Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
257d00de64211f70fa9b5ebb7b85a257_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
257d00de64211f70fa9b5ebb7b85a257_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
257d00de64211f70fa9b5ebb7b85a257_JaffaCakes118.html
-
Size
121KB
-
MD5
257d00de64211f70fa9b5ebb7b85a257
-
SHA1
cdfa61bd195c17cbaf03966ae94633664b8bc886
-
SHA256
a273e50d1d13984c6c436fab3c4eb253ba6211024c0a89d9a08d02e606ef5b41
-
SHA512
21a98978a2b67823f4508ae7fd286346faf161cce795091e6f9d9495e277fd87382264b038143b6574afe93dbeedca49d067b2e8a2c4299e33ec344fecbf64c1
-
SSDEEP
1536:SXMyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SXMyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bfbf7b5ca30f7dd713ea022fb98c5402efa43c4ea21eae8f906dcbbf9f98b88f000000000e8000000002000020000000bd450cd590712bc009bc690ffc136e6842f8c5bf171fa7ea865dd2378b278c93900000007a59c57ef920218b955e06eff7ea87ab1b80cfd73c63d7b469f957b5839faa10b537986718a553acfc19921f1635e8a67152edbb9091a5af285d6d48c28859a595af0d97c3ca973861a19e1b93283deff4e64bb43c8582281f3948736856889641ff7956e3862d7d056836e9540f0541d878890a061672cb427e9ecbe28a60df43e9e46cafc07a21bafd9abff7fa5114400000003aadcbc747e04068b924ad43e4c2e1e681eb1d56b457098cab666c9bbcf0ca81ba3d2eacb15d15d05b8d7bdd31f5677175be8082d7deb205258b9f4d43c63f3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a237245ca1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421343845" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f78540ae4e6304b052845192f7bf7ffc35fe085dcf2e81e902b2893346baefce000000000e800000000200002000000082edae15727544094ba89ee23958472c4cbe014102744d29f1bfc1b17451315220000000876f043a40c61c8162a74b956cf5cd793f12a8807fc343f56263aec43ce1bb35400000002ed3e62b2ea5262223b4d77c16df16afec5e10dc3f80ea7662ae7fd57e6b6c3850a34fc8bb7a1aa6cc9a96b20a33bf8a33f7a50490e8d374f30cd8ee55fd7041 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F1870D1-0D4F-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2136 2700 iexplore.exe 28 PID 2700 wrote to memory of 2136 2700 iexplore.exe 28 PID 2700 wrote to memory of 2136 2700 iexplore.exe 28 PID 2700 wrote to memory of 2136 2700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\257d00de64211f70fa9b5ebb7b85a257_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501a58d973a6745cd752026712e134ca0
SHA1c2c54315d21ae485b898d5666e79d977f0b91b0d
SHA2568c822b6be3c1b36428f0ba9f9d28b7f30a2de79cd0dbed2db7bbc64bf34cbfb9
SHA5127d05451d25f613fdddd203d1d81eec980ab552f6d7bd750df562d5eccb07e8a4d8f53b9e245b70d000b6655dd676e6c8fe54f90ac160fd9bdbbf1730138446ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e095ff96991090976663b62f0b654069
SHA19cfcb88e24bb6a12a59422303e869e36cfd9f508
SHA256d9ec9a26dc09412d1aae63f714b5b1c9587fb02e437d842921524bb18f9b59c1
SHA5123fca21405416547952eb14235f45d2aaf68eda25fea9dfc0c504397eeb7a7a1d29d868a02e2d40049d89b100293d0925aa098a9896557d530785e6df4031b041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e14d0a64d0a63f2ac8470f578c5a4e8e
SHA1469c33ca04f8773eff693e1255130cc4606389dc
SHA256a05a7b060bc7c22842d23e9ea4d6f12db874f8ffc52e58fe7191f590c3d44a2d
SHA512647e1c98440f58dd6e3264604d56e626f26740d583c5f85b8c241f07bfa08b0ae80b2c768969eb739d4b0a24739485da65d193cb3b83515247ff5f011755d9ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599f7fb2f500d764ee57940220ed5900f
SHA19ceb293a105c1419c6bbf955fa8f4cf15ff3b86a
SHA2568f25958f830ea072b14341d1d1cc1bd5c044447a64132de958c3ca03a9492681
SHA512caa514d1795a937009f294a60d82ae2c89d6db397be9b2fca970b17ef07ce216e72ba749063a08f930bd723f01be305d014c2076c2f77f86f9aeccd005d07782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5c6915b813f2e6746b95b9366f3b675
SHA1dce60e74389e79745ff729ff545a76139cf71bd2
SHA256fbead9caf57a8ed84fe0a3b86968bffaad703c747e512967826e7d481bace7b0
SHA512ef24b8af3fd7ff52f0b5a45c1fc944c961dc0fdd25993dc4b428d89bf909b4411b7a58b1ec9ccb4c30f5eba73a396c27290c4ff1fd9c18417f1ecdb59637da9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58096871f131ae2b0968ce8b11d990bd6
