Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 16:42
Static task
static1
Behavioral task
behavioral1
Sample
2ae8415782746dc62358fff180fa7ac4_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2ae8415782746dc62358fff180fa7ac4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2ae8415782746dc62358fff180fa7ac4_JaffaCakes118.html
-
Size
139KB
-
MD5
2ae8415782746dc62358fff180fa7ac4
-
SHA1
62b6ee953e4a8cb6a1adf6751329200c0f30b609
-
SHA256
09c15303588419c4b5039740ffee6c33b87be80efdd1932b3379db81ca0e50a8
-
SHA512
71ea3db247cad49176a53c2b3609833f53384f4e83cc5dead5bc82850de33b339e8f3131033e0a8e646f5851afc17e9742643d2767d44f5348dc89600dc62d7f
-
SSDEEP
1536:SmCvx0E5mHT6lOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SmCmEK9yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000430a564f9ffe9d3bb221791227d7a7f3c618f3bb6fa0843d6041165bb2282f7d000000000e80000000020000200000004de66a75358d4beb2b9df5ab7265a87e0505812fc3ac7f4490388bfd637b6bdc200000004345782763e5f0b981dd15e0c2790ff82656b4003faa51ee1107c0c3d313786d400000008de1374115a352b9bc0287576e5cee8b25b5af3314fc10035f4e34fd011c37e25ef6258c7f1ae810c41b1fced1465bdd49ce0b8d3f1050e1487b680cebece2e7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0043fb3530a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E1AF4B1-0E23-11EF-B3A2-4205ACB4EED4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421434813" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000344d45a4b3fe8e9513b349af39e96a4d9e6f0c0ca89267668371780a941a57f000000000e8000000002000020000000a251331138117f3954d14087f2e227199a989ff0f44bc1a9899a1e4e2fb19a18900000003e1233f672cf642fb3fd222c1000484eb40ac004dbdd64d72616b6550ad52d9b905b0febd5ad7d7365a92bb890e9c437043ca053a094de5185f4b04ddff5991cce6cdf7f26af547fd3dff1c3a9b1832a2a9ed6fd26a10b045d76ef9116ddb4be63beee65b2039725cf1592d379a2ee2f56168da668bf050666e813860a8c84f2bb1a36a3bc8579388961530da7c94d0140000000fe9048a08336b2c592c1ca57034497d38a40494c6858c8f57bed722b0b24dcc4f2c8cd79f2294b15af0e7bd8b5c204066652a9f55632a91cf6115d9f3420ce45 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2576 iexplore.exe 2576 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1720 2576 iexplore.exe 28 PID 2576 wrote to memory of 1720 2576 iexplore.exe 28 PID 2576 wrote to memory of 1720 2576 iexplore.exe 28 PID 2576 wrote to memory of 1720 2576 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ae8415782746dc62358fff180fa7ac4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eff095ac66dc0346cf807803f21b3b9
SHA1c4b34522c35f232e038457c3c7c8b5280a659676
SHA256bffefd26b8b4b25d79fd5fa442adacef404aeb581f1c953c92b4b61864eb3825
SHA5124bea79ac02f972a878e76345c3c2df94dcaa61b83b7da5ec36f47506b5757673d3d9c26c325f28367a1b6d085d64edaa819c9350c6cb7ab4d6beac8ba64ac3be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2be5c186915afb5fb2efce3cf107d13
SHA129feb16e7e6fb07f91185718e124b7e7523767d5
SHA25665580675ac38159258efb95e18b4e8e64a29c335f30f860913dfec89962bef1a
SHA51230c27167162ba63375c533824b70cceefdd3db7e3732964c2017165153b028ecfe79823bebe742c2c43a6a1edbd23ba5e338dee080808ed09594039e8d150e09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d6f25d8bf4ac28dbce1240a5a682437
SHA117c6ae853bcbb0f6c610aa5db75ac0d86ecb950e
SHA256f29b20bd2dee6b6baf6a041f9c12b693d9f6bcce60602c4a0f07c5d0b8c4bb27
SHA512b90456348c349d7f667ed0b340c7e71c8dffd189332da514993e61a94b87382852d6e084aecf19b2a8f877ad8b0bd2369917dcfd6c54b60b546f42e0fcf9f214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5552bf9d0471746b97b9e7fc21e50568e
SHA1563285daa3dbee0225bcf960a0d3a3b8ff24755c
