Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
05a1661c89715cf66684c89b0b88757f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05a1661c89715cf66684c89b0b88757f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
05a1661c89715cf66684c89b0b88757f_JaffaCakes118.html
-
Size
30KB
-
MD5
05a1661c89715cf66684c89b0b88757f
-
SHA1
b9bcc6079f97b6f13303dc43f021dd4981ad05d5
-
SHA256
1522476045703a405287e6ccdde2b5379717eea391a12449cb557a554c8ab6a8
-
SHA512
0b3f1e1c8419642aa1f342ae859f042d18a7133dac070f30f255fe14c8bfce0bb49fd01056d4fad451974441de083012635edad6c6449b0e38287941d824230b
-
SSDEEP
768:7YXgCYFVcq4jgGXX776TJZqS4ppcvQNe/vmvNZMijIRAB0292xyNRQxgim6JdKsF:7YwCYFVcnjgGXX776TJZqSupcvQNe/vt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ad00818b99da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b66b58cadb469e10c3467cc0db38d078b2db49dce5abf3efdbd8c4a347ecf1b1000000000e8000000002000020000000ab7a792263eeb44060fa66a4f84eda3337e9fdb8ea2995bbec6b0d56cdadb5d590000000acbfbd7634c93bc55315dae60338abfdc8b39c6e047882ec98de73c8d9cd068dae78b0020773d4f905b8ac1668f94116d95848cc2b5e5c53bdc1a445204014c5458211df7da8d053ac5092b2ea4c804e3acf6aa70851a03171675c92c1b655b8f48b5949c4051958e4397e11fff391b242190321b581692c571844524975a07af5247e21e36c526b96ccb1f9aaf27a1040000000ab9ecd0216650c738167fd67a00e0a9919d306248da4725a60d4ff2f348b000b3ad6624ef6df7abb6dc9abc60cbd0cada2b3c309284d40fd0f60de7f1dec36b5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420484571" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9AD8C21-057E-11EF-9F07-6E6327E9C5D7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000017e5ea89bc49abc0cca6a2401d919642e4dd0dad9a5c3249cf5c21c9699858e000000000e80000000020000200000002f7442d96c0497aff5db2d23c296c496e5796dc1e53395067f06d54b62b77dba2000000033aaec8ed48464011ad79b5fc606f5132594b136e2c5baacfd4753bd14e7c04f4000000029190c75096b8ce53c56c5282c5eb40b7bfa5e3ccb7f0e00f1d930e3ff059161a78d75aa7efd680ae6369745fcd73ae05daaa246c2d6255db3cf8610d5905cbb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1032 iexplore.exe 1032 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1032 wrote to memory of 2108 1032 iexplore.exe 28 PID 1032 wrote to memory of 2108 1032 iexplore.exe 28 PID 1032 wrote to memory of 2108 1032 iexplore.exe 28 PID 1032 wrote to memory of 2108 1032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05a1661c89715cf66684c89b0b88757f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1e637176eb776113eebe980bd223345
SHA176537b5b4401d2b61e42ca839e201ed8ea505db6
SHA25607c8a5be94fc0584cbf794f791c0d7e7967f954cb45b61dcb203605815107eed
SHA512ec72cca2eff4291e490f213ae61c7ba79da5fb01fafcddb87f760490caf0906d0bd6b9c3f4fdf1b1cb973ecc77c2b9143c77aedf071aefd32cddcd49268002e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a3c938785722fd53ae13c7d57059043
SHA19a527e0146be31f2d803a2760ee89a2f76353cd4
SHA25613a5b7fbfb433c81c8d41c701928e5d045366dbfae14de9e50bfafb8023f187f
SHA5127413a5a326eac2c118259faf39312b6b33d3fe7335d3450d9c20300b712e08b5164842cefb4fce6de3cf74e8c81eae09cc2f14c5cff491f18dbeac9bcceea3f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fcf5ed2a63b6fdd7648cf887c90bd0e
SHA1c793dfc143d07899434f021da106077c4fbf23dd
SHA25635f980b2be57429d0d7e5b145ef83c17e0231410b8eb5d7ea1f82ea02df46572
SHA5129948d1e3db9b74212d0a1c2f6a16852e9705af1b866dea119eae276cfae8dac060060807577e50822e3bcd7f1d2953ddcebebb2672910758a2dc0683c63525a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bab2025184fb29ef1626744094610e8b
SHA1332958aa708dc618cbd9f4844eabca0bdc90e7f7
SHA2560411dc2647925eb154942fa0e946a69a1e2083e135f04a29fdf4bdcacc67a0e2
SHA512337495c77c7de3392a62a4e0fcb2f100a887755e37119b580c2f02c2876f82d84b3af4ab8dc4bb6da38014ee010ee0b2fe399d59b956a8ec1c2d1a5bd5c2917d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5221eb86d58a156a541f613ae78bd6a11
SHA13cd90122ea801d0c1b3dbd49ee18a93799aaef68
SHA2566291901d488aa9c8c6b490f87679b62c055c26ac054aee36ef0c5219135854f5
SHA5129b2ebf96955a5bb2b969a005ae8f7020e4111e8f9d5d3bb6be25816042016db5eaaa5c9a432ab80f3b936da953d7181512bc697bdcbf9bbbe4bb34d7ce6ec441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d897c9dce1de567a040154f6a834e21
