Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
122fefb505ddd22f6d917849f159fe82_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
122fefb505ddd22f6d917849f159fe82_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
122fefb505ddd22f6d917849f159fe82_JaffaCakes118.html
-
Size
213KB
-
MD5
122fefb505ddd22f6d917849f159fe82
-
SHA1
4ba0e5b111c7d398202fd50a9cf511bc3a60f80a
-
SHA256
b57791956629c514d6f05849107eb1987f20aa145252fe011b12ce4c4a8c7141
-
SHA512
f6f0fa0795d41fe3b15e10fff3556b82404a84a80b4bf7d173b9a20e3548ae49d8a74867237d544d599d6b15f75d3ce74f640d081f541fd95e672d6053d40d58
-
SSDEEP
3072:MrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJA:Uz9VxLY7iAVLTBQJlA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000045cccbec3ea1a199804ecdb6fc30d6c5bee2fc5581f27bfeb06dd6d67a45ba9b000000000e80000000020000200000006211f5d7b3f37dcab3753a21d3bebfa0f93767651134c519a455946b931d8bbb900000003b2eddc84c0535b4e4904cfca9ad9f433b96fdfff59f653bb3a9314323f2214516699e1aca6d2662c05db0eb6f69da22ab61a960c0f72a3c0f98a4ba673338764a7f9d41d6b70e30bcb8a61eea2558b1e0c036eb4df3ce2920badbeeb245ba99fc439702562b52ac2d83d58669167221c26f20e648181a742346a892a4ab7fc38462071fea96e4b30efb7f19211b5dd1400000004078a2646f805d4dff79013e7b84b30a0627b594641f2b33a24300110c3e12c5554463a27635880efd8e3e632a1eaa19a2a41cd1376fee4aaa1127276e3cf550 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c869d4cdb831ada0008888b9c1be5731b3efae9d06f5e86c7382f13de00ef07c000000000e80000000020000200000008bef04f4f420fa5eb99e70559a4c003d2650bcba50e7d6243bd695da3879100d20000000a2fe603dfcfa611878166af172d4f5ab5d0e8308d77ba3022aeece35eff330b2400000004cd37dd83053b1072606f48fee925822141d9abc29d99dc887317e9cef5931f61e8c296714f04c9707bb19782f506eeb7ed665990ccb6ddaf75947e3670c6da7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c80ad2089eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420978204" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD5B0A11-09FB-11EF-8A46-EA263619F6CB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1652 iexplore.exe 1652 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2172 1652 iexplore.exe 28 PID 1652 wrote to memory of 2172 1652 iexplore.exe 28 PID 1652 wrote to memory of 2172 1652 iexplore.exe 28 PID 1652 wrote to memory of 2172 1652 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\122fefb505ddd22f6d917849f159fe82_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3d145fc32da1048690242df307f986d
SHA1bf22ed7a03248833ca810eb9ead1cb2bb7162427
SHA256ee1c530df8333464c0f114805307caceed47a5090b209249924a50901ff7758f
SHA512a1982f4fb77234d0842dca9ccb7feb003110d1db7e5f85a45af37555a061768524ec777d5f27b859676b139a330d44543113dcefcabe3cf4a5014a0f7e0bd771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ec2333218795848ccf8c3ca9bcf713
SHA1063661c78fd33aabc4494b91296edf89d9e2ecbf
SHA25696722256d7c402da913fa6969d600c7ad5cb5a8d8234bb26c12180d91069e4fc
SHA5121b754bf7fb1e8e012d628bb3c9b2a875fa16bae7df189524b25359728c33321f996201a08154dc8f154fe8fe19a161f4cc671d7bdb488a0b8b20ceb34328fb4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52467d0e3f6bf72f469eaa61ee75981ef
SHA1c9afeacecafc42214b9deba7448589e558c4e2b3
SHA256441de00d1ea59d713eba89865c1fac5b73f9e1e2a564b35fed92e8df2c748a78
SHA51244c15fb938db68545c3c272b877a5ad0fc0b097937fedd9097fa8842442d3675203030a20af8b016b7bf046f6a23a537dd3227b1c16c1a7b2410a208a34bcff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570b31582b48f8c36d8db36f123f97b16
SHA1cb6f07fda7200ac64b406742389f8cccf141a2ea
SHA256c95407556ec6cb20d555a859940f58232412ce1b510e85d814a1789af97b57aa
SHA5127d8525d4fb9650e099c85958e95a20ec2358de91223420ef8327b887b15551e2b9105c4c5d763dc7817b636b9ff1b41d72379ad55270e2273f68fa522580d698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a73b15968e5dfc1fbc2252a666f71605
SHA12df1d1869f198403c42b565fdf52299adf9816d5
SHA2562ba5103e0931cb7622e5a9173185eaabb6202c564034e94fa892073456f34ce8
