Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
f52525ee70850d2c7a3f70871270995c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f52525ee70850d2c7a3f70871270995c_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f52525ee70850d2c7a3f70871270995c_JaffaCakes118.html
-
Size
5KB
-
MD5
f52525ee70850d2c7a3f70871270995c
-
SHA1
38221d8b77c2c7d855463b0e8ea5101fa42e4274
-
SHA256
8fd62833b847e86626bd467f263ca2984de24a10322ef5261411c7861921c964
-
SHA512
4f6b5789ae124fcda19c7164f9d15cf7e58c140cfaca24288cc14e8d05e0a758acb475935e53011971874b118ec301b768283576119e97820be8bdfcbc760358
-
SSDEEP
96:GM85ajrCv6x+zMgRlSpvKhZMJxdBNUHTiN684:Goj7UMgo+j
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419493985" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000409c52973886938e889ceb0d23d4a362f827965acf1e45f623c4508797c2a8a6000000000e8000000002000020000000c733b89fed0289a917935523f26caf95d547fef4c9cd33da9be7089eb63bc1a520000000ff0ec4f125d2f9f12216b9779e9fb01a1497cac1f9bf9d2bf02701393b60874840000000895ed02c438bab861bd6ee6a89109598dabd6e7a215d6e29d996498c80d7c9ece8fd23bad94052a3aca64b98055ff0f112e7eb29f00dcc9daddbaa82613f1588 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5011e61c8990da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000470e8d78cd70f20bdee85bb292ae9c0825e5ba480704be764bbdc48aa560806e000000000e8000000002000020000000ae5b7b6e2ea9f2dfb38535732c0f6092364be2ab683370ce0dda8c8de03495179000000025eee354110061a14445da8d8af607de138795aa154a59d7d0dad1e2ea3ce156941d307890616db7e0dee3f3ad37ae9dfd4582ad2cfde4671c4d408f387740bb109d2025b104d82a8260627935171d9b5d06f5d1de4209cdf21c889bb15ce98dd2871d792dc26831d9c6c0503852bf9f5f8dcb574c43b40475ea9a0b5e995c839e648739eddf96bc0656d7e6330019de4000000061ca06d013f12bc047d80c7351aa8e090076db69e6b4763acc5c2e7515631acb7a5aa751aabea02f7458a0b236ca44cf1ead15c185be52dc390fbd7479f062dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45180391-FC7C-11EE-B98D-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 iexplore.exe 3012 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2028 3012 iexplore.exe 28 PID 3012 wrote to memory of 2028 3012 iexplore.exe 28 PID 3012 wrote to memory of 2028 3012 iexplore.exe 28 PID 3012 wrote to memory of 2028 3012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f52525ee70850d2c7a3f70871270995c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dbf07bd1b44394f5c06d77e6e0c411a
SHA16ac84dbffc2292ca8a9fca886868cd4bec68d9bf
SHA2562442463c1125661f353cbd2a4b8c796bb69076f1f420f3cb008837d6642f10b5
SHA512a6ce085338ed3c7e5f42900d38ce5b1fe41966244ca304edba0515bf6bf35aa8226637cb3fbac0430f31d3a1962a6e839ad7b5e29fae8f8eda0c90efaf1daa00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3bc638703d321b8f884c3cf0505e297
SHA1bae4b9f74d3aba435b5ae1dac6221b7c29909745
SHA256936a9eda0e8be2d4bd4b7c226aa494314aca0588f178b1ee929c62a3b03db515
SHA512089c399fe40e55b9ffdba48534b499ddb8ea57c053be5bc975e9f25d2819fd4d9b4b390e13a58c04113e8a01c6b08f0f229d038c227a0a8823d762953e9c1931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdb91c0646b147006db75e96ba7cbe2a
SHA11fe388cd9cdd4d36bf7782282285f12882280404
SHA256f8966f4e04ef631f6e54717fe003a07e5aab87a8f4428dbb02dd35780a31b673
SHA5121f3aa8192a03b920cfcffe7d3f43b85e11d1b6b87db80430b9bc06576d8a4c4b723176f6b0f03cb99f108efd51ec633db5a06ed37bc9d81fe856df0149dbe9bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b6c9c2a4243cc9706331e75a20b557a
SHA1d7beefe6da78ddc9a9c20b44f10e4308025d12df
SHA2560be751355012eb92161cc03344e2f7f4033f9c1c767ecc505383247f52553555
SHA51224c5aa62d850c32a97b438fe5289441b7daec5525a8d98d1b66671192f93de7c2dbcfd21dcb2254405193ca28afbf6d32dcc061dbf688a46071de07e74ae49d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de1cff8f7c0257d993a1bc72d875b66a
SHA1c01182afe9409adb9a49b8b99cf9563c186266a2
SHA256d357b843a6b0a3db64fc731d995c71bb87d5ed7d24272006db9b13208f333bc6
