Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
300ae5ac0cf45a267a5cc75aecf2d7ae_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
300ae5ac0cf45a267a5cc75aecf2d7ae_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
300ae5ac0cf45a267a5cc75aecf2d7ae_JaffaCakes118.html
-
Size
8KB
-
MD5
300ae5ac0cf45a267a5cc75aecf2d7ae
-
SHA1
664ee576220b3fc3c11e2796c4fe5afe1ddb3735
-
SHA256
5ed9eab07651af27ac24f695adf8cb844acce140ed60010c4c68ff6fb385208d
-
SHA512
f9fee605de2581f2668c6c41dc75fe002dda532d603baa4e35f33aafa69ee01cfd86c296cb567f40a9762629a74709a763424ad968195cf6f120d6a737e63756
-
SSDEEP
96:RxSDdCRn990H1uNaqU4yDIT4LHdl46vGC9XcohpH1uPTHRot:a69k4/ELHkC9sop
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c6983e10f1e60493ace9dd0f805220f4a9d9dc4f350ef6e590555f8126acb50d000000000e8000000002000020000000dfaa3f5e2a7803d23615581d53f2f9d7bbfecbe7361d942acc3e811859733626200000004956aa9e2ea40e2916faa7cdc84b3f7b4f65e29edbb2e77e756d0c84e1b02edd40000000fd0a003e1c6d678d2f7ba37ee0898164c813a650ae6d67d4d9d9cdb8223afd8cff51b21d51b050260619f30007f31b2acf085a18e5bebcb47cb8763a3ddbfe3f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05c5a45f8a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70BEF181-0EEB-11EF-8004-DAAF2542C58D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009fbda9884a4fcc689910f3539fecc9b813a997a7d7ae6b8485f6e4328c6833a4000000000e8000000002000020000000e6719d81354c6c04c313bb74d638a0ae9225de7aaf9c07b0b8db403830fcea289000000093e51893b1800d9b5f3e846d70021e423a3dd8f2b8769af177f59273e9fd265f1e613f5391bd0528f981223b96bc8c2388248cf45321b821c8be33ab63c271864241d97a8e09e2587b69d8082c02ad0c3c5ce80b93c359da53fb1a1151e99ec011361b0c12e1523d336c808d2eabd813489eb668c284d91f5f0868f40c797a88e07fa37eb8fa430cefed022004dad65a40000000142a46c4f13c3d748ba13b44624947c69f8b42c781ca7663cccbc5e115238516afc1018ea5b2bac3d2a823582809ee37858f1eab22c61c86c91ab8733d953d20 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421520851" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2288 iexplore.exe 2288 iexplore.exe 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2260 2288 iexplore.exe 28 PID 2288 wrote to memory of 2260 2288 iexplore.exe 28 PID 2288 wrote to memory of 2260 2288 iexplore.exe 28 PID 2288 wrote to memory of 2260 2288 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\300ae5ac0cf45a267a5cc75aecf2d7ae_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c72a1cb042015ea63e6ee5803f9cd8e3
SHA13dde8f07cd96934b7bccfa84b18ba7971ade95fb
SHA256e4ac13bc9317790fdfe3db83a48f465e878a477bd932bcc50b6eacb4881454d2
SHA5124e6ab8c52878a665f359b92ced6c896fc9e5dccec585c74531aa93d00344124a392e51b4c777fcba19a65c21aeb3744c124947e4ae563798aa32d4db132c3a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7a075276c8546b54193113c65efbde3
SHA124252861af4b329dbd5bcc55406e5d1cc518bfb4
SHA256533ae4f0b7949ed82e830aa2055ed42bf84d13ea80a7f99871ee7aeae8fe0c58
SHA512c96c01ed31240356f3d1a63cc220c9af77d371b7118b5dabe42cf741f84f727e9cd90110095af2c78381946aaf2556039f76ed8e5f5bed87c671019cd1a66d2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ebb153c625b79f9464c9cd6c2fce6c7
SHA10e7c77375120f469c3d61161ff256e9a06f44f5f
SHA2564604136672c9565442aa532bea5ae956dab482e2b47afc79c11860b471d04731
SHA512f1efdc2a38c4cd26a6c7c7dd89f0279f16bd8c42be94bb7fba34c206a4bfde9cec6ca92cfebc92e1631231c65b9f6f50bc99ac28a7312b8cff2ca4388200671c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bdd02ddc8233639d9c65cc2a621a304
SHA1147eaaac3c9b5fc56fdadd3480b731db8ec1901d
SHA2562421653fed7665b1da6bc393cca75190b6404177e5c81c82b5a3c8b9bfe4038b
SHA512a20acbddbd52b6973e62a853049179a2ad96e5887b6bf4b766233cc5492e8903847cd8533943721bef2db3ccc70e194309e590fc7c841756dddeaa753475760d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578b63b12c860f41d65ee70dd0a10443b
SHA12a424e01cf14a702c4d22cacf4603a016321d640
SHA25627a4373f9b09aad7e9fefc36a6d17635add2d8f2182d4b03708b82eb5c00b2c5
SHA512a01b6aea1492869ead32b4efc7eed484e4cd7ecda423be8e8cd3c5c9d0c9beed4b4ae62356a9172c021a22f261ebe8b23f6023d5e44c72f6f007f9dfc0d51507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fcf641b04d8f8f46c0ea64465b490db
SHA1300d2855a3cdbb4f48cee988d583b00b4d370b9f
SHA2569a3dfb3a4f89764f19a98fabf1d2ac2f69495388aea65ad60826cda09de9f95c
