Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
219b68e9453edb7761e7a9e2f057acde_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
219b68e9453edb7761e7a9e2f057acde_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
219b68e9453edb7761e7a9e2f057acde_JaffaCakes118.html
-
Size
27KB
-
MD5
219b68e9453edb7761e7a9e2f057acde
-
SHA1
051860ee21216a36b8af55e9e9851e1b699ae051
-
SHA256
cf3d9249366f477179446b2ae765ffed1876404d77dff54d6a69e6cf6ec15178
-
SHA512
86c337d509f995aec361b6d30f42948a3d3c397fd4d8d5206ce620ca963982a90034d2cd2d41c42ac0d01e9c8ea4d5139b4c80d48797f7e1a4d4d94f8a1f8824
-
SSDEEP
192:uqGD3sb5n+OnQjxn5Q/5nQie8NnqnQOkEntbPnQTbnJnQmCJVevo7Nt/Fo+NzQ43:ncQ/dygcEam+t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3564111-0CB0-11EF-9EA5-C6F68EB94A83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0050598bda0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004ab375289f8902185fa1bd49d35ccdd9abb63b23f84b7c268af6054d97f4d03a000000000e800000000200002000000056696f969069bda55bb9ceac454f74e8aa56435921461990cddd78377c76a81b900000006f521dcae4e723afa3761e5f4dfbefc9f57ac2d175c28222e6df3fefc722ccadabc752dcf47b3a8a61135361db307bac5e3715efa1e78951be1f696972a87a302817d9472442973f53602797eb593b700dc09c8ac478ded369a9fc0684c0aac5c44d2b78b7edd474256e0c8a4b51c461ecb63e6a16ca72ac42b04051bab033ea429a02a22ebd7fcc05d9bc823ea5ca3e40000000b52b74dfabff629ffc1366ea221254f006d02d99dcdd315165f231d84811822c44ca2e66812fa2d42b245819a02184b9726e29548bb09b0dce56581a8afb7488 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ac573b5ddb7631239f8080d9eb69828a935d74f45d21dedc4d2e79a41a9d3117000000000e800000000200002000000063267e65fe3e249080ed51517fbe061d9cae277284f2445a17bbc1730f7ff8eb200000002d7171a981dc5a0351391ee5aaaf5dd1d1a8708ba14cbfeee2ec0903d5f67a6e40000000101f1318540fb98ff3f6b0fcf67461327b0508ee0d77e5b323af9f47270859835ffcf6685d00b8a253a8c57d73b734358eec2e977c82e84948a66b8939ba54df iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421275748" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2744 iexplore.exe 2744 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2540 2744 iexplore.exe 28 PID 2744 wrote to memory of 2540 2744 iexplore.exe 28 PID 2744 wrote to memory of 2540 2744 iexplore.exe 28 PID 2744 wrote to memory of 2540 2744 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\219b68e9453edb7761e7a9e2f057acde_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f5faf8dbd2e2334479083bf10002d22
SHA1cad988b9cdaf9ae034e4227b0a2e686794fbc561
SHA256142d559ba5f82936d7add6943bbda454ba47aff0019c171eee794d98ba5b11cb
SHA5127c21b9e76db9f577a254e813a6f8e674e9daf5ffbcf3984a659097aea9bd9e5f8cfb78f02b0905410785ba054ca9d9e7450267aa35af97468141280b7e28439f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52487b2db541f7b964fa5bf7e6db4ea36
SHA16b6bb5c9e38079642d5976fbadc0c611df12109d
SHA256cf9c9731e3678d93cdb96f2a222147255e350473ed82b3407bf7d9855ae6378a
SHA5121468dcc6166ef1db3dc320f5a7fc4e508b33c94837819cd24becb3fca5a3481bd3ac70a200a98b80c1b08e2b01dd8154e0557c5c94719d537c42e30dd96a4293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad7b9d15ed6cb980427ce957efabfa1d
SHA1c31c4fed8f71fd2399e705501e1d475ab5b95341
SHA2569cdbfbd4b99fe692908fe2ffcfac3446669501aa91b653ea9037935056b7ac9b
SHA51279c10a1a463406c079bcd2f47918188d2025ba0538cfaae2c9a7b0f36c8d11e3382862a48a5bd487e78983b799a5e9ae8504c39c4624aa13be57e4b3fe66c356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c5b995566ac662ab6f5b55180e94af4
SHA166801b9fc70e687c46af8ad93ef1a6e4f3c3c571
SHA2563a5875851a3a34f082ecd0ec13a4899a37dd8de3eef7bfa4ff1a980faf5b7456
SHA5127c2c738f7a4f608910fd358771ac03cf7bf4df9d727331fbf15b164158f2a724ae36dc66713b72d5c0f5726e5a9d64da4d55a9298354897d9961909ae67e1ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51afff4b23afbd84b9145c90d3c61af3a
SHA1eedcd5da7d209242c4e51b4ea01522f477268ad5
SHA256725c0d1b93a7e4fb1789fcec3a5a390f8790775854e9a50e0df8fd5bcc3fdacc
SHA512b75aa15f1ffc6ad0270531c3c09b881d2e7050c67c9dc2ee05606069de528508a8139bfa409e19fe61e8b6a331d94ee61ad2d99462e24e6c11c56b956cab6478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d78cffebc5f71a6fb4a2cac9d9a1fc55
SHA170e89125865908c5ef19457721bdc2ddccb4300e
SHA256bf7eabd90be3d0f63cd3f20ec27511dadf65e0e014419c4a131612eb60a34b31
SHA51224142f1b85e6ec3be82cbafd218887747718072a5725ca9326f2ddee9f06e92258e6b7269203da878e6431c38309720b9f2d0790b94f25d43084b657272e4f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1249ce792bef4af7c9ce1ea70b335ba
SHA196a3038d4210b08a31fb6ac44777da16ff3acd72
SHA2565747fbab48db5f2e0bab67a8e25e56877befafb233293eab74c6b79b9d598a15
SHA51279d9b066db23c4d820db26586e0ac616018434245ab78a7036593313982ab56861e4c323fa8623d5c4af895d3290a955c7271c517cf9a090d0bbd6e3f44ef9fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51672b3eb0b64e0f99b8b765ad497fe16
SHA1ef062d83ef052e9de2e8d42a7dd33ed195658c1e
SHA25685b3042ed7bcad9189cd771630b83cbfbe9cfb4885465021b6a297945ed31715
SHA51299971d84da135f5fdd46b10f681929d92d218091e7eb2cacc460af5c495fc2cd7adf351de6089748c36f7a33d92d863f23f52b51402f85cd35f9e0e8c6060135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501c63f0e8858bbcccaf9a0422a9e6b7c
SHA10def013409f3154c4db36d337ca40af99d4c4f36
SHA256eb10ec8c4642578fe228578da191d2b3a9db959060f643862fe721ad6f50dbf0
SHA512a3af5bda7f9f5f402da5b8604ff7d2a13beda0eff519c13e0571bc16c9df102941ca763911f29936e37cdd5ed5d7440b7cd323b2aec65f2070cc69c56d9777be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555e7b0c0fb5d7738c018b41317a76074
SHA149fb8c9f76cf9fd0bfe53e7d1bbfca4c1b83e997
SHA25649457cd5fda2e0c8be68fc67c94035006114a6c684bf05aff29969e784141c14
SHA512dbff1954e4bfb43c8898b8b8e5eaa8b19e84bdcd548f36dccc37641b177a5f18c3551962df465aad046c4c1155edab5288d92400e9a11d7c665083b99d3e8026
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a