Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 01:24
Static task
static1
Behavioral task
behavioral1
Sample
3205ad0d7292e9a595f9662c9b9f1459_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3205ad0d7292e9a595f9662c9b9f1459_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3205ad0d7292e9a595f9662c9b9f1459_JaffaCakes118.html
-
Size
460KB
-
MD5
3205ad0d7292e9a595f9662c9b9f1459
-
SHA1
e46e3068b3d6f86c332e472391fe0fdeeb37fdcb
-
SHA256
2abfd7be28e76ef3206f69e44726e4f1513d723d8ccebaa248a6893b3165c73a
-
SHA512
5f65db7f6f2d8923593c2d0bfe0f46a2401a6cfe943327b27755f960e4c7bda7d14e20e596a187950d5c25628d9082d1ee4cb7c3f8d52e9a0a2a158da0149da7
-
SSDEEP
6144:S6sMYod+X3oI+YPsMYod+X3oI+Y/sMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3R5d+X3N5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d9e7cdade607d76c06a947a94afa0791478882cc66f7085c05f92b06fe5f1bb1000000000e80000000020000200000003fcbd776d6e63faf182ce736e9ce8a0c6e0953f59b4341be20db588ddddf2fef20000000bd49982f7c3cd49fb159faa551ea780f5d61fbf8696168d5f440ec52574ee1834000000051fb31984327a7a9add7926017bc944733eedeca8fbc761ec2d5862e38a7232599abae8697d0233fbc39af2441dd0ee3361a9597e22765090ac28b3a00b19e92 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000679fcc121134fa3cd736810af24d897d48cab5b3f7f943857c8128f3c8172a3e000000000e80000000020000200000007d2b27f7306fa42fcaa6d6c48f277b4f55447a28951ac01d1b1f7ac7c6fcb000900000002734047b7527efe4b6180b764b48272764d45645e2c991d113bff85195b9de4a28efc3c7165f7509c1bc1c12efc67e8fba07ba5e80f1f93616ee0a5366139c9d476f508803289e4dd3863bc07145e98db6f9f04819d54d5c600bb6aa8711f751cec62d80054dcea6c7df462410374ce26161e44ec9e4038eddf9406f3b335df13f24753ef7601a4e1e2079cd0142cb864000000076935dc6fec8207bc1e576aaf387d0528e95c567162d028596c85a9595970617f22088fea7f82f086e734c68b56d50d9d6c17ddaf7f9d884a8ce864535fb4325 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34AFB361-0F35-11EF-AE77-52E4DF8A7807} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5074440d42a3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421552535" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2068 iexplore.exe 2068 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2400 2068 iexplore.exe 28 PID 2068 wrote to memory of 2400 2068 iexplore.exe 28 PID 2068 wrote to memory of 2400 2068 iexplore.exe 28 PID 2068 wrote to memory of 2400 2068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3205ad0d7292e9a595f9662c9b9f1459_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595ca730945f921aaea835380474ff490
SHA1e0053d5a7bd3694ec0d99910a6c528fe5dcd11a3
SHA256e0604fcaf5a447747cc7a9e3d4a2bd183b5d8065b66fee7b8d62acecd340c7c2
SHA512e5db7d0f8d3419f3dc6ea3db28ca1638a3eba2eb7801f50b03ae4030bbfbd453208d8ef0c373384b29544b816010088dbf896f984e740f4c93de1ccbb66c192a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513c6eb211845917ba223239230e02da9
SHA1a5de7248995dffe6469a9d0a7728c500f46f0d71
SHA256561b2edae9351d458ff3e99dad3d0db00d3bffcd222ec0d30f142a060184a914
SHA512120e3a5ea7bc6622417294c80f52b5d28e2a5aa4f5cafcbce11339f7f01dc8a7f7dea8ca138ffa81a78b241bc40f1eade63c8e02e92bba8f72688c8e25fb6bc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbbc49d34483a81955b82f1bd5935f13
SHA1f429944c1263467bff99edf506290e3e202b9acd
SHA256e12df5a6b24741b3dffc9be0a9856177125b6e12e5505c732c8a41ea38882378
SHA5121154016727fd8b9779640402bb134da7ed97d13569529bf7f448f33d45c4b366ba7290d5d5d3de0bb12a9095d5d1374be2377667fd73b765bbf33549667307d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52310fbd1aa8f459b1673242c01ef8e0b
SHA10d08e3e912ac2c88cdc005bf49450e8ca6e23892
SHA256d5a2151b970a09a622abeb1690efd608022d24c4cdc44081ceda6ad7289aefbc
SHA512c3515b3239fb8c9ba8e2503bc3e83c5cc220d2c49ceeea6b848ec0965f06469e66873d723654120f9d920d7f5757197bf0ad5492a4e5bc5e4e3b0c9a14081b77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5058d4fadc23b4504b541be34f6696e35
SHA16ca6c9cbeed1ad08a546f2b1e53cad99c3b955ac
SHA256b9676bc03d9e0eb6d4efb0fe3378c2bfdcbd71ba6f4db884585ab822cdca0d29
SHA51202c3f751c4a8a1d78365764dcf776a5a452b5740381ef65693405df4f782a1d7596bfe4741f7db457c11d3ec43327c2625fac5212f3dbc5bb292b5d8f995eb11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7350b2c4c8c681011e083ce277deba2
SHA10211a20bd9dba0ba90312ea535b3986d80f7d033
SHA256fcc92f0b4d7435cc347c1de7fb3727f8e2ca2a8ffda1d39cc2a8f02070a4ffc9
SHA5122e69ba97f4721d0dda08e1f17ae622d3908d7e669f393eacc26c8b7f4f1855dee62ac1096263a50f486ec5ddd1f7ef1c91ef607e88d2d23caf6d2d54580e6b72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dcc2fb8aea0db2b5c0643a15dbbb2fa
SHA152c19a206fa8e7f69eae2e89ec69c8f0ec3420fc
SHA256f2d0ec4ce9ca164783cc5945e79ca91456b0499ae77e4eb1ee966e990e14abaa
SHA5127ff9e742596d6e0ea7ab6572f0280b472b6c7402207303698c69d61dbe92e125d6083903f1cf4fc251400a1037219e537edd08b9617ddfe974b4ffa0ed86ee87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ad398344286f3db52043c78fe8c0ada
SHA16c87580b3bd785f868a549eacd240b6e69b4bbf4
SHA256ca020871ff199888733c0bece9784785d83675c230a255a4665f00abcfaaf7ca
SHA5124f7a5a8209feec253269b42fbe2580c9f233729da5095c52994444c406fa178337a384095d3b8eb98c9d045319f9089feceae840a87ea1c339cbccc778f3a0a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3251f5a62d73e7147a6066a20b65d9a
SHA1313ba735f29a7fae6c9d0f7f7e01a1f43bc6dbce
SHA2569694ac4a99dd61496166ff7a3d901e422758a09dfc91b2dd3375062d41aef1f9
SHA512551000943f34230c4196a14cbff34db7f80b035c2a03ca571014d66f74a72f7c50a4c14703425fae298a3b96582a0b98d8728a3f61aacbeb7b36a9aebb75e62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560809d3ef7dad38ee93c1d775c696052
SHA18e39c21009d2eae37a422beee272b5733d41d837
SHA256a7b359b8b38db93fb22ff1762ff293d61ab02343bdcbc4e5801c7c4de7ea780a
SHA5121300762cbe2f1562c22af3988e4549beb4e8b8ed5e18e84f558db71d6387a618900eae9182fd4420db645e919204ad66f7373106eae182c9040b561800a78640
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a