Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
21b0c2345c4bc7fbf9ee719d74137320_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21b0c2345c4bc7fbf9ee719d74137320_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
21b0c2345c4bc7fbf9ee719d74137320_JaffaCakes118.html
-
Size
6KB
-
MD5
21b0c2345c4bc7fbf9ee719d74137320
-
SHA1
0325dcf331f6becfb6a58e74e9ac4d9aa192df9c
-
SHA256
c4fefad8265dd1edbc14cdba387ce590ea435cb4a7c5eaba71b92941d4acdb6d
-
SHA512
8ddd27708427c491cdd90eec930fd38d82a69ffd41590329e7923520f627ad1c7ed03e23e50467b852db767610f81d93563fa64d30f6050d25e22932c5c44a52
-
SSDEEP
192:Is9PQbNPa2uNUh5hJALVWlF2jI5aT/W3K:B9Pd2u8rKU+nO3K
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421277202" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000086806d86673b71c75ebc5fd1cb5a5b02af1bbb6a2d8a6b75eb9d6cdc61aea31f000000000e800000000200002000000007f280c4a30a4ef9726403239c9ed583483c122cc01b4e14f830c85c06c6257320000000b1a1a1a2a4bf19e4e97dd57a94fbf68d85aba69068d194b80f445952da7991ee40000000e28261a80aa6f0f6aff435f32621f37e466494eeb0e28f29e5c7906eddbd7bc032736809344ffd16dfd3d7595a0ee4018053588044608fe43bf8a6021f3bdfba iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707953f3c0a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1ED84FD1-0CB4-11EF-8745-52ADCDCA366E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000de1ced12539af2cb124266d8a735fd62e99db2f7f184d8981cce679aa8f6d00d000000000e80000000020000200000008d5214a46f4b7f6bb7b746f007e5c3352e8ae11c3b277d5480c0162aaf781d0290000000190b7a7553f215fb8303238327eb33a26e14c803d1a332af77e8e29bc1e16449dff131224b2e3e2350d75ffdfbf20eab14e9a99089b61a70d679796269c58406b090c28828929a4be7794ba67ef62e65ea4d9999272379144e602f22cbdca8b6e902dc9acc4cd711e78c15cbd32d9079493c8fc2cf73305de3a19631a2dd41fdcbeab8282a869105eceedcbc741e7fd2400000000ea08728e0a47d1075121864c641a9360b1a240542348ae70a4fea83211e16392cd2288e88d04528dccf4febba949afd1f3446a9c9084ceb24bcdc67c6871e24 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2776 iexplore.exe 2776 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2216 2776 iexplore.exe 28 PID 2776 wrote to memory of 2216 2776 iexplore.exe 28 PID 2776 wrote to memory of 2216 2776 iexplore.exe 28 PID 2776 wrote to memory of 2216 2776 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21b0c2345c4bc7fbf9ee719d74137320_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525ed3dc34c34c52faafde0c8d6123123
SHA1410b69029d2155e1695a0a5e9fd4e1100725cbaa
SHA25640bd4c721e8098d62a7e4b797f448e1b93ed350bddafc57f9cb6713a26f4b023
SHA5122c65651363619750001ac1ea60843ea44bcefc869f15ac1c9f33b5604bff8a3b7ea4371412477617a38a3d3fbf8d8ad173a9b85ee1ab9df02ac6a6cb7551066b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7c1c9a3719bc3e947ab7dfd546dd579
SHA10a537f9d9cd9608972b427d1c57d05bdcb9eafb1
SHA256b72bf4e50341edb1790e8e16dbdf1f37343eab5316be32552d5ce1968a9e331c
SHA512c86efb0653c12346e31924108f2e83fce04941b5feccc280429ef633e920c39fdee66e981248cf69057e1fdc082746878a0c62c90e2ac6e2cb2360e4c7aa3f2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a85a5ebe4948148cc9eb2a745523767b
SHA1393b4c86836d2b54635cf78856b485671bb00559
SHA25611ca5fe0d6daa69ff5e9781e2a36d5c88e2bd81967559345d3d3e507445bad82
SHA512b181600ac97c2347486237c5b2ee2ce0a3de0776ab313915e5e697818333a679395fda3803c8b36e2a4d341468e845ba36b6f9338f499e91c6869b6052cfbf56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513141dc3b4a3bd0405664b0c7c1c817a
SHA11aa041f77aa83c9d3811cfce953bac6d419e1b0f
SHA256ba1ebfefe4df3311ed7e0534d25ba67010609fe685aa5cd39560e0e6b02700f7
