Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
0f846e9545099bd5d7e78f9e3c8a4d86_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f846e9545099bd5d7e78f9e3c8a4d86_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0f846e9545099bd5d7e78f9e3c8a4d86_JaffaCakes118.html
-
Size
81KB
-
MD5
0f846e9545099bd5d7e78f9e3c8a4d86
-
SHA1
b3c577905f3542431d65f9e6be3d35bee7e2fd06
-
SHA256
31d3c0983c16447e3e510ab6a2c62017b2b7a11e67a136e4cb16f7a77ad5321e
-
SHA512
a19bd4b81fbd6ba6440cdfaa068c14236534535c04174e881517ad23e71b81e1f4073af4061ec7542b8bc99a0b1d2edb24b2ab2beecab44584045e8e208cd96a
-
SSDEEP
1536:J2zevUmgMgh6iZ6qAuTzNen0tbrga94hcuNnQC:J4evUmgMghdZ3AuTzNUq4hcuZX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bad2e9059dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bf3a4c8506b45605079bb2c3df97ec09638fb6ba47e554d93ecea13a3ace70c0000000000e8000000002000020000000deb1f28ec241ec632f5cc6594e1872b643bb7a8645f22c1912adf3a3a5ec42332000000079b03de56f055d2e318367f794c1fd0fd077d290a4ea9c5124fdd60aff7f0cbd400000006f4e7f0d09f0189cac80f495e8c8642e77f1c98d45d515eb505fa222c6531ff5e2b656eb3d07c135660c083df1db6e64455ba313c96bf931f7c5cf94869be0d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d8875f79336dd9db86f96e772674ef16703163070153d3deef24af5efc27d52d000000000e800000000200002000000045927de4fbdee0e28e8eb987b3c31b7f63a049220bf70e62ab429e60dcc36d8e9000000085547e7800eaa885e3c809be90f16da10aa59070866788c393c117904ef0544f58f16c410dc9e2d0ad9dcd3651f6ce50f13b03a22fb68f5b1c83fc466833145926519f798ca8c0e7de617172b4fb9e1bed3e8a3ec46c514a629469768fd33a1fdce86b8c966767c6c18cd6821039006fb998dac72e166fa54a728f72d52a66a982a4fe7a91094c0992dcb8e5106e012840000000f410ccdc72b96ff59fcb55eae3d2f152479d4bf1eca811ab5e6256be226e8e678e6ff87700f301e6aaa3585178054e86aff9a2f2bb713891514e4016bbc99c64 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{143C45E1-08F9-11EF-BF06-56D57A935C49} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420867004" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1724 1728 iexplore.exe 28 PID 1728 wrote to memory of 1724 1728 iexplore.exe 28 PID 1728 wrote to memory of 1724 1728 iexplore.exe 28 PID 1728 wrote to memory of 1724 1728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f846e9545099bd5d7e78f9e3c8a4d86_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c088668db9c5acf05c7968291fded7bb
SHA1806c71767ee9d2c0b9538072aabea73ccc60ea63
SHA256ce9fe10e18966b19316361a955453cea71bc3de723bd1d8230630bf29fae0032
SHA512271e4ce9aee1ae454ce9d2c78b1d5cc8bd2264b356cf121c10a28d532d2b87a40419fb9be3cc60e96179c2e0c60491da1e1393d42b35c81d66afb34146c1a9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b0da13b1f592b823241df5bbfa5eca4
SHA17328b0f59674944477209494878b956ffd21f3ce
SHA256cd09c1e15803b1b732fe48e219a55d5a0b6a1e0b642ff367640cdf60669e80ed
SHA5121e89dcf5f95e1199544c104dc9a38c3cbf5513cb1dd85208598fe5b7e0ee54946073d0fd9f04aaa455fab3f7f48b9be1c9359358798c1a6d50bde8a2f79c1a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c31395d24f27a7b256690793aad7af35
SHA194c4080a24fd3ba68da3e84de3287eec0a253361
SHA256962dd93e6be787c02b1c55bdb36eacaaa5aafe8859e3849bca6fe4704520ebe0
SHA5126efbba286f776f1fa30fba3653f7718db9b79eb34f48796acb3d9270a9f2d140706ac1017bb575b8e39443c8f44f1b9463757781389ab9d72b52a81b861c175b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4b6c5f0f5c2f80c351bed89b7f1e1ab
SHA12d9a123e6544f47fd76f7c62ad547d350bf83ca3
SHA25683897e4abae943ef8c3c43072769b0c7055589552fdbc2d0cd2dcfb0f7f7a198
SHA512daa23af70d6aaa22699e9318566ed5cdb34580d7f4eab80f296165b4528fa86eef0e3ca0f4876e2e6a7a3e3bda9dadc4c844f53dbbeb2f0d4c2e5f1abb2b76f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56589ffd1effe95eda82196a28a12255f
