Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html
-
Size
139KB
-
MD5
1718e29cb7532ed0f02e150907f70924
-
SHA1
f169f81e09cdfb26e27ee989f44ddf81c0b0e058
-
SHA256
6a0c144b7ae0d7003b8b88431196c8fe4f098ec2ac59f07682850699a68f0f54
-
SHA512
2a8322670872c0053209fc8192a704f00f7c3a5825a9f43444e955ddbff045033c2331a5dd8b34e8c8731ebf0f26582ebd4c047a8ce3ddf1e84bae09aed8fe44
-
SSDEEP
1536:SxdF04ysRlmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:Sx84ysqyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009adba417a1f66a1acd527252df0ebe2dee0404061de5665176f5fd88a7494d52000000000e8000000002000020000000a03d81e748ac8f88b38b538bba597a63d53e1ce19ca104cc9d1a34c7dd67e191200000000e53d532b3818bed9ad0a125be5e534a9f0ae521a17891396637f7f16b812d0440000000826d51046d268fdafe802009f29f1c5b8abb1fb6c94ef6add4d6731939d5001c45da73251b522e1b23975061d06a2211ef4f502a6ef1d8b12a031ce972cba635 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72832D91-0AC4-11EF-9C17-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421064300" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003871ca088c06c215c57ee1f7bbc05fafbbc90af745d8f70fcd71c499f20eeece000000000e800000000200002000000037bf63f331dc7ef0ac0a9f8b5df67b0fff7501319990ae85ed9495f6feb4058990000000064011f7a3bae8c2802a1702dcc70d914febde46301953db3c7165f231725d260693297764fdf2885f9f3594ef3f505446882dee5b1489f31994430408d6cdde3e0a23194dab245a5edc44962873f4326a4caa06236d205c59fd51b6655c9bd8244c1328ec00002f970dd83678940731433a4b85c5b65e2759483a0c8e7599f2ab8d37c2b6942aa1a07126e8f9114d3340000000d604d936d5cb23f89614db038a7f6a440d2a17ef03f48194268c14afd1122cb710af2ea45f8715df3224fcabd5351469f427144e13bb255aa506e53696636917 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a69888d19eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1808 iexplore.exe 1808 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2620 1808 iexplore.exe 28 PID 1808 wrote to memory of 2620 1808 iexplore.exe 28 PID 1808 wrote to memory of 2620 1808 iexplore.exe 28 PID 1808 wrote to memory of 2620 1808 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1718e29cb7532ed0f02e150907f70924_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dbfaefe34c95f872d7eaee11c4e68b7
SHA112d070beb686399e9f34211a67a9106e6748b65c
SHA256a498709a76cf751765253aa2c6380516289d0434785a0a14cc7aabac2a9dc59d
SHA5127814e084bbfeac8dd2f71b385a5d65a86b19ae1e8f46b5579170408c20d73a461968c11b4dee64b96afa466af82c75fe914390998a292e499696e7f60e245fe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5163ee15553d94a5e164a5eee6c1bd387
SHA1fb6b6b093ec8ad20c23d2a4e1012fa58489a75b2
SHA256ff725e9857d97913c5c6dc4a4a61bb14ba5033f7ae4562c3af7be06442609d49
SHA512b1a06ff3f36d95037463b8baac372d81f5698f438ef7ce6559cfdc453546138eae220322e16d937c848bcf8f49077a8125709c7661562ab66e8a788582c42575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a602a78371a7d6274ecdf19eada644ca
SHA170113a033bbe8558e02b16b0053baba671825fe0
SHA256cee861d44ad77e7a17725f5a5e8ff1ae8d18042229246885e9a6491fd7645872
SHA512c6c42d3de3d21d651efd3367f1114b7bf99e6390d045c2a74351f4211b6ae276790a6d9198f7fb9deefeeb26b31066bc4ac665e1df350d08056fc1ba87f9cc1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd1d46c273f7d089e5e1be7e6f40d1f6
SHA1f59712b53c0cfc6c0c52dde8fc3fa97a2de1308d
SHA2562abd8abb4f8f82bb6d86ee3c70d7c252bfba8a082a0a397dcd9decf2458b838c
SHA512cf4e9b221ea42edf9cd57afafd07f4f6feb8ea12ce11b7d9f85b8977483fde804ee38a07c6f54cec11d18410ecd3f3f1c1fde5eab4e8b79762e66f8b9253e092
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d902feb53b7dffdaa8c997f2ccf0181c
SHA12198386047423bbcb37a9f2d81b6ea08fdb84466
SHA2562c0e68b261cd81e9200507d03e72e04272685077626f5df9ff56b7c6cd7fbf1a
