Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
2acc768f72f35721819a5f495e830264_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2acc768f72f35721819a5f495e830264_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2acc768f72f35721819a5f495e830264_JaffaCakes118.html
-
Size
148KB
-
MD5
2acc768f72f35721819a5f495e830264
-
SHA1
815fea6300adcf838b5397ed00595eb2e1d1d8fc
-
SHA256
0f63a01f620e9d96edf2ea6110591439f5284bff2be992ff50b57a9957fba803
-
SHA512
c0a4ff304d2d0f7b14393cca2b69751d07ed394fbc53f9fa06ea6560b80ed2298ad76165af31a96e965d05ce5984068f07816f2104bc26ac366e17c59866e030
-
SSDEEP
1536:SpPcfqrJUPXEraMVMWEr/A75Xs7UblPzIzJ5DG3SUS9LuaPwgoyLi+rffMxqNisl:So/SzU0yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704c5c5a2ca2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421433270" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85CDB241-0E1F-11EF-B238-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002e3ecd293643710384a3f92c9942c89741f90899f66e717e1fc4261ba8f27686000000000e80000000020000200000007e46a5cad6589203d5ac3200cb50438a172afe6b8ad930eb14528d8cb47dfaa220000000149e0e3f6fe677b69912fa9d9ddfd0a974726668cfe9326a35b2c83f30bbca6340000000735f4d6082c9c92e7776e1ccb833b5870d497a52c2efdf03b574e506c9691a37cbd72d58bb409f0166c57505e52526fd9c537eff53a4643aeb8c47632d256ac7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000053ef65db40e5ced17bfa62c5e8ce0a4172f5b6742fbbdd50e64ac90b8f8d9300000000000e8000000002000020000000170e37006c525bb22b6124af534f64c6314ffbf936e3b4ba8de4b3c8031a29d29000000014e55a259943511395b43b2ccbfc6ee93f4a954a3e4a8efa3f5ffd790103fa041b2166190fabaa53c025663984b6d66267eb5ab4da90ec7d039a1c7da09162c29a859ad5cd45bc8fbab6ca1535860a2491b9f88fd21ff1e28d7250be191babdab3be0b50706599307bc044fd74020fd644d2ed94976deba597f58ba01df44d0f8814f5575a6bfd499c59c61d4aaaa09540000000bd69093b93e717e927027dc7363477e364a623940352906d60ddae592b7a19c7a791a007a9ee47758597281df09463ea9e2f4c2ad5cf69b6e269c56c10dba815 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2936 1848 iexplore.exe 28 PID 1848 wrote to memory of 2936 1848 iexplore.exe 28 PID 1848 wrote to memory of 2936 1848 iexplore.exe 28 PID 1848 wrote to memory of 2936 1848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2acc768f72f35721819a5f495e830264_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a10080c607d98622682ded6a0fff948f
SHA185589617d4e60edcc5e2c3921be086392118acf0
SHA256b187890b926618756763230d4faaa764b716ee5121088c69b488a0ee20a265a6
SHA5127889b8a3fca19bbf668475fafe9b66f9f8d8807570017a88fb465039573f34e3dd1e81a37a211e864c00a19e0fb41b97b361673ca4dbade10e1ead730403bca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc758ec5d61eb71ffceb75061928d35b
SHA122eda01f4c35b845cb3e694cfd4519100233a38f
SHA2562b2f90bccd318dc8fdf1b4d0e3be9ea6db0b89a6f4c2e0ba21d7583b5584e009
SHA5129ea3fa3271ac2c03aec614b617ec7a6e9f9d35e945b1e73847994790cd32f4199de05eb16367164e08a5724032326b06bffd8ffb1dc91c7f637f3716d97d818c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df5a618d7a4c780435dd1ae4df7fea3c
SHA11d5fd8ede9dc4b1a49ba07c53e5c6ad6edc8df7c
SHA256d97193fd48d517613184815df31cf2a2749d2aa99c2cf03ee2cbee3fadc47979
SHA512c99b415872ef2ba4772dc499766a4f33b79652f4c68ad96b31b7155c7da5bfee86c91331f5ec1b41394794cbf557cd913fe5dc14eb47088c5f1aec24d3466b9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1a2e544137cd78788b860e6c942e07b
SHA19657792cd0a720f2493a7ea5293e70d5dc8207e7
SHA256661e2afc5c6503f4b79eb5227dabe34018b9422cda9ef7ea2e6023b9553fdcf1
SHA512f9d06d4fd538b778cfe1fc8653b8b04269dab17d4675d582ba572bda8fdc0560c0b55501df5f3e11d748c98021bbad241524c798bc3f431e2507f72895dba3b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ced66b3d97d41e737382601c0c46f78
SHA1a32f0edff9fb7c55ae0bf35e44d71d5b91c13acd
SHA256f710b69c8e73e6ecddbf0f246f911eff19bc94542b1b4da261165b0bb711a955
SHA512051844fc805a80c132ec88f2371192139b901039d6f09147ecb974c0c7d7c96e288fc3950c72aaf5ee34e6a3df2f8f8d6d15fc56498ba635df3df8e1e781f2f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab63459c8cca5750142a15cfd31b0e61
SHA1b66c5e8feae93961c3da73f05672af983f2b14db
SHA25696896000da5bb9b63b09f557ef1ee5798b51af629db0d55981b97e41e072af29
SHA512fd694dc7cf3e85880e3930744f5fdeb0f68014368920babfa9c2126a5195e22526b6b1f9446d2d602d6847cb9899fd792ec622bf361a188de78416a2f9160c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5397c3cefc59bace85349adf4e62a1915
SHA139bc2dad160ee81d0a3b2b6bc0dcf382f1ff512c
SHA25607b1262a9b4f4a403df2fb9963f094d768f69ff68290079865195f2a30d3e8f5
SHA512f4fa60dc381baa2593d59e94a1185df8312fe5aa3673bae53d8f0409e906a03f642938323bced8390a3a27f3a90733cf5730fbe591eaf329ca271bb0c99de96e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d74aa0a28f25537633ac91ea669464b
SHA1eaa27cace92a16fec261e2929d407dfc264f93e5
SHA256ba7f31c39426dd3546ca0bc1f5db2c1c18417f924cf708cca48c986a79d44ff3
SHA51255da038c3064216971b271ae0255a4210dcf7b60a2e0bb2974057ff4123062f6e2395166553353f31b141a891c3d23636ba0f1860923b9954f200c0082a8422b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3fbcfa6554b7b3180f92be174e53d8b
SHA1cea072e6f22999d189381c763d91bd4c5185b0a9
SHA2566bc6395145ce7080c055e2a4603371784c93ee5a8a9750fd58fa83ea1ccaa39e
SHA51283dae3e8d4666bb6dc9b42a5290c0254aa82b7e84664c6be3c5b01404c30ff1d04dbbeba6b41d5e7a1134f114f17ceb42c1b7967deb84a06d6aac4cb1d488571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5995d25a7da4c12799897d632757e9f4b
SHA18c12b5a08115505800bc30e3fab0d3cd19e27b5e
SHA256c5a6feba1dd56d24db9fda669e622bb9ab3f2a0e2d955cb3d4eab448dc6b15b2
SHA512a12eec31584763f4bcaa0ee7edb5dfa938427e10c268d5189275c2765e85313f41a31eb3066a91d53e64f37e11e235474b0a96803612f0095bf5abbb57cb11c8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a