Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
00cb96382c95b9b577ef7f7148812a77_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00cb96382c95b9b577ef7f7148812a77_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
00cb96382c95b9b577ef7f7148812a77_JaffaCakes118.html
-
Size
221KB
-
MD5
00cb96382c95b9b577ef7f7148812a77
-
SHA1
8a330859c0fc17f878500fcddfe14a06c0922d4c
-
SHA256
d09722514362907a983d20a467befcba478909c24e0c593ec6848c13527f3cf4
-
SHA512
7129907492b4acfe3f8579f4b198fa57f0fa0049f56b9d51258f503bb8406aa33b8e4e89636605f610334fc142f145501d653ecd82e943bad803b944d77f44e4
-
SSDEEP
3072:Sh8SPFrKGLxAyfkMY+BES09JXAnyrZalI+YQ:Sh9DPsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68F1F821-03CA-11EF-B2DC-EA263619F6CB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420297204" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 1960 2904 iexplore.exe 28 PID 2904 wrote to memory of 1960 2904 iexplore.exe 28 PID 2904 wrote to memory of 1960 2904 iexplore.exe 28 PID 2904 wrote to memory of 1960 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00cb96382c95b9b577ef7f7148812a77_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e8d752b78807f94f03d39d0981ddd07
SHA1d3ed8280677b4b38167ba5ee20a03478dcaebdca
SHA25685b8f23a80ef6a6a1732bc0f9f1fd99cd74c9eb0dd8b352d1e5b79b7397ee295
SHA512bd9e54d3f3389c1ca0a223be7b7c2af027caa68e5cfb5d42e9e654c165d2f593bdbae549775030255e9c4d3e20ee689a08a74c85355fce3739caf0d3fdc94ceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ca54e13a7614f7942ca17ef84bab7bc
SHA1f6c3bab288edded993442c95039178d77895dfcf
SHA2564fe9575b375218e93515ccd3b7cfbdf3d7c53d4ed056be19498d87e0ed419bb0
SHA512e42bd0e804c1ba1786aa75183ac62932e90285618c677a194aa94c34cf6816811aa474c96551be41b8810eec5414ecd37cc0da04f2a45ba089c2c269ef496c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eef8531c0a752d5ffb23f4ab43ebe4da
SHA1f98c5712faa21b744b238729edfa384dc3f26685
SHA25601b8f4740df1ae908bcbe810c31b53060e2102c075188a168a0141a5eed07894
SHA512913fb2cc1423838750316f2012da2f0894ae081d95694a10e8e8ba3be45573ee1ce3230c162bffc00409cfefd6c6c5b3ebf677f6963ea1c0099cafa43abbc5ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed30b961378109ffe12bb681e2292080
SHA1e1ae7717c3a84e98bb59beee57ee3255eb264f31
SHA256b8ea2c02463e079a834fae2b2d3a60e5362d46623218ad276f080d7afc568894
SHA51213f05bb9b54ada0c2b9c907624520e5477ebe9a673aec65a566132d786a04013ba9288fb8b3ab958279572d31a6ac95fa99e12f2ed6f6205a3223f91a172f0a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f98cafa9e1301ba2a323e07c81ebd97
SHA184053a4305a0ef17f14e1655e4e17d859a0b766f
SHA25684050c2d9434bdfccae9b2ff2d5f9c70a69e82fd378954b1a7506c70d7c9bc1d
SHA512fda8e1a210c3081486581e9097d122430c7aec20f60921f900e07e93e2b3645f75aa109ebc52dfa4a3f9a2b95ef9a2720ced61158f43f0d1f57a2b4be91596da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5713d53ccf69bf98b29c8fe50be616900
SHA14c793aa4e8b532f25f663d2fbe20e75cfa9d00f7
SHA25667d744e1405d024fdcdfafedac079888d4263817227238bdce3294ce060a08db
SHA51234851c4985829fb89acc8736663fd606bbb9f8120528af371a0faadb8454724de92b03611461f0c3e012768b3d42be4e89f40d4335246c9f6bd738e1efda4fad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503f772ce60ebb71ec3a87b6fdd2984cb
SHA1af85daf245c91a6c092e94dbf64b6196028d3de1
SHA256fe0b919432014eaec9bb059bcc5f9d6f3eaba7e9249f8cb61050af343b6db67f
SHA512ddde484350e769e733c25aca4d58d50c5b0df4f7bcf11d11e98fb1a740e4f906315773d6035059f3ca3602594a7b002a4b2760bfd10c1edd994255265e5e18be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1bf1a936287ee6c02d9ba9695f0933a
SHA109e7d2847d67467a7e1eb4ae95fccfa5df5dec46
SHA25627928e3ed4c18d01e673de437aef07bd91577b409e7095b4059a140ebebc9805
SHA512fad3304bf68e2e2eca19ee772f918a40d2ce4cfe86a788b48fd35a2b4b9f7d599e84e497889aecc0cf8ed8fac9029d958d7fef99c07157e4fedca656e44176b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db955cf1d0baf9e557c0da6fba44953e
SHA1d407d3a03bb51a7cf841b2e2249845595b060231
SHA256772b3843fcfc2d8bfd0bd502d154f8561e4ef16785b96c5981766feab6ac83a4
SHA512cd1d8d5dbbbf2658a1834a301d9b20416b7c1988e941016289f4dbb8b61fb05b77d1faae810e1f2acc357dedeed3b8e03660710a351d8b278ce7f75adfa615ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd6197a474b2b1dd2ab49f5c17592557
