Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
-
Size
213KB
-
MD5
2452a414d2c1d7c35420c8c0d75ab104
-
SHA1
da5fa99d80ee7aecdf86e4b57b9cf26365ed6187
-
SHA256
7095249465068853b4fcb2d9cfa030e0daf363d1c0b169d4a975271571af08d8
-
SHA512
f58d43a5e8240287eddbcff8791a4dd5ae82250327dbe20a8a90e711759fc0185d9c4830cdf90aac8e40a3189bdf289914ec1557ab8dead6a763f4a1610aa313
-
SSDEEP
3072:SfuPuDHYIY8yfkMY+BES09JXAnyrZalI+YQ:SfXohsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89784851-0D21-11EF-8A46-EA263619F6CB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421324184" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2168 2356 iexplore.exe 28 PID 2356 wrote to memory of 2168 2356 iexplore.exe 28 PID 2356 wrote to memory of 2168 2356 iexplore.exe 28 PID 2356 wrote to memory of 2168 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54118a083ef3eecb7b2ba4c7c37a0e959
SHA18c54035c17ae6997ce6cb7f0ea26fb9aaab4094b
SHA25630a0b812083142a8af97b6e3bf77ce95eff173cbb632403e87160e98f4d38ce3
SHA512392fb4d83920cc164e97c1ed34f8a83243c20edb8c80b7ab0ee65180f17cf1501e1c47d8aa650b0138b8005d4931051a2de9bce0b8f000c5173184b0c72935e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fda50425b205a2a777356641c7fee6c
SHA1c17ae4ce00b6767108bbf4b0a3a9e8c1236c6770
SHA256c2a52c0645af7f1c8fee64d571b8d853fcb0711e93638192eadae6510d6ce5cc
SHA512d8543df7cbefce9c04719fb9cbe5a8add078f42d0b33ab7f9ce72608d2b3361816da309837876f763b436d69ede1a66ddf963016bc39602b82894c4390303fb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e0dd6b7c873772aae1e8b834ba88703
SHA1fdae8386b736e67a12cfbab32b3a561c8dd926e5
SHA256da4accdd0f83e481a2596fa1e29c7a831ab6281b5d0a8d3c4ebae9e4b81691fc
SHA5127d2e71b3e76925990115a44620bd11710d18f12f8bdfde3596a0045df5ee32d5689ffc85a675cc36b2f3de558079d9f4fedc7c081316b28aa23f6c7b115f0576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58997f63716e57fbc6a17467ddf9173ea
SHA1254a191af24d5de8f399702dad50fd4dce64128f
SHA256800245acc00b4eff99c1d85ea9998f1e2213b55196dc4e862b325c4e8e891eea
SHA512e2b280e6467e9085173be5f62d1d1dd2c4e1fbdf4274ea672f40795e50423bde6c4ec08ad24f51c2328dbe2f9d41dd12039555faece5a4f83687a0e8bb58503e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58447edcf11fa87649e8710f6c76dd1af
SHA19fb2326787255e0195e19d3b7a90bf3060325f24
SHA256859876ec60fc610dea98ba0702c031ba7e06b42f749fa5b700aa2bd7b970b954
SHA512c242af12c24cea004323243fa1f9882efcfe49a5ad38ee156c9ede30baccd602c32f385b79ffc37ed8f1533fd8d3bbc4f248d73c9ce290fd1e5b5b4285c6d5b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522d6e55a0bd507eef91746c8480fdb6d
SHA1bbfcc765d067190176684a51dcd86c15dd2a1d9b
SHA256a9046c5c661096e732a92fe60e68d4db8f5be94746b2d0425b96aa17e061e69b
SHA512c18c643665c452de25215b354c2e0c27b786b411aac74264c5376c98775ae4aab5f1c4ccb42405c2f9e9e90f5e3af14231f6805a55f342b573ae5700d6a9e4c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e43749b77e1beba90d7b99c7a60d37c3
SHA1cb1ced2eea0ec46e38f9cf90a657e032eaa396c3
SHA2561f19e2e8cf012eced01fff4f4a0aea484b942514ea08018b72024d4397eaa05a
SHA5125657ff1300b3b88624c598bcc5a2fbd4d01526737f1fbec1134b0ad693e85175a2ae1d343f43c67d2a9321bf3ba7c2bfb409c457b429a00bb7c05f447484b33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f55556193b1007b59d790b4bbf2cb03
SHA1d1212a459c572ce0b3299046347c3c2a9e6cca2c
SHA2561490d7b0183f0448bdaff86390997d94ee6459f6e86364d78e8afc6216cbc08f
