Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 08:18
Static task
static1
Behavioral task
behavioral1
Sample
2e30f92c01374a59183ac05234e9e3e4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2e30f92c01374a59183ac05234e9e3e4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2e30f92c01374a59183ac05234e9e3e4_JaffaCakes118.html
-
Size
177KB
-
MD5
2e30f92c01374a59183ac05234e9e3e4
-
SHA1
72a82de8ea224b7088d65d1bee0e9ac026d4e055
-
SHA256
4093fca60750e8a8b539e74024d0b4cbd5983175bb18f3f63fd443f2cc058ab8
-
SHA512
3f65a6b08eb231aa5fd05c62a1d98714659439d902914198802551d2822c1d8738f0185506e5c854362685b39c8701f9285b3c48879cda228aa08eecd8f1f68a
-
SSDEEP
3072:Sh3SiTAYOvPM6CyFyhUNV4FkNv9wxiTp9VK:ShC7YOvPM6CyFyhUNV4FkNv9wxiTp9VK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005bc43f56dff1b1d90686a43ad81d6d1397dec89d9b9f20908eca31a7eaf3bca4000000000e8000000002000020000000bd15dfd03b6b2ad5b0fb944db6bbc5f28a5c59c717dd653cca024d301f965848900000009a14adeea10cc3fce2c71c5b37ed7f03d182c7a00e587fde9c4fbf48f697d23ef921c1ff3b3a86c37490a7e0237c63fd026c898ff3a004d95a6e212906b7c1808d87b86c7e2e87801b08aac8ff526401528b265e1b34556a97e6947cf2fd4071589b0780a70b8a73a00b01e251211d5b255b82377ecaa8999162ad11fe47331f10021aa68cbc7025f0db69a0f34ecb01400000007c5b6bc6d11ca033d550663a6e113e642b825b88dda8b3059f27806a15cd55e1f3313d253eadccd0bd9b8c033a63dd3248c6791eb97976f2535b72e0775763bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3B8D4C1-0EA5-11EF-A635-D2EFD46A7D0E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000acf90933070b7d806aaf587f4d8b4cb86886f42379d756087f15e3a492aa90f6000000000e8000000002000020000000de3f130350c8d3ecb88317ad74b07b3022dd398371a8557d15a3371a9f8b687d2000000060f5e942bd5d155203a99e9c4c27426294986f4eed86473284b4d8969dac496940000000111c5f180a824bacfbb25a702c449a268d8ce2a32d74c79363d7d86a4c6d02afe9d7a3389fa6619255dad7d312f1261c4c0d7861ce980444b344f13b7051c919 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421491007" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509abdcbb2a2da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2024 iexplore.exe 2024 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1404 2024 iexplore.exe 28 PID 2024 wrote to memory of 1404 2024 iexplore.exe 28 PID 2024 wrote to memory of 1404 2024 iexplore.exe 28 PID 2024 wrote to memory of 1404 2024 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e30f92c01374a59183ac05234e9e3e4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db132dd69aef46257fda424a54e4735f
SHA182f02f946ad57903652c1eca6aac17a11f0a6fdc
SHA2562d9be866798274b50128ea7097b1ecaddee40b082719b55869cda9ac650f0352
SHA512ff9d3c5f5ac6eb70ad2d28d520a454955aeaf2dec68d61a26944f3b2895af803b04302fb0dfcbd1a1fc04897ebb5e70d030cbad0c0e2e1a732ffd26ab1b7f6a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a4dfe2db677fe18c74e0ee3763ac545
SHA18ba5fdcaad536c7091ca72f9f4e95cb80f3f7faf
SHA256b3537002f203998ab9ded4c1e1476e8d040bd9f6ec7cde6d552c476379a20959
SHA5124879fffd721dfcb64d3a7328c5fbd2095ecd57b0d23149367b319f29ea5c1dc394e3638a2ec89f007d428fa1fc240ae3af5ccc4f2be34c4b00eaee12100738fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51870a8a03f829939504eb18928653514
SHA13ddcb45824140101609d1418a6be9c36411d20a3
SHA256d36b54ae28086136edbc9b0b41d35b7debe972fb21195c47c283dfeaae62b84e
SHA5121c954d6b7e18e19774fbfd0a761963efc6b6a459de6009ea45fbd46f2fafdd8ea757340af6d49ba0db9e0723fe8ad50750c4914c3bd0e4c78a0a8a70d8c3e436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0c3e741b0aeeeca35a823c261e926a6
SHA11ae5b405e0fb3e0b06e3f75c7c5ead3995f593f0
SHA256c9c77810726d25c0c55e3cbee2f9048dff395adf5391bb974100789a49b13581
SHA512c079590925696ff38ba80e12ca19cdd74c682eaee0805e6549d7768d21c9e17d0ae3703b82a322fa814be97ee5bf4e9af2fbef4f3973db7cd1607f570b3df041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59265142fff597f26214ebb51c562ee2e
SHA12882178ab9d03c2c086cf0365ba7145578788128
SHA2562fa0b20646baf374be9131f21836b586e11d23096f8995e69dbb0183ed50d3d1
SHA5122046aa4cc248fea11474aa6b1789a2b76b7de687226b64d443ffc9d63841385e8c796137436ba07fca909b392efc283dd962a480466dda2049f110f232d70b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bc005c2b0286f900cb032709dd55024
SHA196735a7bdcbfa67e6cc21a38d87caa8df74c744d
SHA25628adf6a7af3a27bf6a87c9cc0335e7d4ae9825ce092b00faed3e0ce05a72b4d2