SHA1c29cd27245c206e39e23b35f65d7b774433676cf
SHA256ec4dfead19b160374277548ddeb23348b0f4e1182b14a572b8aef12e831d5525
SHA512c1e6ae68da589e36b43530fe717bf36d45bba0cb0fb4e2b896cb4479f67c0346bf68e64ee790e9254faea2d10c116afbe9d75e182ac5a97ffa41e5ec12caa334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d17d94726af5071be5778f5178983741
SHA1ea73fcf56367b1ac1f47b5005355b1c099d663ae
SHA256724dd92f3aa2909e92c1a068f080cabb2d78e1f45dfc6347afc9de29bfdfb757
SHA512fd9894b4bfe700392857647723d55710b3d8a774f072a6fca5a0d8dcdefaebaea7157f15b941e7baed17ce3ad524e59be732b70c7f8f3fba4cae59c51875e5eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c5bebe1f07cd6d04ae5607d958f5428
SHA1778bf6ae8844b9ba7bef22893d2cdd871ec1f24d
SHA2565cee17289e11b73681a42d3f21e41ef388571558bfb3365a10e33193dc689d42
SHA512a2c63c4dd6be6b3abc77ea23866ea01529c69dd756e7875be8f93dda7f9efcbea7933e1e4178181cea6098ffd3d648b7541c4df4df6f5e3432a7d1dae3cc7a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561398f71bf6c12c51866dd7b081cc6b0
SHA1ab961bccaa8204b6c22a0e4d484c180d34fff94e
SHA2565ff7115370d02ec86730c39a8b9a11431fb964bf7bc9652dcd9c41e1c380e0e6
SHA51233b4600e412f9454e8158d34facd7fece832e9b116a8c17b50ae12c1c33b9f0adb174b58a36ca09bf3e196c1e9d976a9367cb170d176d3197a702ba8a2709ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e438f44a274a73b77e194b88a547dd79
SHA1156853e6492dc3cffdf7c06ef453c084d60db0c3
SHA2563ffaeae0e21a11fa18d226f1fea3056014fe1bf049204fb8062a43aedbaa7d61
SHA5129cd66f14f0b0fbeefd1766085449318ba04bd300fef7f62c31a0953da3cf3ead4641651ba9b88503c06d959e757105675d438f1a25bb0de365ab0d2ca22ec933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5128ae7006e283c03e090a8627af23243
SHA1148ce984206413615efd82e1c6c4dca9ba6b662c
SHA256b9630421f5520909981c3ad3f0c3d3486fccf607030c2c5b77708cd7d342e29e
SHA512b41757ac84948830e7badffb1f76293fb6452e56a3a65b567122e00fd33f314efd4c0c7710ba8a000838a8d9fe63e0a589c49995fa0d5d9c4e8e9afbcfd6daf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a75d506ce470bd384e07d7374efe289
SHA11cda58ab10024240f3b5a78f8bbe1869bc22abff
SHA256910bdf03912bcab18a4efa88776c3909f9fc48757771848d54e93e4c43f37546
SHA512946fd1a1df328c4f09fe5fc9c55811c93f0cd8918801704cc0e2d07dcd349b3006ff0a8f8d4bed4ca9cb838c20b5bb7f1e18e63206c084dfbc32e20d6c2dee82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53453349f17e9693f1c2b02c1e2625634
SHA13fc35e685c025162c2de6095d978e92563e5b7b9
SHA2569b2671f1451463196c6835d2774a3b5f12e09e006869237d79923a9617ad5b82
SHA512aa9666fd2442aa876c1d537d29c32255548281fed97a9129a931d3d8cbc6ef05a3f5a62b6e13feef5b9de07583a3618ee714f2f37835f2f54c17437c336e3c17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1257ff19ff6b3ecb0b1d19d1bcf4b71
SHA1955a9c99c74373b7bf0789e86c8858e90700e081
SHA256e82f166eda24243982c3331bbb233811223b9933d7fab372d4321e5fc60220fb
SHA512df6f1de0f984443618cee93ac9bb51beb6679a1d8ab0975518e560bf0bde4ff8d462d0c3f13b8388b25bb455ee5c9a750136d2173d2434e5364a8f12963bda34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8255b9bfebb08bb7aaef50f41c15b1b
SHA1c0025815e9055184d1dbc05157930def15fde25f
SHA256652b99a3496b6e2ffdfb1a9a69732b52e59839b34cd7cb61185f5152e0aaa1b7
SHA51240333a4b316dfdbee41acf2cafb2babb6b83ee0cb1101d6a66140540b4ee4fd5b6e76b1b122452add6bbe27fe2682641df5f508d5298d74e9b89e5ac6a8d3d60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5898e9d0ed6781a95d4b33cb9c5b6dd46
SHA1a059877483b8fce3d3d36e6806a25e6bd50c3ec4
SHA2567dc6ae0067d0155dbf48c31785bfaeb8b384635c8d2191505392f40f9c131a2b
SHA512d0dbb5567036f0d446827f233023df3bece42a5b6ea82f90317670d8ba2983ba1cd0ba775472db2572a563a4d19eccd1d46c37126af738cec9800d9d9c0fdf70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510538aa1bc7f38c0ecf3706ce4277729
SHA10f976eeb8265afa112c067d6a12a179dc26f17dd
SHA2568b6c835455570a1f5d496a06c1b406f814733eefe0b01eb9bce274a6bc3a64d9
SHA51298b46cb1b3f331df6b98824ea2078851a8b4bbc07e66fa9a0ee29c5944ba8a38b5329dc5857c5fae1db7056d8a91e6a949bd45b6163fafd5b7b2f7cd66428a64
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a