Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
340656509ad59a1f7624ee8ef711297f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
340656509ad59a1f7624ee8ef711297f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
340656509ad59a1f7624ee8ef711297f_JaffaCakes118.html
-
Size
69KB
-
MD5
340656509ad59a1f7624ee8ef711297f
-
SHA1
408de0a5de519bbde7bc6c1a2e42c36ab4e1983e
-
SHA256
fc3f381bd19cdd7817733dab0a4f5fcb52e4f78c9c032a9c667a9826e70c533d
-
SHA512
eec834004a0e50940bf05a7c452520cc2e7f9a2d32eaed688176a765f03f556415a5f8fea43732099cc2d873144500d8e9709e22aa7a01f7b60e02780f1955e4
-
SSDEEP
768:Ji3MPpgcM/cT9WDr99DXOIAzPoT2fQC2aZZ1MdtbBnfBgN8/oAOcRWQFVG8c//IZ:JQHZ5T6P280tbrgaYcBnz8PW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000d67c14542ffbff171b721914513d43d755fff1f5049594f0066c0e9af2c9f45b000000000e800000000200002000000068ac49ad83000faf8d61b31a2e0bed66d4099be00107b2b2d4d8d2c94ddc30b02000000086589d34d20abe8d69c9c437ae8e2063ff3a820a7cc02a301fbf0e0b7c076fc040000000326f713b28218eb73b34f6b583c39e8125826e76fc7e1dec786e4615f10510c776598bbfe0e87b2f8a22c1c360c040ecc351c18456b1a9470a7a9fa952ac02b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c185658aa3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000adfdaedc59618fe19ea308e0dd6433621de2b7413723fa121cadd1efe8c3c60e000000000e8000000002000020000000c609fc33a20d38888c086f396a6b6f50e6cd06d0d8de80f7b7e876028f5af2d0900000000fea0216612515e3b5a94d627aaf96196e8dbbcc13ba19a7f3bbfa93eda3fa441b61573af7851908a2b3641ac95449c80d4005623f11cb082c7597345c853c4594c518a6a687126649cd8f734076f2d03ef47ea78adc3f7bd7d5302cb95db50b16377f769f15678cf3cd4d698f2506063cfec6e8a8dbaf8e3b1a15b03c64d26f05a13ec0e1f7340c46c63970706764d6400000000a38b3a79433da05b1fbd9e8da4caadf95f3078c05e666d0ff48435dc8ddd99b3d138d995d80a023c1d0c6bda1169ffc7fcda74502ed7c31aa18557bf38769db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90A40661-0F7D-11EF-825B-FA5112F1BCBF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421583612" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1928 iexplore.exe 1928 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2732 1928 iexplore.exe 28 PID 1928 wrote to memory of 2732 1928 iexplore.exe 28 PID 1928 wrote to memory of 2732 1928 iexplore.exe 28 PID 1928 wrote to memory of 2732 1928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\340656509ad59a1f7624ee8ef711297f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acabef21b34b9ebc80342bec96d3361e
SHA12c445ee1bac74b034ebbe21987eadaf2bf127e4c
SHA256f25f58c181cc9ac06639a4df854f4812700181f8f594122869cfcecf68af9385
SHA512bb274501362dc1313cd924f2bf850fbb147f3016bc9682073c6d515b2a91ffe59077d0b68420761a166b248bce2a7374eecbcc0fc022581e7acec0399620dabc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3940b25df8699207812cb4a88770c40
SHA1817619dbff07db3fa7c29b82384515e2739fbc2c
SHA25643f5d6a728799f5bebe1d195ab48fbf6041737ca3644ba8b0fb6aff1f4fa46f6
SHA512e4cc3eb1ebd472b6e8701f2b02e82a9133a6c55bf460b6fba83616c6a93e5f73d1aa023ba9676dc626bbc1f3dd94db75d1d91ba07b5c00e4fac12c5a459f52b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f455fe97e999a2d0cff2b8dfd2f1ed
SHA1e16429855c8c51c93a745e41ad085b740a9db9e7
SHA256a6298a1e87efc9831f6e153ed75d9fde8a1a7a77007cb8371e695cae03d72c55