SHA1f18cae9ab0a123ce23e675c429bc5bc2bb9e5623
SHA25622deedd3776bfbe8e849d48faf3dc91cf0d335f4a79cf08ae70ce8349b41202c
SHA5121607b1bcfa90e3a356c6b8596d1d1d3d51c9e4ea15f538a2e8c4b8c45743d5bc054235f31b33ac7837eabdb21ada2ef740017ba8ffe0ec32c9670728912a137f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d21c0319ebe83b38b62ad244b856a73
SHA1a61c2c1bb59abb41e91a69314c61da72b2620222
SHA25640af9d87ed6355ce3e3153de3638cd9e84d7ea8c0b45f2ab55b1462603b19130
SHA5122b0099d531f9eeef96584dfe282abb4101d0185340dac8e73210ae9ee8a97522a297345417723968b7dc7327ca382e9f1889dc63332213d6e2eb0147ae7b1cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a685b9ffcb7768b984d07e5cd5aa1a62
SHA12db7f90dd39153abcb35949339b067023fc6e9d0
SHA256496d9553ee3665fbee268eb9fe2b39f2b35b8eee2612473e6f7b241819417505
SHA512ace2007e724944de260cfa6fde571ff3e1ae806f3f2c59ffbc885138516ad477a7180dbe060f17d85fae3470a74c4f2dcb5a5bedab92004fc24586f8f4ba9a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537d0c9997aee058fffd99af78b9ec01d
SHA11b951ad18fa86f518b1d33951b95904355aa1d3a
SHA25690e6085e59a9667f877acd087f310e6b572f67f32f01d257e0f8cb6175f30bdf
SHA512f7926805d8530ae397d69e91e544aee7ddb5815fc3f7e57081efd65588ea30de0b71b1520a93e18692d6dee06f237dacab8caae27702febfdc9190a98d85200e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59783a447ef07559b4b41084d9acb8ad7
SHA19c6eb5d63deafb4c2ab09be69be1e281bb6b4f88
SHA256ab18c3a40595a38c47c14ae631c50ad7ff53fb9f22530c14ec542dca9ba0fbab
SHA5127ddf1444b84ad9990b7a6a04b0cc733060f49b104873a374a45858183a3efb2f6982b7e6cc08fe8592f55696dc1a2c728f95420de0e97b6a14d328263fa60f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f86e37b1cab2106cc9d30f96936dc9dd
SHA1ad50d85466394b29fdcdaca026cc88b5e63fde6c
SHA25630a4d4bf86229385a207f293be5b29d71727718d87372af573cce6d9b40cacab
SHA51205b043c21d41df1c4523a2317e0f0a29022a768c4a9601c6959f1744887652c972294845f36f99f5246b546ec427b1059ea2ad1df1e70ef49307f7de297f189a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565d6cb5f6b5c4697804cc99bf2ad3c4f
SHA159f282151451a9a2e714c1bb91270cb001a96e68
SHA2569ff15245514ca7120ec0a6f4bf65b5c443257ab632f3891e16f44d5055a266fb
SHA5121cddd728d82e0bb29981d2e0ffa16e680f656e11f6a4d1630a2f532a0143295362d12df2f0ffdaa269d62660066cfc7f97d74950597558723e3462ca27d8903d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cdd17ccc5b7954f1fb18750cde1c3ff
SHA1c861be42600d9e06abd7a60d36ec809ced3f10d5
SHA256ed51e252fe82f2abf097d5aeab51989c6efa704cd94b8498485ea5a551db9135
SHA512185ea2d21ee80367f83cd8f723bcb77b2af9eb5e3e5bb5e616bc8fa76f565058c3a2750d1fb565af57ca417e72cbdc601f8e9186f68f468d00f7bbd5d58d8e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58636e08bb3a4963e10612595c12c568c
SHA1c3fdb9d8508a1a6a9b6dc88b414a580672d356a4
SHA256b62ac670e65d80297ccd1a066cd68a7703341e013568c4d5e71654a1f62c2f12
SHA5125175e5666fcbcfeed05cc03e3c753967eca5b6fad9b74d47e7d5a56418f76690d775e082a1a0767a821a0bcee6ec4cd890ed20edf48aac7e8d76c5fa427ae343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5020853afda60414de01da842d7b4ba63
SHA191f2d95f945a7101b7c8cff8829daaa865c00589
SHA2565cece52c275df9935ef85dd5d2af167a84ccc53b7622922c1d0a6310a5ecd575
SHA5121fdb254cd7bcd37688f8041be6a5c819524e637c9d0e5d58b11a12c55a9f5e578ce76dae80d5c84bac1df16b44682377c63b60d659206dac1dfda0127626f473
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9b5f967dd64bfa5d1c9e6fc95a7612d
SHA16e89820586ba83c25896a6bf4444f08d03a8a728
SHA25616e6ba0e1a06d3fb224bf573767c1d2f237b651e2ab598c74e865e414f6fb3a2
SHA512b31fd951a1856237ed92a637ae9c1285d3385b5dbb7f4550a7038d4b051dd46f7665f0c3f3dc33210f25e871d70c4f14b95439e1d80bd2bfa13e3a1479df2da6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59357d0e5aada5a4a036083ed61d7ac8b
SHA1027b4788e783f45fdaf8c1369a838b33a1e0ef18
SHA25622b1d0b9c6eeaffbd4fa1b0d36165ecfa92f42587a6770ae83988a2698ef8eea
SHA512b9eb87ab7b56dfb5d8877d2643362dfd76c4df268bc4887d793fb3726c2015f00c079a2eb11f494069017e86b6d70c979181a20646c73e2231b8ff59f449afb9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a