SHA5125b51a5b0acd3ca6e58d1b4abd8255a632bb212f7d1f73f2bc2326d98ef7588807836d02267a29a4fed381253a1bab475414aad2790a1f734fc07b5e8d889696b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52da4e086d44bf4a8ad55554f4438a9d8
SHA1f7bfc8281075ceb497f9458b2f3260cc84e91c0e
SHA256bf6eec77ad4bb85e329a4fe069b59a85b5444ef4dd8902aec735a611697a62cf
SHA512638144ca5bad35beece7dc54b980abea692f776e91692db4905b11e002a639e2ec1ad894275e276fd814305bd8ead9b708665637a0d46bec1a06980405ae9693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512f53dc5ee17a8e0eafb9f2c024c043b
SHA125536da5a3534da73e70f7d2317b037821f6de23
SHA256967cc03f8316e5fee335a5607fb571f8655e321ade3716bc768299dce933c829
SHA5120d5b829e3a76f7c3a06c851199697a0138253934c1f7b862cc6bd5626c37fe0345cc055a2c2b56782453e5371226b76320f86c5082af676e28a0920ff92a380b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a21b9710eab1b8faba998474e7a00122
SHA1d6fbae59ea9af5592b4c7c169ab96791a809f345
SHA256c674fefcc573a2f34511e44207feea16152515cc774c95370b186e15c80f021e
SHA512a9681b841fad98e9359fb51b38e9ee56f720f96e85cb2ee81157589d161ac07b7893e3393cdff395fc7c8ede1683759f8c0866b7694bf18f800b0c2b118a048e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54686dfd940af3f92c56605d91cb88229
SHA10dd962003687fcfec8d311c9091dc022a3f354f2
SHA2564d0c3a57e51cbd5097c14c3841ebc10dae16202e2669fdc96a8127dc27dbbf20
SHA512d9e62b63afe9e42e5dc848d9881402b2ddef858f063f226a111266affb1adf1ca8463981886dc10c43769c409fb080919d76f06e973c181268da01d7df65307b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc3e2f9b30eaa4f5e8ea9592e6135284
SHA1e228f62130f4e67371581c8d240a030100f0f297
SHA25691a397fea93dce89ea3795c945694767f7fa5bfdeb50b151db0b3f03758034ef
SHA512db035a5f57a3aa3e839b46430bf321f6927e7fcb41bc726e5134864e3bad75afa4c9750ad1c8286de08821cf680e7a3d72c2414924a0cb9b0786bd776492b17a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527779e2071ea9907a3bde82c61b6bb14
SHA130252838a4145332dda031cc710ac92bf7ba4eea
SHA25630309aec5ccf589f2ec4ecff0060a6b82c4114c7c2d8480ff51ffcd97b560ab7
SHA5123802bc26b4866ae7ff50667b4af92a5c7f38cd4bbd0c5fd89a6a3fa920ad3dabe845b8ef646eff29c3c4d18a97d00d773bc27566771eb4cefb286c5568c7e460
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f11cf9cc57216fd073b7c0587089122
SHA100757a36fe531805120e55d48bb7df3e75b1eae4
SHA256f0f1ece14c08e5d9571fea4e7d174fc9710361643c855d6b7a3476d5da542c35
SHA512f8e4f7130101dd84488e6d3d433443981cb2ee3862777567d35edbfb7281afebb72f97440e4e4cde48a482ca76613c48c2ca2ddbb198f0846f8bc5b03d29610c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557f65f90a046ee84a73f7c9fbcd9481b
SHA1c881ea2fef8e7b67cd1d15532c605b15840b1e75
SHA256586174d044bd40228c3f2856e7a625c82883a31c5b81a6045b83a10e208240c2
SHA5121a045ca4a002c239b6ec566742b3b7aa76becf877ba71ae251423318f3ed9b944dc6e1618735eab30da9dbb932039e0bbd2e307f3d5d42e849829ceeb1fd30fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b4bd8f1fa4edbbff61f3521458cf6b
SHA18c559a1565615bbd3cad47aa227aa649bcfd177a
SHA25605717f87848522aacf9316c2ff67ef47bd761ce8ab3aeb105a9546847ebb9b43
SHA512201b813c66200742cdfeabb048ca8345c8bcc725246298d0a0f02eea9e2e0b8bfedc86ab2777cdb48fce1e459514f50698f7fca1d20686ab9720451995ac21db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0bd0d60f44e380dfb687840efc71e0e
SHA1bbd83468405fad5d26210407c131e760c3a8e2c3
SHA2561066401c8b582b3c2770e39f244be35ca21e2910e743daac608c8fab35d6f947
SHA51233fcf29605a5cdf9af4aeeada73bffc9c3fb743e03297f7f687ca154f70e83191a53acd1cfda80ca64069f06bd43c4bf39bb688aaad8497f1007077757977178
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc9ccaddd2db8f819dd456962d60221a
SHA1f9b4da10c21e7a46c6c687397354b8488b12121f
SHA2560868bed00beda0ee0cfd775b5ef36deacd6192659597ec4c948f729587db6876
SHA51223b3e81a03952bfebd42b18832b62bf2de8cf177fdbd0529e9732b52799a2238eb9c937d4a1f5aa2335bc7d1f183214892d54eb89d7982929b3bf5c24c4c3f3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e0f10850e032ab8f07af2d702f67383
SHA1e0dc285b2f66921031bf725c5d15cd85446ea90c
SHA2569c44d1948255bd2bd1f961b1803830c4f3be6fc66cb05f27b206f8a793a4abbc
SHA512bda3486397dd140fcb2e1fd26d795b6c8ccef158fad73893d2fe7066406c8304047182ea4092003d517c001b8126b6f041fca6892b2409ca8f108dc3fb03141a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a