SHA512ad3a97278ba980261bc695858daed6d20baaf4c94f75f2af136a80a4c82a7153e97653311eaaf8ed92c37d33f129fa338de123e60b28d5862e350d858dc024f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f61434dae09659dbec109efe8703553
SHA128ebed80ed5193ff8c28c6d1a0662ec5c62ef9dd
SHA256be8b360c391234b70f3b5ac6bec688d5c621d23db3dea606df1cee62fa36f9e4
SHA5126c6a512df8b7d3f76198925ddc52ba3bc29a9a23dc80403aceb615f59c6f799f9f2ba71f2dfc68c7a768c84e8a0aed9a67dc8fcef6a993ad0def33f530f381a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f6a2f9c33fecfeca5cd4e4b3cdd197e
SHA1678f96d5067b9b59b0676482b3cf94164cf3b0f7
SHA25606dcf68fa515dc5c046ac11112257aef52ab9ceea3e52c1df4dc0f1c5d47ca2a
SHA5127566d27efec4fb73497ba4eb25611ae4378257e831651f691ece43b8dc8ef9123deda1230607edea5b5c3626d96926348523406a59c5bb4449bcc14857198e26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b651a044d18db8baa0d1c0e009a8d28
SHA1ced2acd231e9f0f0b0d714abdc7bbca3d25f4662
SHA256b43b42668c7b8bed879e1a375bbe0eaff44ce8a019d0568feda059cc9aca037f
SHA512fe2ebe373faaee55ad9a7012a194cca9a6e049762379c0a01d4d26088e3c75ca6ded7f79b2de1faf95ad6c124f63199966ef2a92240ecbca223a97aadb2affc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503b35dabe0a7d4041bd217f83d36c9c5
SHA1f5c5743719493a2599fb4084db9536a7641f1f48
SHA256e1337419813ce171f7b3d3c4f5909182b9751c74feced9cfd554228a4e1b8db9
SHA5122cf1691b259a9314b72de82bab9906fad0e0243655732e43af73f58820cb40d6fedb41ce46c478bf63d554ebceee7eac4e1fda0d1fbda119bd0f4151262fb26b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d34946d16d7800258756d608dcdf23a
SHA1147ec174e84359fa0e87f99bba94a038a5d266c5
SHA2567b4a5ece606d5bc6c8fb98f1641d55a2f58b2adaf39371eddc1d64d800b2a518
SHA51285eb3a5656c58d86daf4ee539473a4fb479468027da77ca7290f2e56e42157713c5a413135086f453da26aa07c2726bd56b8970917f49f895687af130954ea8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539efa8e2a11d8bc6fbea514e03299951
SHA11a993240db721d3b71b7d3ab5aa1b7e5761a65d0
SHA25670272ce1c75b6f37a07441296c994928e5a66b54f224f3f18b9f83ecda619f61
SHA5128b11bb564ce78823edf07b42fdeaa7482ef75c596004d6a59a336c5e71187003fc106bbe0734bd5cd49e8039430593905d3a6fb6930d79a7cf8c4b69ef44da2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b520c4f21b645d8e98d49810cedf03a7
SHA15d452f9d1027cab4d6a02742ed1d8918d6b76c80
SHA25690774e9b0ec0522673300d345a09ffaf07fef2d6724c6d516aa3846163ca0fef
SHA512c2cb0eafeade930c1ae560949ee419e420169386e8405c65c5fb02b3c4392940e89136172d19dd6bfe92dad861ab80892d05d863ef749b58ccf78d781b059fc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0aa975134051ea842b36e6390880dec
SHA198788e71e8eb400fb1d56dd1170c560c1fb506e4
SHA256e59a47317f731955d7954b6bbba9f9052cc43334611fb0d1a78d62413639f7cc
SHA512cedb6a585870000b9450508d69cb2042f6f82f53d911867b53946b7d354851bab1a0aa158e674a830b2334a70aba3e0bd2cad474fd85870202a2eeaf34ce86e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e40e4264d695e976041bd2235bb0e870
SHA124573cc3186a866ddbb9463e4f2e24fb312f2198
SHA25620d020f530f8c2d247688cc8ee2616c9017c27285c74acb98fbd10c60ece4b5e
SHA5128b51c45211d0d4052dbe2817cf0152f2aad5b5d49fbcd78938ee7805b3033dc231f34cf6e57783672a8c08b299af6f2c2df72b5118148134f9f68ba1efbe0c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8e9980a49788a313aecf40f1f88991c
SHA17beca595a06182f1a77c93d30cc9c6fe5fa2c44c
SHA256b6d017abdfbc0c70a6f2554eac492479a1a9ec8d3c242761f032634a31eb6aff
SHA512f3e104ab05bb372d600f5327574c3ed62af32dc3a0396c13905d3872b8b969cc68ffc29750ba39b919fbcb587045cb6580b77a85020a8dbd4164a19ad0db8dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9bf47bd27878ea70a763f5e763e6d81
SHA176aca75160268020c74704535321a8a3d2926216
SHA2561ec8ea2f56e8e242323f4ae1a2861e8f810dc72d63d942bac934fd9b71aad696
SHA5125111463c7c65b69b51f72a122d81039eedb8e7ba9ff9b384dfeca455d65554a02178b7220975db8090308424eb6ed670bab11f21a0d53845d475dc1343c8917e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a