SHA1ca4e0d0c8245fdf42ccb43cc38de9c1776e96e81
SHA2566bf006ff7a18b74465ce6204b31a6ddf06e3e544a244c5a01bfbe7ef16bc8d8a
SHA51216f82b50f218cf3abcd9f08e976383d65d7868aa500dc0f6a703a563e4c9ae512399927efb2caa541f97b0fce23bf2c4f3346a14f91793f3689b1b6b1bd7812c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a66d7fa20542b907f7efd18b782549ea
SHA1effdf58bc108d6383ba681cda3ac4aead07a841f
SHA2566fd3912236a7dfd891c11535e7a1b4bb23c9bfe4589252231cd5e7e9e0dc50b8
SHA5129c725c477e3ec0ee417ba1fdb88356da808fd5370b2a9c05a4727c32ef9afb491e8056cdec5ecf11c230392f9d9c69e8e0c029a261b4b8321a27b878db8c20e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509143bb779d942ebe263ef381f5775bf
SHA17178134293d985c6f30b071114e8c4532387af6f
SHA256195f966e150dd14e7d9865e553f9fa4e06b1482bf9177c51ba9b6c53a1b48f8b
SHA51238f12714deb17f60a40e694e2193387b88e9d22347d992bd91f30d0286fc5ee7a65a501ce471b374d5c3f00f03c9f0f7f312f341064840090df5beb2c4db1826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f761aeaec36a283e9499b7bfbe4a6963
SHA1a4ca49de13905e4deb411e53a4d8db6c72a5d3cf
SHA256886109735617da91bd0b0c46341ea9c8acb257b1921c299fc6842700e7700d1d
SHA512702c155991efcaa8fab918a8186d9d4767fb25397bf2e6ed516519433007709bc4636c6e1b111820e157b78124316850e72d9a3d2013ba75e12446139c96af8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7df9a51ffea1506c78c9920f4a32293
SHA1d83b2ab42ca4d9dee7905e7c8b71132f5be49827
SHA25686f240b134601b7e222052c9ad8f8f340642e5153b6bd5c2c69728a6cfe21533
SHA5120f4f838008dc7a722d8e447fb25361bb85f67776eb21894ec12fe6b4ba1c92950889f7e8a1c9085c88bfa9cfe8827e3a3c91bb759d2dd7f5f45881409ac88625
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebb8c0c78e5248b083a5c3145f4e8b83
SHA1815967fa758f6fa89f4dd69fab3d6da514bf2286
SHA256462d9722646df7a253f3113cb3793eb81235cdd1157aa1c8a288110b5963b130
SHA51275f2d8a8c981fc67ccb052bd5d8735970104a8fa6acb1429bb9c0445112de1901db337dfbb68b9b8dccdac74424af7be6f3ac6c46938803089bf0e86ddd348f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535cdd9d2a16cf7c53b863975aa275234
SHA1c7400ff1f60f18571fec8ed09ed27c6bcf5f3a0a
SHA25628bc3cf741764fca05c71a4dbcaf8962e8338a406398c709140ebfa3c131d0e9
SHA5129934ed0cf9c10d541750e254ab61ca26fefcafea4d940beda412102d6892f6d1ffae2c727d1c6a28a3c5395cc0d112e928aff3975a8bf2b33a4fc88ea8f10c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5772e4f23206fa1450dda55483f18093e
SHA1555d4f08aabfed73873f300c66d8e981064c01e8
SHA256560382272c638fe5efdfc5e9899359c94538aa3f1e77a4b6eaf96ef48d57eead
SHA512655789b1170ddb3337ce6f26bd12a5575d8539150c3aaa35656d635c3674c678be4b0ffc69616c71a4b3b4e9fda4cb5962b86c4e65037767a6a4da35316ac52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b38c54c37ba659ccabbb3c65de1b6601
SHA1fb946727db1b168367536aeec5d33e611d50bda3
SHA2562c872c08cb13b180081f0f509a23569ed6a09692bb5feb22a79f899b1f5a5c8d
SHA512ee4c51304e330f4e33254bd76bdbfbb941602c15c3e5f033141cf9bb6c7e0af9d5a447b97e00d15838121b3fa405ac070ea2d4e4238984e1d972377c604c8aec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f13a5b5167acf38ddd1c55f1f1defdf
SHA1207319644dba50e5d2a81c0536bf61709408e890
SHA256c73595e63b90c32d21aa4cd4cc089c00c00453bf57daf2186ec68d97bcac4e16
SHA512c80659be64231cb7f6f70636c4c2658fe016fd7dbb20a78d7d9134bd9763af0a441a97730b78bf5c8e71f357f639a6c1538dfb73acba0b4358d3d49bc43a11de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52259492e6bfad23721a9d091df56d17d
SHA125318425e172666eac39c9faf7ebb768e9ae6e79
SHA256bc41e19975242d36a6223e56718944b160a5325c3c245cab26c43cfab056308e
SHA512b1e371157f2dc723545b177337dac7fc70a3ee7f49fb860bfde4725f075b5e29ff8bbe5ded7ed2138652fd65a986aeb3506c3c08a4c53a8ab978ce5f8ae1be00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5639c526ebec57b655f545b7048fe541b
SHA1bd598f81b24c31594e56f499c356586ef34e83db
SHA256eec8570b339e1bf4439b74e3a2b3f65d530a510072436fb2ca88a24a236bf1e0
SHA5125e5f478d9c3a9b855cef7afe32363c9450fd02dabe79745ef32da7c29e601f5ef871f3cbea64269dc4a12aadb3da2684328e45df54f12f13c2a7d4dc48e3881d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a