SHA256f0bc4b8bda120ebe33d9cf06d49d0f4a2215bd18d5be609e84e5755cd9be5970
SHA5121bfab78fbfb75c56392ff0672d805ddecd15534f6a507ae0cfd8d2074c1f0f4894788a843fa98659612f6a2c0d679f3aea120cedb1f1f65acf4f98ab0d15d1df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d2afacf52053ca44fc61241c1f6ff06
SHA1826faaaf1272fb1547b868a47b35178b0bef4d12
SHA2562bdc367d4207189daffafdf1aa868ed7b8a837427383a87112b17982af0f9158
SHA512775091255f1e1f3108f94c3ad9d60a4c03d32d1333aeb0f3ee3c32b0b58ea4d6433ad8bfa892299b18d2062e0a177d9c076fbc407cd440ba3986157f8623967c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500cefcba6dc08c350baaec1f50baae79
SHA1975104f92d69efb4dc29c942637eb34963afbb37
SHA2564a3557938ab0f69b1c79cb74716134949602f7614d216719eecf7259d9cf3feb
SHA512c0074e1167d2f160ce8183f2d7b37de7a3c02900e3d0ae311c555e2605bd86b40507074cd8e3bbe3904bb30996257f43b6242ddef5209cb193ef8bd7c5144878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f49ca63fa70a9dbabafa29d818877569
SHA1d7987fb763b8892e1a28dbc0009cbca8139fdafe
SHA256071c0e8fcbce2fdc9c2914879dabba6c8b5fb55d8406783daa04c778f4e62fc1
SHA5126f3793fb4ea5fbe1c607148c119a38dde0d2baf5294927f1fc50f52c81db1b3fa7cd3b8072035a93edd1f4931e929fe0e24929c7b3ea515354e2992e05c9eb81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54007014cf56463a22fa956bbd526a09e
SHA1d3c8fd11ff45e5c19108c06998b2b1a87c01ccfb
SHA256dc9bf7898bf6c89adfac73bc29906cf6161a8235d05831e57225a755d29165d0
SHA5121d8de17ba49281b7e51da4c62af40ec7598e73435afc71f664e92ab5a5f6ea3fd521ded53f08df0fd99473f4816293a4c4ac7bd96b9ec3a394a654cb74bd4791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef474e020207c5552621369d6ce62cc3
SHA12393a119e51145b986848faff40438a58fad5172
SHA2565a341b8ee014bc3a61313a8edd192a5af47b0795c8f89099bae15e72f279da99
SHA5127de7ea3777d65ab8e23d88cec8769b8cb9cd55cf27d506e4c7482ea595f91b02fb5f25badef848fba1e33b324d91666ad578ad2811196a593ee958b4ae4a0cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5260076d06c99768e03dc6524fe1363c0
SHA124b3a06fd03dc627d180154fe7d31ac3b849dd98
SHA256b041e71910bbdabe0071adcb1a7af5cd889e35c445a7a391c2f7402daaf4b3a7
SHA51208b0b508f5ae57f1191f493f4ae6ff19adc1d727faae5e9e184d3520e6d9fad3b1cf728635e1ea568f4abaa55a1100d1360da80a77a38b8ec6def218bc16b9bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57587ba56933b0fe2515906151f472820
SHA1d3a8165a61de8795b1c96016cedf71543cd15c47
SHA256496166138a4e9b6120fa880d56830d699d548af4dbbc9f9adf6a60c585f7d489
SHA5121c5b52c1d88424214b6ebbc012e72210b02638c3050dc84041e0e2940a3455fc03e629e6600873e3400338eafb0f11f32d99b361604fe15a12a87c12860099d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cded70aa0b689ff776abd9471d66b9d
SHA1edc6e4484418e8599119809e351d09c459fd4569
SHA256943abfa94e34b21810cdb73bc3536405da3a2b1d3387ef6805588ff19a8748f0
SHA51200aa941c156589401c2912013f98c8dc5d304bcc2df5413aafeafa047114cde699312568fa095b548902858fa38c631e8445acc12ebee5b728630119179ed7bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d50e70d5272af4ad1becff812fcb6cbe
SHA1b1fdba6336b086cf120e63d6d485500fc9513bde
SHA2565c70b94c54fddf6c4bb824aa8f6b03b2a924f2489b399c523526acc11fece134
SHA5123e898086f5a0ec50821e99b1560e5437c0c1ef2aaca31eb10c380b6987189e5122d682b50955bbeeea7647d1f3c9a13bdcd7c0af5650375b45d07db3db0d3773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c8aa37dd0062d8e4c09069c9b363686
SHA1b5d5cd687284ba7c022627f0c200b0c4abc04c4a
SHA2566ab1bfbdc85164429c49c984691248a45679925e9a17a88ef31b054879d91b99
SHA512af97d89acaf636a2417c8474b648e8fdf271acf5804542bed52ef148dfdcd6a43a7a95ed0e53a48861f11ddece5304d0db7482a3564da374896c2a0ea9e5b6d2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a