Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
3068b19f55f956e846dcc86e144724bd_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3068b19f55f956e846dcc86e144724bd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3068b19f55f956e846dcc86e144724bd_JaffaCakes118.html
-
Size
5KB
-
MD5
3068b19f55f956e846dcc86e144724bd
-
SHA1
1ed14b6c5b03d39e5bd7709f4555685a19050f5d
-
SHA256
725cf1f8442f2fd0d75373a16df44b9f05797a9f2bedb19048c12b07a2e46b33
-
SHA512
9784430c75d136e0c95bda304fac782c6eff5f74502555086e8ee4a83c61ad395f4ab08f7d7412ece39b8f93db2a3e8743de900ca82859a6f1b6badd6c709203
-
SSDEEP
96:mc1qi7yylvtyylvMyylvuyylv1yylvA5yylvXyylvuyyloi0mFfeAqIuTNT+/TTc:Deylwylfylpyl4ylfylqyl5ylml+7/yd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97866E71-0EF9-11EF-A759-F637117826CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c802a603c7e2feaa40955d066beeb75ffa7efbc64183391580405e0074eccda2000000000e8000000002000020000000f76bcba1392f4904a938c4e7eeb47d06b72ba4b8a531306cb3dca78a63b744d090000000089eac4308e87fd829cc4b47c31306b085e2a4cd4b270dd5560c35a1b14304412911e8be6a23257f8176b957327907d4d3d804d241b34053f8b5e04d6bf28dc913e7e8a83754543cfa775ede9bc9be6c0fdfaf533ad5abadf52454953b9b71f181d0787a9022e73a39caa9d22382b25ff3cad2c98b41af6dd398e4aa5c80259ebf6d45ee78f137df69941a47e81c790b400000005b8c60f5bed4f2f7cf58c58a29cbf2eb498faa40dfb45b56be37612b2cf3503d7d7e0b934aa6f11b0b331c511d8092ef0d62bb306552e5490561700818eb7602 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d094266c06a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421526930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c7347915898a887f6573627019e1bb74e7f2cbfa863f8fcc3b07e05c5d5e0fb7000000000e8000000002000020000000a7adc58d0feedbf31554f5569c8c5027382d09e86dd27f35ab9bf654f30292dc20000000683bad64f674dc3b1a87cb94a3da0c3f57b0e7e54d06d03f36c0b5efbcd86dab4000000030a068ba58b1746dcb7586603ec3953488dd0090df28583d7cda74c8c33175fe369fbd5770ff72b9b468ecf56837ebb274e035ca567854daeca5d593ce63059d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2028 1936 iexplore.exe 28 PID 1936 wrote to memory of 2028 1936 iexplore.exe 28 PID 1936 wrote to memory of 2028 1936 iexplore.exe 28 PID 1936 wrote to memory of 2028 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3068b19f55f956e846dcc86e144724bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd2bdc5ba2820a6ceac89606dc7642c1
SHA12c9f7af1c5339cf729ea0687c498ac55b306dc93
SHA25672876a754ddaaf88b513e7b60d5b674b90ca8602de63f968b5726f22d65cda11
SHA512d035637efb545e03a9d06fc2d8ef3f008478d30cf84d64ea832ade1dde752c932fb671813d3d8c2fa9ae9b4af22f611070eda9bbdca78f056184606df44acc39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b0f2898ae87820e934858116d08d847
SHA165a53367d57b86176e3f75dd63fe8e364c779d2d
SHA25658927cbda67c58e39c8f12f3aab6f72776652d9c71d6fdfa7f0c42d305b11836
SHA512aad19986ca9f9c27b0d60bb83ade3e8ed2366eaf198891f04707f9e6e4b84bebf12258ca4b3cd40e05944a724161c1fe6ffcc1d21d577a7515bad00c1550f27c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e0f3010c28bc3d1e8efe9cb7f0115de
SHA18afd7d6f6572501d7b9f2d5a18abae31611800e9
SHA2567b311650680e4c8c413845be6fa565ef68ec7977a5d246928e02a477c6d53088
SHA51277fd22fb594519cc8894bce946b9aefbaed569e18e248eae92e3c91d1faa37ea307725555ea6eb9e631687458a495bcba733c8c2b039f9507958d2d9d370695b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d878adf197d28fb7d8ba2f6211e3fc8
SHA1ffae9faae88e5e571f8c290940d1f0f21fe19eb7
SHA25668a338b0cd674e5800602cda581e2d996fc68c2c87279bae8c5f244e1aa6c384
SHA5123a6fa56a4a1240f6b6883c3f6aaf94a0bbd778623e8023443d1b912b9498b53b2833d8c7d85902e6163823fb802644359fced53b1fb48974389bd6d4dc1a10eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ae57f2c0ec003c629339ebd8e2daf4
SHA15fc234130c33f99ce07130f0b4848ac8462a37f4
SHA256c9908d744adc0cc9ceecec207fa22af69c0b9645d1530e516327947ae9ac00b2