SHA196187df0ac5faeac5c835d16f5041a24dbe834d8
SHA25601fc5fd402018ff7fb786572719f663b806f65cd18d20078a27d74aa2e65aede
SHA512796a5f47132fef08badf326209e8a97c6b15a45056a36b1005acbbd526a869592e1a5425cb4577137ec46cf5a7f9cdaf1038624ff529bec4f8ce0189906f8922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ff4e4fd197b85780d164c23d00e4695
SHA11579dd0e25f205dc6d205bd1460e872837c049bc
SHA25695e383e7ec2deb684f41e17f26c5e93381f85b7513e661faa1aa9a623580fcb9
SHA512d032b19bd630b5d50440f560993ebdb9bb667a1fc0c0b45c917cb08268a4abccf43896c65737da67fd353328a112e3af48115e0bbb76d4d4d1c3083fd60fa427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5476c869213f251383738c1481e21ff0e
SHA16c7b753d019a7eb2373ab837f807b1170075ff38
SHA25658e1d3fb2f3b37aee2d2ccbeb9d2c6683d02b5613aa57da65277c8f0d2a70329
SHA512708a393072c64d71f5b0526d471fc95e86d0c1ffd1723465ccb8c1fea6c05953b05d647d743e50eb00cabd645e59f97a45bec28ba13709af86c6872067c9c381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535ec9d72105336ad08c2f257634707d7
SHA175e2578364a3daa90a670bb716da4f5e14423de7
SHA25678637fddbe8e104982c47bfe9167d45164c9bffe2a995e46d02553bd728a3ba2
SHA512375b32aa68f4af3b10b9e132892b6cdb5d1752227d32b101cf448fea190d5cb87ed6c10a04ed50cc0312ed9aa08db67403996d6207188abe6f4db219344572a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cda57702337c6ea17aea9768fd18c8a6
SHA1b7e8c6ae01503b490a92ad0274a1d398bd09810d
SHA2560e21b6ae444a383529fa5dfd93f50adaaa93eed078ea53d2ff671194d8db6e66
SHA512c3b05a0afbb5bed0e72cd422dddbe5e72282e16e10e9fd33a09bb8779bfb0a6e54bdc710521985df71e95b81e06d5815e11b72b36813a5671c785fea880899ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512730b6a8df774765d391072b5ae923b
SHA19f41aefb106e4e98ff492c2d2d05298eadbd5409
SHA256ffebb2c1a234b04e47a2f75fc44d2db8f404c3ba9fc5e7613e23e51541cfea2e
SHA51239b025d12a980ffef3e3db842a49f585942d117e0dbcaf8aaa0d68943be80026c1ddd676d97c8117683b6093114c2b017ff3db984292f3e51044776f630073af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c65c3c8c0034c55c6e9d9be93c70c34b
SHA19a19ea2efa14c1ba5c6916745f115666837fdc9c
SHA2568b3b6aa899002082e2d178193617b2a717bf408ecea48e771309d24270acfa55
SHA5121a49d2d2ac3c3f06c99b9167b181ddc48de0df126ae561c9d9e65d3aa24d86ad0a1b954f763b3b96c1bc8645abd78e85cb02164cd2d1e4dfc59ce864a83af161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5766cec8a9ed7d4f7c7e6b6fb12941f34
SHA197911a9788bf8333ca83efe5aa6042d84f93bba4
SHA2563c66ddd473d685d993d74315acf345a48ea4d6fdd3f621369d2b0732f93cc445
SHA5128b11dd353d399c86be3a338f1cc10c0407aaa5937b4e2ead4484f8a5d8c79a4c0fbe0c83a4f138cf9063b13ea44f7c8a1394db806b3748cbbe46dc11feec5d9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560e29b974346e5ee403383b1c19e9d4a
SHA18a9a229c69cff890cca8d73eb32333f550183850
SHA256dcf70936b485f2b824fa35147794bcda4c154cd5cc49b7703e518aa37b4f56d3
SHA5129111503c54078d28fe24dabe7831963416b4040263ec963793f2ad752cc1ab7b5d1abe3ccb0fd4d783bfb5c423ea1a08be6266ddf3a402691d1f0ce5a66ad7b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5784c44f2891bc1085708fc1ac7f5fc7f
SHA18d6da06e90056f70141aa9d281cbcd0edd81b9fa
SHA2565e84671d79b00e2449dc4750faeae826002165140c7f390bde082f96d98e1a44
SHA512eb53f4dad7975a55fe3ef020bd9fa33c1e4e6f447fc44c2b69bce75bccb44890b8efc4613c0cc5ab1e6a00d8494c8af57be34e90bb35db51a62dd06d08132c4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578dddeecda29b8bd28c02e4449d8fed5
SHA16f1b99c5f409a051a3d9bd037cbca809e3630cf8
SHA256a99778eb88203ea582b039245569bdda7f42422bc4fb0f19addb5d321c0cf549
SHA5127d6804b9132955fa53c7444a7d7938e0aa5f7134795f61bdd6e48a4985bfa02424a925fea7c18d4f955c71874819d71e6ec5ad9fb42257ef930c01baf66041b1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a