Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
30ba4969f2163ce425f7ace51c30b170_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30ba4969f2163ce425f7ace51c30b170_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
30ba4969f2163ce425f7ace51c30b170_JaffaCakes118.html
-
Size
23KB
-
MD5
30ba4969f2163ce425f7ace51c30b170
-
SHA1
759e277f91bb30ea2e36e4f5ec9234a8ef0764cd
-
SHA256
7b78df6f65a0d6fddf73e2ad65a521d6c88526797927eb34367a373d89179b6a
-
SHA512
5918964c171ff1bf28d8579d5bc3105ae64d1ec9b3fa3b77752aa4ccf68fba560bcb80c3369a89904863a988ff7d1022271d14bc63639cf35aaec512b6a437dc
-
SSDEEP
192:uWTwp4+bb5nkKnQjxn5Q/znQieiNnonQOkEntt5nQTbnNnQECnQtQwMBCqnYnQ7W:sp4+GQ/6wb
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4003794812a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421532024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000080178feb8bfb23c28fea6b239ae766fb281584606eb0dc821b9103ead685ce0a000000000e800000000200002000000059722c26a5167756ab943f49ed1dc1ed05ca979cd793c9f440c4eae5435d254890000000b356fc9ade5f7d9208887f09fd494332cb19c484973905038bf67485c93c786b542f2f87b0102ddca5c2c04997482cda4bc0c89266169584cc084981730d3284c9647036e82dbaad4577d92e7fc59acbeac2661e315929cf0b77abd916ce23720dd26c912cb1ec4e18385ff6fde4679abdd26835084eab6a88f58193893304119c65dcb5cb85da82ca2502fedbd1b72a400000005bd01c7ee0e4fe65f68a8216d88fa043152538f3b5477962efc6a4a0bf845fc55c43e440cbeb88e3541dc20148db5f5c7e393c0fd2522c05326cb5161827d3e2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d5873ff56ac57cb16d6bd501cbd950ef6139de135139fab3560880c551d4acd3000000000e800000000200002000000096a50c97d7ff3c4e3950229c42a48ca6a34b16125f2b584442a9da8cab47e17520000000329f5c4460163402bcb67c35890d35fe9e7075e526249d240bc60b45a8906046400000003faa32f90bfe42d90b377853bb535a58121367efe599def218012e0419ad6ed95db61edd997619c5503d3385b06996c7e5b9a9dea34fb8f11e382913f3808a05 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73CA9C71-0F05-11EF-A002-FED6C5E8D4AB} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1148 2348 iexplore.exe 28 PID 2348 wrote to memory of 1148 2348 iexplore.exe 28 PID 2348 wrote to memory of 1148 2348 iexplore.exe 28 PID 2348 wrote to memory of 1148 2348 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30ba4969f2163ce425f7ace51c30b170_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54327ac6a3a15d239467f2c12cc024f29
SHA15086d1a08e0b8ccffef27a8998fc85306e0614c1
SHA2560e9ba12778b902fd755d249e8e63ab367d2dc08bf2c1c9b509392c8a0a9ffa56
SHA5121d6d5b797eb00fc8f6871826ab182431bc882e9a0c59c422d62168873e1d8d4c417e06d36812df7da2381203edbc44e3ec733eb49a6a679670ca0fea2061e444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560f9341771800cb80fb9a109fd87320b
SHA10d84165d2923db220c7c0b6993e5ab02045e31fa
SHA2563d5afc91692a2fc8ffdfe7fd78d1adbbf39373f51beabcd26441a54c1d727dcd
SHA512f566577599a77a3a566ed930be7cef6b39072f99e73e375b4bb619b5fea4495923a7dbf82bba3a178a572b652336de4fc264cfef25aab35c9d27508198f95480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ebab384d4f32b6d9795450553d4cd78
SHA15b697d7383775e1b6888afee04a903b7b8ec88ad
SHA256efbbd3ff88731fa7d4808ce3d32e846e3bbf06764835d0ba8f512b693fa7a092
SHA51291744a904a35d75fc02a4833260883abb23c02f668e02c8fbad376d789c7ee4b1518e7361329d3df32c8483a80e0871f08ea59593e2b7c16e99ea62a83c89fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e84e33a8c12caa12a242bfadf6fb059a
SHA1fb8f81a431eaf461296db71386130ee01361add3
SHA25633a3466c0ea322c986f18c8ef051dbf263e6880e02c930a90a58dd1f19e87379
SHA512e76c73f2e7c1d2dc2c91bb80084fc86a1ff6007d99b9df5073b94b640f85c0fc41906859b81be02e485432c0c0b0806455d1ddaf261db2846459868c118f6a13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571ed13672b45ec249d8a125409a7892a
SHA155e0533ef243c26d1099f419c189dc336980106b
SHA256ce31ac5fb677e4e7b20863504c300493277a6b1a3538cfa2c7e4daa6c999f233
SHA512dbf2571b1d304c7ce681b81c1bf8f312f3f2b327b9eb77184c4db7c01eb3e96e1b9c085f6bc4cf5faf033d652b5199048bf822cc025c39f69105ab03792d8ef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543773a720c12aa38d9afb735753b8de1