SHA512df422b40980cd799004bd42893c7e90f79d052fb36b9b503837838f467a89e50700cf27f0d6354702e66d744f93ad5e0f4f633704f36267d997a04ed8fb5bd7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571a407d15fae3b028a8bd00188336469
SHA1a803ba951e504aa03931886527484b81234337ae
SHA25603eb8c5a7d8a332ab16b534090a739da57d15a4f784922f4b209d65b1d9dd32d
SHA512e0ffc540a9c514426d9108f363550270337c3150af18f4e81af9ef217d6da4ad6c7b613f3685afef4d9486ddab238be68fee4c3b676f5488f6d7fa00dc2e6a40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5774f8cff0f78fb05ab6a4b92057d0b25
SHA1a749a152d68965ea67785309dcb6fc92d609f8c2
SHA256ff3afcb5c0eb5f09ad91aedfdc1efb9b0ce0c179591e0bbd3b15a486ec2444b0
SHA51225b1102e26ea84df7fe1ae7286d3de82e2963325768abcf1b5f42d7a686cd8559bee251a03cb3d515eaf9ee7b20333def7853d8d181876453941a302b705bc00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d43f52cd3e11c76fe11c540fe5733e5a
SHA1596749546544206474752c85ac1694dc9290c2f7
SHA256c4ad931f04a353af66cf7bd4a4bafd8d57ffd39a65887587bb9f323d7d484d55
SHA5125f7d1ee1564f45650f8f3aa3cc99864ac33a06803eee0a40408f18b3687fda7bc20514b55fe4c6202f32e2c6c92595a23773613d74615da7e347cdd1324ff461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5391d3084653c4b2f16427ccfdb5261a7
SHA12dfbb7d1803c57cebb420cc25b5ec9f9cd15083d
SHA256732279d3c430b00e543e18e278fbfdf2cfd034667f84f188c42e3e50789e627e
SHA5128926b410569c75b736006c67fd30b7a02df3946e645b752a38124d4d49cef874195a193771f0ba63eaa57a1871835fca2e39cdc5f4b6f03ffea23a4e6ae6df81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540248ab78de5c06f52f28652ed0b8469
SHA163e9f1dfb82c6accf03552382bfc78d472b7243a
SHA2569cd961c5a936e4e4b75b0bbef44e3b859fe45b2f341ffa9b25bb3b8bd83273f5
SHA512ae9432170a7391f405124a0e00af293cb62fdb0fcaf7c3c5456afe22438ad6759f94b07e98c630d34ff14d9f9b23d4e9d8b7ba77e5f6d7feff792f3f81749134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d264e9a8034e02bb3c6ec2785aa835e6
SHA10324fa1e549933b37088fb0f23e0b141fb0c5d79
SHA25668e486050d456c187356a05d19ea5787ab2b17f3d3749627bb11b5eb10c61420
SHA5121960759fad0925b1177c399adcbf62a15d7cfeebdeb896fd6048833a9e00b041c9917fed22efd96f9ffadf186340e9b6d80205f806201b50698172c81311953d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e77aa915acde7282f91ba73b4593ec80
SHA192cb62c04aefa0b47176dee9876b8140439f6169
SHA2566890646409a5ac1cdba3a18543c7f15b56cd2e04c374a102f1cc46acd122292d
SHA512e152b89a16e0a48343f0b46cbdc2abad003cf915339e3925a86e431375560f306cfb27aedc5578f215eba7d21366300935cb67d9cb07b4fa22a0f20a2cb8fd81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d8cd8d3914487eed9e785d49d33e8ca
SHA1783e5c2ba99bf94600e74a6002e7d6f9c149a1d2
SHA2567186f57bb70eb44a49ba1be6f829a2ede2f9f1e32522de7e950825996794d202
SHA512e982325e93b3aa6065d24691d58f1caed461ef02ea53fbb6f3d76e72da57a94ecaeb75e16710b97826f373608ceb65c6c2547edb984a39b29ee03f879332c490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563a8372b3fa5bd2d574057a3a976f1a9
SHA1ac153890bd18be76d926ca6d836f8bbab857ee2d
SHA25676e19d73d1938a675b8ab70ac0cd48f84ad456599f2b8a519eb9d9b3679bd4d2
SHA51251d183c07eb9e5550765751a593f207fade1484bea9d4b1327ee9da1058c741a1241da5231930abe25839a951724f7d93601ebfdb0c13851bb288cbbbe516eee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c39c34e8d7e1c22e925896ad7f50c69
SHA1861658dad8fc597ea845b1167f03a09b38bc77cf
SHA25615ef7a8c342be4b400ad33f3b2961959bc3fe67403504ee3c6675cfbfcd198fc
SHA5120535d42781a5388c9ff839d658f5bbdef11150c6a86408a464dd06be65423cf7f851a4bfdf474c762b8e1c91cf323936dcb7f471c296ecb796f46d56a7e43f1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c642f7fc5054194ccbce3e23fad1abd8
SHA1d16199b0b3b296d535702eea910f8235d8fc506b
SHA2565da24ad6bb05dcbb371c2e5d46235bf0855da964b4938c9ee81915ddc1c98973
SHA51225732596ad6c1723542731670713dd350adfde053bfbf382af79d29e1594a2aa38a7ed7ff75f8dadcf6844edb0e586703f228655c302f8da1a56b413532de6a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1481b603c666cb510941b096e383a04
SHA1f64704f30c11556559243a4781e59a229a2b0ba9
SHA256dec0396fdb332d82bcc139b5227bdd65bfe88b340311d6bfd00f6e297088b5e7
SHA512997efcaa63eae2227d09d7bb8e169f9715dc40153cf9c788439a0be75dce21968e46ad31fa5aaed0fd7b3dde8ae18f58376132c2a53bf52bf13f4ad9678efee7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a