Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
0928b3092cee2c409f78007b126d5d36_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0928b3092cee2c409f78007b126d5d36_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
0928b3092cee2c409f78007b126d5d36_JaffaCakes118.html
-
Size
121KB
-
MD5
0928b3092cee2c409f78007b126d5d36
-
SHA1
252e305f710e454668aaee7f20b590fc38d17805
-
SHA256
e8fd73404d0d2c27a7f7c6e51ad6f95ad213faa232a37837dcdad23fbff4e5c1
-
SHA512
8b8f2940f0a044ed7737821342549cf2dd1af14bc8e6b4d7115583c4242b94eb646991b7b0a36969dd19a241d64ec07d8e250e70d0a3548a784f09b5f21a10a4
-
SSDEEP
1536:Uomc5yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:L95yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ccceb2beecd72cab000a594f6ffc5114bfdc8901b4982d85904572fcd9912074000000000e80000000020000200000008f0ba23ae4d43e899b01ddc5d6afc4729df76c76b7b5971b87a3429ad69d1c0890000000cce500e61f9b550ca14d95b9e20fe0cca65d45ac12fea7566b7fab2203b83468861e2cdd8b5428b9e263684160e55ba63c281d0b0b439f5189ee0ebecfe9615235fbf0007c8fa8ebe9f724ef7dc730453ae594a84b7c6381706f87e73f468b92559134a670b56a039d4cf70188e6d13a4d3f69bc4252ca67dc9f61edaf28476fa55b0b5437b45657c8c765170f7c3121400000001b02f028c83705367b37a6d4f052f50e43e613cde747c9d78c26a279585b917dd85c2e332f3b2bcd8797b38e68ae08701875424adac04dd69f43c4aed8e5a60d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420617962" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CEE63B1-06B5-11EF-B991-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303e7e11c29ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b6dbcdaa4236297cc23d12ebb41856d0aa5f4b05d8561c003cd1e8957b71fa11000000000e80000000020000200000001e2dfd09190dabc4f1e8bb670e9d3f471fde8a0b87a56134e82a2e4248a408a220000000b31cfcc2bdd6c37d7c6b9c92abf02ba411b8366c9495852c5c378cce8c6bf79940000000810662d2cd5b2a67691bb94472c0e1bf4599ffa864690e5f2d749b5428b966a0de6a35ae43160ba64bfd35c9970c36541250f42eb83d8fa5d2b3b14a49848d28 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0928b3092cee2c409f78007b126d5d36_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f4d898a14dd535c32cd8425755a0a5f
SHA16db836812ea4c1b496a443f30299471b82f6e2b3
SHA2569fc1b6b87484d27e0fd71b1e4ac58c0eef074f9002af34caccea597d639baaea
SHA5123cd055f7403a81614c128838b4bd100807a7084bbd84bdd2b0fdb6a84f7a5c53bd6016f137eb7f67d58f1f1b403a0209044b514e2cce78b95e89d442c1b45449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e7628213ca448cbd158292bbd9312be
SHA160c90652dd14c174c0575342b71d273bdd9c4dfa
SHA2569c36d927b5d82511d75ccccdaab5764e3bae92ab7ed1acff16be667ee9933c30
SHA512af719121d9307a60db3b1dc45b1e9a7a0adc42132b7f55d3db3e29c1722f8c898bd9b4fb4cee2dc0509ecbd58c098068e7d903e82b9671c99408a3fe2b1b3f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc244894d8f56febdb519a5269bc1d4d
SHA1a0614a861b801c76c0e400e5062f1643f745976c
SHA2565883ba31b8c3c80b4c68e3591c1b042eb1b4adc808ad64f7b6ae70590f3a73ec
SHA512425650fd34bdc7a3ca204df246b0fc592406443f36d8941df3df247b7b1c5cfbc90a91ffc3fc27c6e3fac7a331ba4f6315ecab9eabf0992e82e2812d887e6d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf368b2dc3943ce833854cfea8463fd9
SHA14e3598c3134602ff32e8c18dd9b1d568afc4d2fe
SHA256d1c8b07e9a79f6802e915e95cc5ee7e0f7947911e3dee53b60d54258830b3a3c
SHA5123d082c84b4ad6af2b40b79783d9ccd8c82ec900c169254599e726a0688885987fda2a2460125db4a9de5b2675bcfc16b372ec57a4a54d5a2d75de6d498ec7ab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55640b928f859183094139a60e01d8b3e
SHA15cd4524c7a908b248eeb5c767d06b2ce47a77cae
SHA2566b0c0d8d17cfa4b9c9592dbd686ddc779ddd8346ea576b7eb7f7145db24d7f47
SHA5121c15f5e6bcd52d062812894e0838668578d194adc640f76ec649ef4857c091afec8290a2c178416b0d1ddcf74c5c65d84ec15dae30963b739ae624639a20aa50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518bd661404746918dcf7a55d7d706e39
SHA19d5bfef854a31e0f8909d316d9de273cb6af6d7a
SHA2560be3c71cc1b9abe1af2eed4c0ed6d79eadbee6e9eb0857ddf4a10a4f410943b2
SHA512954733d5fcddf44cff354656bc4906357dc7b6314f0c86f1b02b158073170f28c88a9e6d6ac8a9a92e4db98b2dd5ced86209b50edc33c88c680a55220105f7f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ac344c2fb1fbccd314af8fa266a693a
SHA1f3699b7284a9761ea45e5b7873bf51c5ff2c325a
SHA2568c9b90921c2555efffd8ca0f258d59cd306652bbd72fa9f07c2c4881713c8d11
SHA5120a4294c1176c24ee3292cddbb2a2c3c673b47e9737579333611b87c83b1e85ae9f8e50134fa0b4d1f13fa28ab5948ccde75f913f9c1713f65e64daa5b2f47598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593503165043891e8e56ab84d6697fcbe
SHA156794c8e82121070364e04e995f4e5d5580b0626
SHA256ef7a54bde8eedf3bd27a91c9a405876c7cfd16cbe72515cd2ffa9d661d1e8cbc
SHA512aaa485db2baa1fe01545a5edb031cb15c21c0abf29636f8d53e15ace6a3e0223bef6a9d8ca41704cc1eafce90f50b5281d8ec3f02692e0b06d7966fbdda9dcd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56735e7cf4e56abbb51f12d2d0ea74ae3
SHA1f113267d4a3ac5f25ff540fe28f044a40376e9a1
SHA25641a55b4a9992c6264a986d3786e1a5ac44bb6491c91abed61d7e1f186ec03acb
SHA5121e3d02bfe32eeb1e76d26292be95cf6301b3721349ac90c208d9e05039c1f85ac279e5dad2826d40f03117c26e18005174e1a627f1c8953846389a0f0649d524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597318e9e6ad694f0f5bd94ae475c4b8e
SHA1a5cb1e3ef67ef7c8e2463b875fa6ce51ead93edf
SHA2569ab0336aa31996ca4a871186285bcb650b3c94fa66f346a70d75e55fed6fd164
SHA512d632836cf365cd30f41c70c0fc5a39dd18161efc31201186065b826eedad9802e8325c6d3eb1490d5e7bfcf2cf166858bb86513921029894022f9a586c77bdf2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a