SHA51261498a810a99014ba3016d23f1bee876ce8a72f1b750c5005897c37cef418317a64d392bcfe5d2c2cfd9c5d5429e51e697ba22b3d3df58c95308caccb7abb380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f10c0f6d4a55d20df97f332e7360c63f
SHA11d978a88ffd17545b0cd39231d86ba36db592ca3
SHA256a40b46e326edfb505784f29ff78bc9f09ed62d1ce9b810751d4c37eacd074bf8
SHA512ae856278568a30c2ccb91b0face23565680a4d84f1b12bf06be3820663995edfb58abfabcc7cf4f15f933c1e42b70271806660dbe8effc52fd73a4a1882ccf8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfdda7449436cbf3bb721f3c9bb7afc7
SHA1c7888e22231f6ca408693e4e2bb8789580538e2d
SHA25622dad90e0ac4286d5460ec77534bcefffca5f7ac3cf60b56e2c5f62da9379ac6
SHA512d068785914ab67a584c577cb2e22104b69b966d92f51a712ce6404b81fb270bf56f2109c4916936b9b9b43d973f5e522537241b4d703ef34ab9be9253f3817e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e56f10137e1a3da33873f27924f0e267
SHA1b18b83977e83527a3dabec665b29bcf6444d9319
SHA256b6d2c8633a875020f793b3bc9970c1606a284e564350baad32d9c5c1011df6b2
SHA51215dcaf2e8994cbb3149e35ac527357e9197a07e29f802ddb585a7875a14230664566a7e0dac89bd65705313143aaca0b4186a09b3072c85ea6903ebd4e5475cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a7dccbfd419d323b2f2a844e9514ffd
SHA13a5c0eefb75d57bd610986752edf8ee4f04d7904
SHA256ffd6d6b9971a0128bee21b5d6013d4ff45fb3b81c5bf5587fd09cb9c84fc02e2
SHA51216ee4efddf52617b11be82893a49ba56a06213a5a174caa7244d33dc5649eefa8ddd44fceb98c57bf8c7ddde7e90211e0ed09921b4908013e75ff1e501c5362a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faf8e9c40d2e21eab82de55e270fcca9
SHA11eacd53eafd6d9964102edc30bab94b91ed496ca
SHA256cb2fa9c09cf8b3f3959a757de92691dd8b712d4b909f1d7f976f9546080f0c5d
SHA5129bacc7d90e91c9101a4a0c62a7cd802c2e03b24fd71c586970a6aa6e83aad23ddc8f265786709d2f64b8646bdfae026a318c2cfc4a30449a1f1e1da0eb41b030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551370bbf61541b8b73fca90cea177b54
SHA1ff3159deef21dadef1895dd5fde8918acf9938c7
SHA25666ce9d862466bd51ba6e8d33ae8ff4532a71ae998be8b4af46bb2dc4e484295e
SHA512f183b519e3d2405057a758583cf2ac61c7e2cd3dd7584e6322624c5cbd501df46037bc738f978ae68e46576a50cc3551e49ee85db0f720d5fd1e3c37fff5678f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55414d5ab0308d0257ac17c1c1086b866
SHA1eb5df0cec846d96613e975ddee5b693d918c601c
SHA25652684a1edc9a08f9c4f130bd73ac76e90a0cded772b7e3ed568776753e0f0306
SHA5122df82b29b09baae4e1618d3f3ae957494612d6b9acc881a2a098059d68c9a71cbbe746bd610109fc5008830430dbc0b53e238c50ba4a8db64de54d3d48df0fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51710f360866fd7d85dd2c29361ae3add
SHA15018f5e7215b10fc25074962719051fd08218c36
SHA256872b05f6da269f804dcc231be2c0d2d410267ca2d3bda94b0c357c4d2959ac1f
SHA51205a84229dca646d8e6c5c2836926e2731fc4bbedd3176c048dc336a3057293250e28a23971c7afdd58e4e0724966222514dfa25c5ae064430b74fedb1cfc5033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c702dbb0b98bc1d43b0cb35804ad449c
SHA14e63c6159183b3e9030d5e67f0aa8ed18d162bc6
SHA256bf8040865242fdac02f4eee1725eb7ddd97364e52b8623226287d5b4f51b4d40
SHA5129d6cd173c9cb31a00501255786a48c4e9c4cb1618def681c980114279a5fa5f0426dcf039585fe953bb7ec77b0c7e6b2c548945e317e7e54e81454938e56b0bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9da6b9f36499565f6110bfd8f6fa0a2
SHA13d3e161932e691374f471f1cd50aa7e8ec154681
SHA256d18dc832f6eb94d5519dbb59029353a953097201b1a308c4ac2c97f2dbee11d6
SHA512d52dc6f4160333f4e7fbdcc93f4b3640038250de171111fd31d738117f44756954bdd6da0badc8f8d45bd575f63faa2ec88f6750a23d996d47041f5c73bfec1c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a