Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
1f2953e65c434565df33684c1f0a8ee4_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1f2953e65c434565df33684c1f0a8ee4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1f2953e65c434565df33684c1f0a8ee4_JaffaCakes118.html
-
Size
14KB
-
MD5
1f2953e65c434565df33684c1f0a8ee4
-
SHA1
43e27aa2ca2051af534028a98f893d3f5bb4e147
-
SHA256
1b9e434443346391b9e48843ca50b3f9fa741eca581736b2034389ed9a435ef1
-
SHA512
7c23289abcfd79db557ab285c41f0b87f1711aaa404ee1c982c7ce619d90e9745e311eed8d65ea6f69c0803b194bbc33ef3b542f0b571586868b0612c3580cff
-
SSDEEP
384:SIVIh/qXq2qMqLq8qrqjqrq9qvqeqyqMrvwk:SEIh/qXq2qMqLq8qrqjqrq9qvqeqyqM3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000007f6c7e07b65cd8a7a642b173cc817e0716796f4698a8a86c7e19733a94894d08000000000e800000000200002000000056193fcc759943c3a004ce2d2f69470a3e80bc81742a419d067b1ad54caf3eda90000000528ef2716d6b02361368f9d5111cb2456aa5bc247f74637d5444f14de0308d7333844bfaa742d152cc35ea6e671d960ef655d012a7c25d1fb5c85d3fcad6f60be2d5aa134eedac2ab450e2ed571b2daf57fc846b86af075cb133501dbdce39d4c210a54e8dfb8af284ec26d014118e087539e1132a827a85b399d1fa6f9c2dc08374cf8189845eeb49d9c9ce8aaa38874000000075afd15074b21d351e3dd417fbdb3ba6d98f10ed1e7e195e3fdbc1b99e143125f911f80094471ba097574ee5e0266d09b5fe40eb183d6fa5e0ef0cf624f84b36 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421211290" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000007109640fd910abff9a6863f9b82aed51af9392ef3651c608c9daa38e68152127000000000e800000000200002000000012e031097d5df319394dde3a901358f03fca09c867b21adf9eff367f6b5b375f20000000252274d80738c939682ca8793887089654b4c04129057089b28b2509717c710f40000000f3554d0f2a70b1cec841eeaba80f722f8f55f505cda45db6f5c4962eea671a4d7ba097fd701b60195cafc30ee80a3ef10c2248abc839f7446deb913e0c8e47f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF673BA1-0C1A-11EF-A0EE-F2EF6E19F123} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105d7ea227a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1680 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1680 iexplore.exe 1680 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2928 1680 iexplore.exe 28 PID 1680 wrote to memory of 2928 1680 iexplore.exe 28 PID 1680 wrote to memory of 2928 1680 iexplore.exe 28 PID 1680 wrote to memory of 2928 1680 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f2953e65c434565df33684c1f0a8ee4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3107e2e86e9eaf7526a5f71a7cce6d5
SHA1c7d6b1761bd43d5ee5aba79a363a8a1fdf8d8149
SHA256e0dcf3bfc719cacd8076278d02e8b39031f48f7ef47e77603eff699ba18a56d0
SHA512b58d762def602d8a784731dc0382b7e74a43a4d414dae3f485981639f8f80a8805ccd4c3e3a0199a0a205b17499968a29b18b6e83b0ec3f4207b2fa448cff956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b217fac4035c22deb01694f43d8d769f
SHA1de24c9446c4b7e637bd6ec48bdb5b614da2fad8c
SHA25655ed7a4a658edc405fddbdf0da45ebf1eab284477178ce0c167332b55bcbfe60
SHA512111016a0addf38d0e2a6afc755c393051d672c0a9053c119f314677bdce16c45a1b85be83ac953576ec6c09c5da4f3d678a2f583206af5d3932f1a88c876219c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519399cd1e620f14f8ffaba6b40c3a4b7
SHA1f90d93aa9376e7ca81f220fe7d692835d37e46a9
SHA2569c0d3db9d9c30aac71495a7492317956afb73314622da0a58fc3059ea874dcef
SHA512bada0a52161f0640bef26fd255b9d50b45f9ddad14c95dc68097ac4788879f33f613c7fb6ac263efbef2f30ad491aff116a0137286a5dd14ca57aad24414d7f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0cbab9052f17f0537c9bbd6ee9b88e5
SHA143e886af276781dc4bfd749e82dee83e54412a8e
SHA256044635d025741d1c57b76f89f3c5371540013a2f3567aa62f394c62ff565e5e0
SHA5120803df4226e0e1f5e1541086036e9e5a591291ba24b760806f4d89f4bf7d18903d0143f1f350da919ed73a8c16fcf4d770c9d05614d4d5b712a48827b776b9ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e79063343b0a0e6ce4d4ab1bf5ac0156
SHA19b5e765f143235aa980605ee071cef8993b09ce9
SHA25674c2ec347e4aee96ec914a45ea4d07d6f8dfdff2858814ecefe1ba80d325f2ae