SHA1bf0c56c84e949f9f33ae66c7ab38ff16d1bdd8fc
SHA2566eb5a0c1efd786cb32392acddd5252405ebe8364333edc7f197a3ab376966b1a
SHA512e39a0feda9b88297d8cf2e64929c50735822c9c322004c60dcb9423061668615a6ea6151aab6aa8bd0f629f659c1b302b30f85b344db4a6b02521a2105d81137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa770a9e6b97a2233d8a7f3366bd2cf6
SHA1475597900f70650568b3776fa4a3a575c7d6f548
SHA256e14d7b44627689b080cf7f9caa8511549fc2179c8840bbfadb3bb96d76964b19
SHA51209620be868aec5c7dccf00acefd63b30244e5a34f50c19eb66c29d3c9398647952dd9664a66640778639ba0de22e37e14a22dea19864d896ee85703997adf411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db644b567bbfcf7f0395480a3eb99e15
SHA1facd0c3f38d04b42abd91fd00acc3d38dfd2b783
SHA256dde7d511a013beebf3a8b2de9380260bb641daba1d56e39a50e67be505531267
SHA51219ca12c0a8809adc84d9904a467143664f0dbefbc8a4f15642bcce0b743e8b857dc0f9ab51246bd698a58301566c470840c726a7bf46a746a049dab456defa07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537542652d453da620d5463068fc9cada
SHA1007b3c0f9e69ec0153c2b8645de2d16528a75b3b
SHA256197bd34441877cb1278a4f1653a888f408a2fc9b8405cfb977dabb6de4fd5bc3
SHA5123a0604dd6e50067ad19d7da8987b866e1eab1e9b6411a5e950e6fe7948cb086feb9b91812d0123a8f74ea0a8fb76f2587ff20744b9510a9fc793747ca531a101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c63bbfe07d1080edd42266993c9452a
SHA1b5ce9a37c612da25a7130bd264ff7f1ce5194f55
SHA25660c886408e5688ddeca74df0f951256a039faf256ba1e9a4343885cff6c0d69d
SHA51233e45fd602e747adad8a73ced50149358de6591abd32aaa1c2756d5e0e2cacb0d7958614582226e382f38d07c83d9a322b2c7d72331cee26627d0d3d79178b20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c94bfcdc303a501b25a72b24c892516
SHA141a17984d9f2d452a33d740927ed24a843e51a1e
SHA256e27cd1e3559cc1cfc233a9355e16358b1934134e1601f7970ef27e45dc598cf8
SHA512e3f67d550df08952147a8598c516e50cac47227e70e10dffd8dd360a2a3d60932ac4bfbb6a49896bb408554445f6d6c2361c92bbfa876531c564bc24736702e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546482c4db9d84be4d9a2c250452335bf
SHA170d73f5850476dcad1e7ad2136dc9e0d96eccd01
SHA25690d3f9f6a609100d983012111ca1126dc04fa24b11a1cf70ff82dca7920b8267
SHA51219774dc08330cb4ccebdbf9b79d6c854ced607e1413512254be32ba203442ec09789eb85a4475b4e06f235e48b1ede5dff8e9d6f3b0c693d62cdb62d354e167c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538134ba9122db1ad576c74f53d15e4d2
SHA1a7ad5878aa9cc040916b4ec5670b57a7095509b6
SHA256bb9088896fc28b679344cf9522807106cdb65429c3d00412c8196a4e393e0e96
SHA51254008af3082490a0d376928be3863c3dc34affdf5440cda7b2dca178a74c1f13ea00a821673dc61d07026a5be6307c01f19be709f4a1568734dadbc60ad0da38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f1b29723f70a3d3df5890165edd7915
SHA1e403e763a3fcacce193c77845dcff873a899b455
SHA256119a1f64f5b005951c47d2147ab06fc9fc856229b800baeed473e9edac7680f2
SHA5126f9a25ced078309ba7e1c6f1af39ff7b4196d8d5a192d17241f5fd77ee1e8ae5a28c4154b75a69742d0891b115357e94696fa5b255e65315451ba91179df9cdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526f398cec9dc219e87a42eb5f8894193
SHA1baa5067f49c3e2c8683c872037ba95738a782b4f
SHA256fc181f2fb376a09e2e52eda2556504c832e13c12f7b6dcdb8d894444a5eac974
SHA512bb4b327b220b5a1fd61cdbc00aa20bb89d468187ab7a09af080b66604e271205cc4e4ded0aafe7601cce1dfae5f9365463ba863d8be97c223a06e9ab750fc49a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50da852f915fff6c77a2e52da536b9000
SHA141ba5c87965edc9a83120d9d4a55d04a304be46a
SHA256931516dd3e5be68657f98a84e3a04b20a33df8d5a29d337f2f7aa890457cdffb
SHA5127ec741c5afb9bc481cfb097b30ec20811b02adb7078702f42095453229e3a354f3d7c8143af8ac9ae224d89cf96370a45c8e2ac7c61c5c1fa09aee2924d6f8a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f5d2beaa267da888c70e6296ecc8f42
SHA157ce3be3ac17b287b8a6b8b8ff2426b7b7efe565
SHA256e8842e19c17007e62fc255710b00b5f9e4890e5c8801c0ee2f2b8656614d262d
SHA5129879364b3b620a1654d472a0ba01e1b35c49f13f667651389ac874aeb64518ff3c0f9bf8a81651af2363d46fdf7de035c98da6c6acbd89f48b8d21620ff71d0a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a