SHA5125cc0f928fcae0053472d21f0cb24de394917c7302c27f239724e3478897fcca85173ae331a7cf1e418de2603b8b5926c79d86c7b9a99e1ec9bd71f3675ef5f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5593a4fb385d737343e8b41514013a875
SHA1159bc6b25d272b3000bc727d8fff7047dda2e60b
SHA2569f5c2a980913252f03d739672ef83c4880b5e9af4fc410ada8bfea0f45bec433
SHA5123a9f6a1bc4449f7d627388e7c7e4ab5658d8f7201a6119a5c90e83fceefa152f3106eeaa4ce7b64f990a5569467d03dff7693078450c6bf52088cb978a43985e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5753aafa25b24390d60426cd041360f47
SHA1ef213b676a38807f9b27b21d295b718492b0d5b7
SHA256725891543b95614bd90151f6811e71f6e8b892665c57ef4e1e9fd0cd7924529c
SHA512116e69a79a98aca199559cab52a07c095981bcc98e7f80f90febc2360d1231ead92d85ba73242f8021972a9c31be48939495ded08a722b1e4a9580eb5862e084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544f807a45ade614a875b96754a99538d
SHA11057ba9389da26b6cd0407c72e07394b1fe820e0
SHA2562a013f925ef939df0609e6033e807a8faccdfe011d87b1455262f80ac7bd548e
SHA512c0a1b8a748745639cbf077288701894e1d1ba7a813a289f9145432713be99dab930ab9e0e44373e058f07749981524286cf42144f5689f3fbc4bc889c9084054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f605b8cc59c372810356579634812dc2
SHA184685cdd42ebdb6228cedce8d50fe42af69f21fd
SHA256b09fd0c6a2a4d15ca3a1926e9853fd96cccf6b022bf5389ba127e1cdf647c69c
SHA5129f830d8660ca99862bb80604c063260ce0e37a0d67d628e4e3115c1480d86ab38899ce67b5a0fbccd12a86d18d6e1d62ea4b8118d93be6868d90faf58fca419c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e27373031a73bb25c71fdf4d10a2d29
SHA11ac6295a995013afafbe1a89e98815a1ba6442a1
SHA256a3de51cc0595e71644e5ea03bfc2a177c646ccaff99f59a017a8f9045177457b
SHA5122d846ebd97e00d1a4cd6dc8da7dd5e2b27a54563262472c45c87a7eb1d630cfd0bae36c0f4e70566a6919aa24e6fb0ff47fc581602c1103d9b5050b2f78efb64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f31c167455372c1f77cb4c46ea17e9a
SHA1af0662e3df6cf5622cee27dab20e94925fed1e52
SHA25650d57420e7333f8d8c04995068760178c11676887678fd0fe340458ac19d6cbb
SHA51214623258f58ca338d24200f979e74399422e366d637c49ea6c4a645d6d69f434940b9ddf49499bb2fd580043a954614ea1deb11d93fdcbea5cda697d830de6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db488d4a03fbe7d0fa1e1b469c217005
SHA1aa4f51d1b52ef219135de8957f20337b47847b7b
SHA256d0964c3c4c1c4077991b94de97157cd62fb7c4f419ba63ad11f6b02ee149151d
SHA5123c5868a96b1be066d5231ff40ea8d9a4a956ce2b50a8ec06e7931c1b605eb1feb49a3d0c646a5e82b5547eba2146a9704b1e3552594804004e0487545c3aa069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc166f46592a9a00fcbffcf1ff961420
SHA1a4be7ec87463963a6b914179ced4f1bb54ba14ce
SHA2569f7a4e7c9c239e56224e5c935b0556c62b8e4b4f87092dd6ab8d5c8eb7399fc6
SHA51212689e8ac2c96c417266b85be2261da4ee6b1e56c3abec519c7b308e566e075c1af20cfeb97ec0001f61538e64099cfcf50c40ec6446f83a49708ed11944bb4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2d5ffb45e9f53635c04e5e1ede88f16
SHA17758f3816252379d0766f156b1fe76b5665a1d9b
SHA256035be2ced72770ebc682d57678556fcd9ed5468d130795eebb1f305d4d4ddada
SHA512bc0a8c922c510f78a074da18f6f7d6036e3f0346dc40d6395bd1e19d0cdfefc2ff1246d1d2560fd116a4d79615e75d1b7bd3534b411551d19437d1bba3b9e18d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dda81efaaec521c0f6c6f44deabdd22c
SHA1f409d9025b1d8e9111ed2070fc8e0b1d858849e7
SHA2569a7051f1dc6245cf2976fd656a2f5a5db083852739d85da60f7cbe3ac149e233
SHA5129a1ca936039c9a08d4f78f5acd478f9a519f692da3eaf4281324e3a0d49d39d2074bdfef2a1036c1f4a121fcc934d315732d51e555a4b952d474e8eec86cf41c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b320f8662165a72ea4c1cfec47b0314
SHA16d7c0f8b4a97b1911ff06878520c22f10f606630
SHA2561a1ad5c7149dc6886e7d94cfe520aff095a89f3f5616cc6c2c2aaa9221090410
SHA5127639344b9868bcca431a2ec3df8f6f2dcd6d7751b2882d15f2c4a6db074ed89580c95b06bb3097dfc677c35966342f35773ca2265c33cd0dc5a7d808c5f93013
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a