SHA5125a97a5ad42ef0f8996e36887b6c41922dead37b5118d485604462767dd3f532536801a2a16f5a461c14798e56c433c6ef7587a23c4f0bce0cd947689ba8f5ca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd24bb963315bcf642753468ecd918e7
SHA158c5b6269bbb104cd108339b7ce8b35c49b7ff8f
SHA2565d8944d7c182fd072c4d3206a6aae3c7e3fb45c2a4ce627d6de4b980a1cc28ef
SHA51241ea37fdbf2f7a045522c3e12292582550edc50e1cc4b335dc9a23d738b8e26ddfe652c5b52e5ae5ec5f95da32003dc96b08d65bd58e3168627d8a67bd1b732d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6a0774d5ef6b504602240212dd94a69
SHA17e602ea64b3f0180c7111f471e2c88fab5f84497
SHA256e3f3009108f0718fcd61f52e7810761d53b9265b9dd318bacba041dece8230bc
SHA512d831b7503207cb2ceb51cdcc1da24e36c461ad226b91796435bf8cf90f98a543feb34f079e28f4dc2b44ec46bc1cf7c0655248adf3c986b10177efef01b77612
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5accc0b34e0bb2ab18d1693a58354e449
SHA1a440c775289bcb4f46bc01fc20c9871ec19163c7
SHA256fdf1907e7cafd49c466def1e5b650d0a9ddeef7135187f068be60a64c239bf08
SHA512d681f433910bb8b4de9fbe62d8a72842f32ea15d96d89d3d3278bd34aabd2fb6ffafca7b166aef8091603af615f95027a3d1caef370179291e494a950e2976eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54466b2e25c2720166951a2adbefe63e5
SHA10b06bcc4998e636285ffe7850842b3a7b9b631d4
SHA2565b91da93682583bc53e05135ad7df9cd9360d0bacdb8c4019d02812d2e4f7a31
SHA5129b692c2220bffe4ea5192330d5d7ef9e17cb61bc0faf383a91fc330730c782334a278d27e38a0edab942b522f5b7aebfa90d0c3555b9b40b2905a252362eeee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df2f3964c4af116a98c22f7b54fa6c56
SHA14446b8d908dd0edb9f64d812fbb99cdceb59767e
SHA2567cf1d7ceac79f85d1ec404fbcf9dd66f51df6c80b469b8b33271068c1de20d38
SHA512e9daa0e52dfcdb4f71b94f25436f46b306284e390ae5dabd73bc0d276fc19a2991d828f4f6221adf16278ac00804db8a201a49d49c638e0111449bfed6a7f012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a5043448ee395dc0323a4b83c45f23d
SHA141c6d2d03e11da565af48c2555eeccb95d7eedf8
SHA25646ec365816afb29a7e8fe66dec13d170edcd5d018a2f353ddcc42a6a8b6b710e
SHA51293e85adc3576723f1dd9a5b4452da5c2bd3c9ec4ef5ff882e40a06686d62cacd2b194f89ca122a85857d4c358e49cd8b78d4f79ee85847948ba3c251b968e81a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbdf42930f1af6ce1b65c7d373b36009
SHA10a2b86334d61f69fdc54e07633abd69f80addb09
SHA256b66db73b5e945bc57567c3629ed7b17bc40a4728fba15b3b3b455696a3d6a532
SHA512dd1e020483da467b8972242e939d4f14ab18e21701af2201316e1f0f06707f3fa3993a7bc9f61cc505fb269d9613cb34abc2913c5eec3b7d5df77c32c7c57e7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5419a121d171c61ea951a0af4998e16f8
SHA16bd6a231b0287829a5e29f43060a9735f46fddfc
SHA25634d57417ead6acfe05f572eb05c978b81a90d833952f84a96f903ba523dafcef
SHA512326a503492ac560b582684a4586c14aed1c57b412ed6e91c6d21f9598923285a480b3e3fc981cd769bfc7e0423ca79cd7b35de2a06de35090055ca7a61c12f89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559151ae1b5e5b7052639955774db7925
SHA1ecdce9bfb2eddbbe21de651535b032e57c07ae0f
SHA2561ed56efa0b4e68c38ca986ba58fa971cb70a918bd4a3116b8515a7e3c5389a3d
SHA512f801162cbd4fed6ab6fafc77926bff8055fa09e23679e8c521cab59f31873694b9a178ceecacb9d2a7c7472d8e9374cc6b92fe19b1edf776fe7a96e9eb01ebc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a402deb4d757b791c06869d2d80006a6
SHA134f331ce3277f0831e40d3259f6619b00b56c408
SHA2569a20ee6c674943ecd6b999c09b8e9bec739ccac4253af50c06fdc735590d4f14
SHA512ccda2d883c4607708a435807f158c70dafdd109cde99338ce4af41512184f75a769b40ac93d8886cc4140d04a231a4deca134241522af369b60fdddc6a0cb900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9f47c1156207fe2bcc30b5f41d2520d
SHA18e115f79f3cfe241c4d1c20b0884bbca1054b115
SHA2564ddaacc763d67daef334172f28db31e7e3343c169b933678a07d7b6527fa95dd
SHA5125d0a082b3878b40714b0da8dc12fa6bccacd2b05ece099cc8ffb4168e18806bb8d132763b878c40aa99e3e8cf4be2d1f0fe778d8b1accd857db6180db56b39eb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a