SHA512305ef216c27ed22f797e30df8efce5be816093a3bf346b1ce4f261374807e80c2414099ab253b3c98a4348049321cb66774bb35cf4660582910aa484988727c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e510ec467a063fc50272bb9acf78674
SHA142d2e0d1dc83c51c831f44a75d4d7d6f87d041da
SHA256c1730f0ebb4a014385c500b16064e1a734ef6edba4047ccf775ce566cc8d2674
SHA5129d787e977140ef55c22c5f0b6a61a1a3bccefbf1c9eff731d0bdbf8a472a830e794cb0c2557dd60a470326efbf90b9a43c053109c6f812fbf846ff46e26d7bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a72d88fc67b16cfc21705d6ae0e39c1d
SHA15defa2d01f2fd31ce01758bca67d3d6ca4e59f8a
SHA256f3fee07dae2194a6f31de524b1027d0906a23d9b22a5aec5ac0db00f8e4a988f
SHA5124f2b62be428b89e4b7b8411a2bce0f6f8ad81989151f76ffac9da56d5293b92fa1dead7c5592459bda1cad6091adf77be1caa8fdc68388332381b8110f426567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae0a28bacea02d3aab30fce012f30e4e
SHA10489a56bbd7d153019ddda82a0c27d610a47b05b
SHA256eff8b0743e6df1784d092f560de16e0417eea300289dd51cb867da558212ecac
SHA51224a0eed9ef599cdc7a851f600dcd863e0a1baab03e7386bfda85a16d1363af9ef5a85151cbef752be9642c752774da11ad8e104171a798fb3e33b91d0d3bb9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59847d9d634b62d15b2ffb32974c9f7af
SHA1f08cf8d2f8a81a16915bf13f719e46823c377330
SHA25634a1d6feb4b43b06dc131583b500fbaacb897d06778941a92d1687c36cf5d172
SHA512cd8ad801a3a673412018049d0c68ca37940ad9021fcf26f97da4e7f78bc7daa85c8f94b08a293ac90743293000473052b7cb39732ea3155b3590edb3d18d7c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5244aaa4513b624611dce1003b3faf371
SHA19ad155753ab1a65c108e5fed12e4fe4eeee3aad0
SHA25636cb4474b6c5829ca417093dc40bed471b63f3e7d83f596b8524de75cdc1d1c0
SHA51207f96ab8cf909714119ab412e54fe001caaa44141031598c31ef5fe08f89a32ac5f39f5b948859e30ed225a756d7c8763e295ea913f4577b49dad911dcc4a9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f88064b41a18d71a90950dd1dbd491b5
SHA19d7c4ac803d7592eb9acf00950489910a63e14d5
SHA25616570ee8274f51f192507dba3577c08e224bf850077b8fd13b73d0409f02700c
SHA512071e9f2c4e290a8c9fd72d2233512cb689b24b7b7fd98421905496f55b97d5a0f99954ea1ca6bb6192c29a3244ce5eeb92a5db71e3e668296351e58f43fad5b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56911a8ad931376c8cd07d0657a251c6c
SHA1a9f9b8376f2fa2fddfabc61c1a83c1772e611b77
SHA256a3ee1064c037343bb0189e1774fb8f0ca21bab893758f39ad279ea19bccbd276
SHA512a60d67c1ea26907bc54435c92fdee4d48ee8122257f97d9dcf556ce9dac9156c37f53c409f9aa1be5ca3f4cde98278b8741f4f7a82632546962e95ba246987da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5555d23e7bbd31241f3e29e3db421661c
SHA119b769f5b10308655b9e6ed43d9ce4d6cf494ac7
SHA25683028ef35d3b0232c07f6857bdf6cab2e16e281c6088b6d40f094a48820de859
SHA512d0ea3139a1eb6cac6ee71688cb38d6845df7509796a2b31ad6fda197927c5dd6a55669a5f4e88d4d210065245ba2edc056c6cda9a63cf6d251a6a629d84cb009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5960bc07176086a172783925972a226bd
SHA1166c7f843514375703c51e703ae1128b9ac44be0
SHA2563032e6b24f601ec891f760d3e6036d7deaf7d10ce8d0be774113ba53d03db097
SHA512950728ba9c0afaba657113edff8b88e49236221612b8a9dc1d18aa31926f023c4f2b26d8af0aea3c806387fa39ce32b884f2db79c32d8640ca922ba6869e26df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de2f336e86106caf71e7808222ec93a2
SHA1073925196608032a535e00f7b4e0f16f317a083b
SHA25641ca45c8f2caaf94ca030f720613119667c2603b6d12da14d8ceddc85f907297
SHA512711607c0ae3f4838ab76866a2de8a3f29c3f39a47049a6bf0f644a8e565491849c30fa5f1da8c0ef2d1a7f71d7c5015963175cd082da2022815ad80bc1a9a952
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfd0799f27356416e46e5ea0004b42a3
SHA10ab87c2c9d42e820762ccf8a8ec9022106f165f6
SHA256147719e781764edc2728bd2f13e71c8da92671a2c2a4b302d4b80bd4b1d1d288
SHA5125d9f41ac77bcb10e2f5fef6626ffd2868562f6cebf82b3f2ee4d7b8ce76f48260774137c7c7bbb226d1b2463c05c86ff105b72cce9f49ead58d0d1adaa9cb82a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a