SHA512adc4c0abb895d79398bea61a17c849531356e908188dc79cd845fa13a57e02a1970fba95fa02877a9b9dcacd3478ac2afbd690547cbfdfda698c2cb3a363b0c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58149b685b73b13bc44a991eb2e88da11
SHA1b3a775b3eb2abe1a4607d2303cd276c697db1b7d
SHA256b89c3be51dc546ea2bf1f40fd543e8d829a95fefdf123d7b1f3cb67f5ded4a5e
SHA5125a83f3e0ff89262eed44963c3cb059ad9164578d8dd5386003614d34518258e0633e5bad9bf14d880f1e0d590b5bcd503b8ebcb96331397da5ee69ab18a8b735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088bf825c5b32f838f0cb428e4bf5a8c
SHA1a147f078e9d747a9b8bee0a7a13693980a6b5508
SHA2560a20b435ad4c3b873cb6f93ef88db65325440ee5b84ba85bc97badd7766c4aed
SHA512c7280cda86943d913f917350f032a44f8784f36bd9aab07b52d86a4469d7376b8c1696cff965acf4f7e1659fd0bddcc8c6e1df48a3d9de27fc83b5473428ca35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f2932f034538fb343f5a85dee7801e8
SHA1aa6fa52738ab0a52b3795d0aad7793e545896884
SHA256856134868c7e11ccba7ed1ac5edac92206889aa86ca2e4449c2b1f0adf8c2686
SHA512d58863f596538db57d6deeed5872a9c635f311dd3ec406bd58da58b7bc747703cda50cc82c6af013c550e3c393af9c5c3d21f9805b23902891de939ef767a5bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505aaf4ba1935152f5e335e196d201227
SHA1313d3556a99f131a945e323605d4b4268fde9711
SHA2563bc5eaf30468642deabd0ba13443d97105a033efa4a6d99dda131c36c8adc801
SHA512448ecffcf3564b406c0a8eef2c37beff540efb0643697007443bd4eea757cd84f8fe7205183c53bacc0a5c506c00b32fcd7e4cc5151afe42c7facc09e1c74f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5493c450456d81dd098c23609c4819dd7
SHA1b0ffde357bec9ab80bbcb7699b31aba95d7ae5a7
SHA256411bd435d8b1da27f73b78f1563162b29ada10df9b7dfb13515aba86512fb0c9
SHA512b005680a7caca7cfae57afd0c19f9c64e8c1b963e9975c16b02b70929e013a4b90b8427e8e227b7cdea7efea84b6fd2dd7819f9e75e3ef387b86e4932d4f8a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5900cc9e1ad39003c4259dede7fe604
SHA1c6a4f27f87b6cc21ba2d9c9c9a00b661417d19a2
SHA2562917d982f25d70eba0717afca0210e27f4e9176eb9302689c49dc37f32a5ae16
SHA51259698644cb7b060e9d90337da554afcd63e1a2a585a968fa88bc10b326537f6e08adbfd778ac86efe1cbbeec43f9c433fc766c1d826b518be604cc87153fc1d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5786a32dba49dd02169b09a53b0cf2910
SHA124ff671f446a593b01d89b52d731429ccd68923b
SHA2565f9422c3393e122ab0f575e988d375980c366c4885f778abf73438852240d792
SHA512eef8226b66b7f992f8104259aeab39171af2fad5173889690dbc2ee37213a00b613821e413e6a1d39c29be792c44d37b0e0e70811922024d5305b58d9a335e9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d43a14e6f3b08ad05516849debcf28fb
SHA133c78e95829898531eb7d165e788da3b3b4aa719
SHA2564413be64890cd21fd2c04eac1aab7ff2db1508d2495b6d2b03e86dd04531864a
SHA5122268d064b5b20420c44cc806d4610d43febdaa83a7314faadf31acf30b72d261735b74d78a945cd8a7577a362b2b036ac1e0889493548932066a7ce81f3078bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545c9d13925d4f76dbe9b00a6c3472f78
SHA1ce608e47f8b8a95984057fd965107c676b72115f
SHA256e400aafdba11a63fbace42c5fdf21438421c087d814c3166a0e481149a242ce5
SHA512d4861fffad65e7c16931bd9e0655c24d023297e40c6a6e77c66cfe464c54b6614ade1d22a3ac1fd5e6ad3d5aa4584d43e72b3f025ed89d2aeabbdbfc03c48439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd501e8063562183100571807a63f834
SHA1ba111bdb8cdf8876f3adae1b69f7d7965d1b4399
SHA25670a29c9185c53a8252975d084ba613e6e6cf9a097ed4718ef0e900c7f9f09d33
SHA512078771da3a55a64dbbda083af140b7a224f61e0891ba31c645e74104aa7a3e31bf624442fd8c644ea0654a3a2aeaae31a126698c0c6fb8d9b47de440b25c86b9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a