SHA512e49da9c9a68c0a0d21af6b59018a5a18b6f35137befa1c82ae41ce0c16762fba50d5614bf33da62c2e37a158ed91464172fc1b01bf973fb2007df372f891dc0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d57c38574ab98a15c8b5acfb7991c19
SHA1ce4c707689110852904e323e21133f498233858e
SHA256ec35ed3099c4566535ca253de67f918cd77944def6743ef0a8488f3522943e2e
SHA512e075f297f8c470115f9acc202536fa9eb25f5d248f8f5544dbd61f612a8c55fcced7393314aa405b610b1c9a5fc641b0c69173d1f8a50f4aa12e4fc596d245f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dd66676f81bd535cfcfbb586eaa8852
SHA14c963cdacb9cda8aeb3546b97ed4ddd647f395ca
SHA25662266c07e2c688f365575fca84fbebc0f32ea63bbb33c5dd8489dc2c69aa508b
SHA5121a659e5d363cc9adcb112d300095ddde0b2d6636fbaf269df9509a5216a27f0c544ef6a0d49026c04393ff4bdb3523427ebb059df5d91e1c4ddb46b4f8b3706b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dab3dbabf77fa1ba60b5a5d70d5ab93
SHA15a57e8b999e9b20c00e0f4bbd30ad55da2653074
SHA25676ec2dc30b6f778f704bc6a6ec746d4477aa9bc4eee6abf97f7429dcd56e26c4
SHA512bcc89eb35a78e9b761f5ae51871be1e16448860b9500bf7f8bab7341557a2f421a0e96b3c17556704320e76466e69b46e4c6e095314e0d1b81a170a22c7048ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541795ea1019063d608b922ec1ed3ff77
SHA19e6c7801cd50be950d7eafe57ab27473b900b658
SHA256fd6ceedf87b900af8b31a871217d17bba6b045c1eb9e4b1ecc52a0e0cf6239bf
SHA5120e96b209169b210cfb200e95de9f297b94fb5d759662e1da3141e37288dab03dab54db84cc53b4de864646afed56a63f315b29fcd98ca321ecad80cf729818a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531b225760d3c34eb8d159d1697a042b5
SHA15030ee854607d3c58379e59b80ad5394cfd25ccd
SHA2560a2798bc6031c2af9fd0fbd1508df79e0d87f4b890defeb0bb1b98ae3dbbdb91
SHA51202b051daef7c008221ef26e85ef633f9ec261f168ba47431cc4d85a0fa9c3435977d9c04c53741938970e236512a5c4e5eb176304e43904bd88c3ed8257fe30c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538e72fbda81ae77d22cd6352dceb0ea1
SHA116308f6e93392d1a9514ad7e70c6cd8c746bfbaa
SHA2569d824395fb428e133af9f4108f2d1532a1a3af07847cac1052998ab595de67c0
SHA5127588c264fbefbe2859b01310d546e7c4f5d8da94740543be54fe83ca34933daea49a2ffa51ba932c7205c5d6eac448e2682f6fd105e1d1eb0b19e37ee836c4f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593646eb188a9d0e323256d44cf2341e9
SHA101fbc648569c2a4e813213bb2d78781b4fdd1b10
SHA2566e90e812dce40a82514b5bdc745f2b33eff125ca9df4a86e1263338688dce9e9
SHA512b071585751120881932c42561924e563d678ca36e56fbc2db0382a78f4a0d6fa18c75d5a968ff6173f5af4449eb9ce24d01309b7d728ac37d47a6631500989b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5353331a8966e68340783c4d4d773f38d
SHA11d8c93eddfae23d9c91f8baf5f7dbd0ab69ef38d
SHA256e874ae4b676e38552e91b6b40ab2b47966e6ad3983a29d54eb7f1f50361db79e
SHA512b40cddd46747ab4ad8dc5c3d85aad007b5968624a51cf1397820debd1104b353570ec6da7415c68052a5009e17b409dd8ea826f6c827773c9e7c08d84624ebf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4a4446ce8b3bc066ae075657d739ed0
SHA19bbad6c94829433336bc3017a289365a8b7c38bf
SHA256faf820914dc470149d5fb2c4421aad38f21ba01fc5e748fff513a644449aa030
SHA512136d18f23f863eacef31eccdceb96f59ca0a395ddb74b999c6d21384824ff24a6a228a2308aab49c97ae59522c70c4d7f7ee2d28dc6c8ed39b1b2ba9a5295890
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a