SHA512d08304562ddea0d6aa6bda892cedc8ecbdbe560fe4dadb820e3baf2a2ee3185ea767700424bf8828be6e85a2468d6ce066dd51ee9d293ac0b19622574d66609a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52750c0d3339a6ddeb1fdda67211a3779
SHA1352d08b56653ec9c585333f669edc1c237b1e6fb
SHA25662dc8168495b446993c0953f1214e7559a31859d9eda0edb7b4cd637c6e43cba
SHA5126849cd78f2c8eac58db3cc4b0ef86678f5326b30e6336252cd9f9e49b06f1405a5a2c23cbf2a3d85bf79e656455341c9ffc2fdb69c8d19b07ff4ff01ff67fe29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f474986424a3684e814fee9431f118f7
SHA17e7bf9739759267dc709a8efa1b83cfe43bfd570
SHA256315dcc3e60020b75ae0b51bab2e104e5dcef1018e9207fc2fba50d0c2ed23ff8
SHA512c9c4639faa3db366cf6b305aee8306807a2d97c75f8347ce0e7b75653588626d0fb64e713c3751ba2832ba6c849ccd6efed48efa73f9adc935eb3d3e713251ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53af537a0f7477803db73183ecbb43c48
SHA10f95e4c1f9235a22e17cd1cbf75e62e982584a6f
SHA2563cc460e22c21ff07024aada1f318863b1d0f4a720b3c98c5b172803b25b49a84
SHA512e46234736f9d1c28c11752fd7d9b1508b75034bc0e8126ad94007d3b73da5cbf182584467d129b716ce00b5de39f82bb11d1bc42f2bc184f6f3ccb58a98bf1a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50516318ddc84dc93adc1877d9add6155
SHA1d851d4c0715eefa8e7c869672e831a71029f0509
SHA2568f4e14dbdfffb516bafee1d500636c82a6b1ebf310f3a6f3deacc5b94638d8f5
SHA512cced3ca3f5cfed2d454ab9f9b7817f9842eb87dfddc77b554ab8e04c00b2ae4072bbd1bd2953734670b388b290a21446f1d3f3b873b24836570d4bbd07703ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5714396e47312e9e50605f6b531b78d30
SHA120d4d23417b7ac9b2330d1ca62bc9a35a881a1ee
SHA25667c94853d7f3c9be912849c5449c65fe11a5d8f00c1044652ed8db98d10c2e9c
SHA5121f9fbc170a6abad036716a3b02489b5c305abd621dc0f912068eaf83aefc635f1f512a911676cb3d2a9c4960c9485e737a53f744da5477e35cfddb269af6933f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1eb88e826c3e68b40978d655799d109
SHA1355c282f35b19f6121098cc58b9b8c8ee7356de4
SHA256c83233b9196c621921510347cb5c01193f6f6977dec7f911167977710616053a
SHA5129d04f447913bc8ac699a7bc6fdb8fa9f7437a05e9fdede03317d75dd7b89af2bfc2f83fbfd983f74cd595cd11f40bc0f2898b8ac0a216d4d7a19fa76d610522f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c62325b5c47177e9bf0c64f466e4bc81
SHA167b31a3ea75d45cbb59f0f923c769ade663e5059
SHA2561a0cdbee0bc232a75e75fd4f4649a70dd98333755a91559b12a805a235c6e222
SHA512fbeb4c6aa62f5000b90c6692b384c26cd5fa247cc3f16b400f4043e8a8e212267bee591b6f90eded0b6aad636bdfdbf7b8d2d5b3766f5b8537d0481f1f3a2ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555db8065908848d4a98b6e2069d5045d
SHA157459409028159fd3260d0dea3ca3db0b5da831d
SHA256d749a9a65b9a23b64262096bbed71a2424630a2697fb8c2a9c0e5b317b9ad656
SHA512e958288efbc3c9135cc72b9a8a66f27041517e939c77aba8c8992f57dc3c9b2ce1c2dc4f3f0d920a846101624de10e74ceb48440103405e58b360ae573e650c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad16140f49d7a8028e9f8b816934e76e
SHA11a6bea1f9c8f1e6fb070bd4ad3aff3f9852ccff3
SHA2565b7f1bec79b4feb0e828089456f97a296976249f1af97637c7e3b3aaeda1491f
SHA5122771fd0d4cef654c59d428d48de4e96c669b90bba489071df82318e69bea93397d305579850e1051d513e99d2df7e97cc2d32cd5e77f9cab7cf04bfd0e2bb4b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b5a39f3091426d56ccc8963c777638f
SHA1a55b0e7fe8468da6914886ba9e5a4d1308e4ac54
SHA256563d02330687389b17ccc0add7c3c8dd4432097527fe223c060ab82ffbf23fe7
SHA5121e3f29b40b1a2b0a1e637604f22e5da7f727f89d53f2c491334d21219858c369457dc51e0fff9d5bb4030cce139bbb4682e07853eedd03960ce002a13a789539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7361b848420d84b15867220f7a5321b
SHA1001497a0f687a751e13e79ffba460e80f76a7358
SHA256fdf510b8b2ed176245ecd1b975063b84cb3703e77392c3e2f0c3a2a65849eee5
SHA51260b936fe38ab010d01ddd55ae738c8e3ae3d29d58b5cd0f33517f5d1c608042a091a10aea7053586dfe4ef311e86d876ddd2d8ea5a0d2e2f5630965aee6a130b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23EIUNT7\background[1].htm
Filesize114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a