8e671c1fe7734b44a9ffdc2dad75b95392a192b1eb7a4fe3744d200020d855f1b1e68b1b5d4462717215b4ee60c34be7e2d19279bd5c175448bf3fcc378c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6369d749a9839f742d7828c73a29f2c
SHA15a9929d6202ccaf08484a550f391251848b882dd
SHA2563dc594bb224f551c522837dd72a55bac705f72dfe3d206a2ab220ac0f730dd3f
SHA51245eacd6122634894a2a260b640273e1e163f9574ca03e6f6ce6f9506fb69d273453715b6d0721e5be31e2aac69f4fbb54a500efc01335cf77eb57778f48dc02f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e16fbe203f110393d1ed83ae94284a42
SHA1dded62ac9daefbed995a6d313f22c542451e6c15
SHA256f990950c5b7869cf63b918080aa553569c09aca629cffcbf1d65eee671a261ee
SHA51249e5b9ba438944c9bd553b7ddbd70c1dfb1a604461ca485391dc1cb1ff69c30d8fbc63b2f3a74e93e84bd05fd43a0721211fd8a1252a697fad7568cb11ef3ec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5026efd09a732393ad61e80eeccbb881b
SHA145bc7a3606633ad68660d13258221885241d4a5b
SHA25605f5787a0856c10841151fbe841786d4bdf4cb1d97be7c285b871d33a0189fe9
SHA512c3b81498bcf68568a621bd1c0651ea527754ce40cf0cf96cc347a344a0b02adbd49d1de63975425508aa0f4dea680eb966a567f5b6f39ab8254c7c744722dff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512a2fc2b41467f9018e61ad8fd2d64b0
SHA1e1332cdf5c6e5943c59b2534a176ccde04e42934
SHA256e00654f17769f95b2ec05c0379be2bc21600ce68c9ad75fc16f55e5fa5edbf49
SHA512d6bb6db3aa41f8b69faefc865707b314e1ca298a2cad6589489fdf774b566bcdb8c5fd8377894331b8c963d69f79032ef8bafa25b559498f3717115d6f6860f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5397ad6c6da0226e50d0b6592c429a98f
SHA127d909f714b8ccb2fffe376e2a0d4cf17161f4e4
SHA25620c638697119ae66f28cad7d7659a78a0d84a3b480b57e5707e8a86194ace343
SHA512d52beeb2c99b850a7c88efbe96fd099f3542da2b202b86f3ef56ea53af988caa6bb1f5968fe8977dd83efc26d9773a053d3c74d5f65c78d73fd2322f54a627e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e83fea2d09dfbe04250fa68a52d7062
SHA11c553004d93bb90d57ea83226860474757531348
SHA256c3327df10cdc3108f66ca264bd550e372ce07e69699a300ff8da13a46386806d
SHA512149b82b1c4d82a216051f2c69ac2fc51f32753352e99027c5ccf665e5715c6a6d904a888a9015d3d527cfdde722a135a09449315d47f3584e12ba4cdcc7960f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c66eb20ab72a000ef3c073094d29803
SHA1955b37ea5dad5efc8b049320d32e5e51ebfea132
SHA256027e05231b11f3e640d5cc1c250654cb4e26815ed57ad132a30c8222126db497
SHA5127c35616d88f501b67e9f38ade77133fb828fc85b01d80476e6d8e3394f76ccdd4ac033f733c6183df1fccb831d012eccc79ff579755605a42d8f5fd5f062c427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af7689961c3731f33b3ea5c08f0a3a4a
SHA1185b353357590cc18538b9ffabbac9b2b159a5f7
SHA256ac95e12b2010fef0adda305c5277c653db10ec04e6626489ea15b03314bc31a8
SHA512d3c64ab1801d7acc6a8bca342e5bbf71ce2cd7758a71e9dc925ed5d86bd6345e89fbe6b078c52047b31087aab99eb1d9dc9623f202323d60884aecaab1b6c08e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a8c093d765f2f3410321ac79cf43a8d
SHA12a1607eacc5f4be529987f4b4d653f975f259a1f
SHA25620317b481cc4b438abfb4cf70e8337477c40ae56e15a5df27038dc47a798d64f
SHA512711afcd1e9529e8e1294286cf564b93447d22074fb3a8c586639144b68044aadd71485001fa82653e5da5ac6e94ded2ef413463df46697329b1c07872020b4b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df2eb1905a704042307076959f500a4c
SHA1f7832acf8ccc2967ac57b7040b01abb94f4f5e8d
SHA25602fea9612a7eeb660c89903711c7452739e422384b1954eb579a7918171ff667
SHA5128ea969cfd14fda391b15224937fea048b326be0c1a05850c0be495002b4554ffb62d7b1094e0c8abcfc24328ed1a4bddcaa2b5776a3c3551866868a4c141d9c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c238ddea2281b76a2c28a72f6766c621
SHA135c6906ddedc26c7744f4919cfeb68446ede3972
SHA256f758a2838c5ec615ddd2de75e610da6b7d7e0350ca5a68825e8e7fd50c7c72d6
SHA512b5eed23039ab32c198bc24045483711d5c2e4db3a6b734b2eaf317e90769991ed4f8ae6b73ad5033cd4f1c9c7e79b77f49973d572d901a38448395e611a8abc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9af7dd2a5ca6794391d8ff073477d22
SHA163ce498c75bf91444076502fe38fade78c54bca8
SHA256e314883a97397619783b738272985f6b3dd6ef9912560a19bdfee54daca25f71
SHA512af17508f723099aad26b464e74d1108806e1e0f8dc60514bf29610216d3c35ec96dae3fbcc9c00086e80bc07e9567956c98b16dc32fea3285b38ca637bcbb951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fc927e665687e02ba98e8b8792134b2
SHA155a5024bfa39e854bdbb70b56c0a5596ec09ee9c
SHA2569cacd06a4646dbf847d6a686043b8c2983050ec3e1ca5471ef45c0e722787f20
SHA5125b77eb8e9af4775971534277131572d09bc96aaa8e2c64d3f9be58ecc2cd56862814dac3390379485dadfa48696a9428eb116a9016b84851c4162dee2e633307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f0dd0b85bef6a445d44ca1f76e83324
SHA10c19836a4293d9082519f677fc637584675e3322
SHA2564c692cc18299f309fcd3253cd192a187a7e704da4628e596f7ac20b5e0b6286b
SHA512a2767fe021c99e2ba9bd22b75cb6424e0c85d2d84df4b2ae0ed563b78bb6d93b8e2568f9583bc6d66afd3d66a001873e23112bf34f35ab0997e171400d65944f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52caf008feef095bad5fc6d8be0a61aa7
SHA1241f14616537c96e7b8764e5c9a31349254a0426
SHA256ce22879ad938a70defb989b52aec73655f950ea83f62d32b2f9a23d1a06d112c
SHA512881112e3d4fadd3a164b16b6bdf4066d6c8bc4d4b7840ab0c32249a3f44c475b4be6d7d8c125233adcfc1713b7ff387b1fef846308edca761e3bb76f7f9525ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bd745e609026026ce7236919ac77b89
SHA1b0fa421ccc31e8a76f0d2523cb5eea35196acf8b
SHA256d3c43aab93853bf8669d602f7aaf19ce7f333c2675966efda03a3b278316d636
SHA5127fe9b715ccce135d96fafb54547f09d40befce9a75ab0b93b07a3e8d54400a6b0bb72cf007ba892b3aee1ba0196062b7aa04062070e876305a3939e70d433ab4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a