Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
375e2be9597e4b562ddddf37dcde96c3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
375e2be9597e4b562ddddf37dcde96c3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
375e2be9597e4b562ddddf37dcde96c3_JaffaCakes118.html
-
Size
87KB
-
MD5
375e2be9597e4b562ddddf37dcde96c3
-
SHA1
8e0fc91f0315bebc8692f57a08ca1f9247135162
-
SHA256
7d170a714eb27a0de2f16e9a7a852cb0b89c14c7861137814c8ab786565eafb8
-
SHA512
539d82c5a3ba988efcbd2926a5d73bf59d41f8726e00a13787e90371e816f83da8f5954a4933903f130d8fd2665adca80df4d2b874e5ff3a753f2f4835c15563
-
SSDEEP
1536:paFtKukOhgCX7vg2Mr7BXNVOWJU/AEBpM4ehJU/AtSpM4JLgt8k9NTtgVMB9jHHt:wFM8hBLgt8aNTGV45HHufV8vHrBa9O
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9AE32D1-0FF8-11EF-A48B-4635F953E0C8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40590a9005a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421636508" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c7c00eabd2f6324c488ed1c6e3399084eb3b551dddfb355039b06391b1f11d94000000000e8000000002000020000000619ab821c70b97b93de8b4a242d88dcca869f3177d04aa4c8653e187e8ec846a200000005d0c223098e48f30cfa9d8c6cf4e6842f095b5b4fb180b02319e32cf048c5454400000001078e5eab130fa870ce1852d2fae3a8785860ebe3d32081d9a43f4371572eea9c766bdefe4add2b3d66009f7a7619bf919721b0c0c65b7f9204fe54d42fa2836 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000141c11f9f8cb03af6628e0ac5b031b4f03a8cc9b2501a657926792e7c7d55106000000000e8000000002000020000000004d8dc0814a9a82a30525c5618016fd983d57f34f816964344f9d90cb6bb95e900000006a150e180686e07cdc8075bcabe3810621eb9288bb231e18918d72ab9f5d91a16cce536f87c8b6ebb909ce14c08c3cc8558befc154fb897f7fdaba3ad2339811250b5bae2936088d1535498980c8e030ac4c0ab4d8dea3ee5d2bfc3e1c25107a937a86e8cb732e12aeef27b5cdeff48e7cb841b58bf3051d0017c09b9cdbdc920deb99965c6be6abc9d22559cd6bad9c400000008d084df007b229005a98b4dd536feadb2a75d0c9ae7eb8cbef1b245f7eec4b1cae205fa6913dbfddd7171e3ae81abb3ad2b2a576c2eb1f1bafbeb29dec6de992 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1048 iexplore.exe 1048 iexplore.exe 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1972 1048 iexplore.exe 28 PID 1048 wrote to memory of 1972 1048 iexplore.exe 28 PID 1048 wrote to memory of 1972 1048 iexplore.exe 28 PID 1048 wrote to memory of 1972 1048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\375e2be9597e4b562ddddf37dcde96c3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e2f4b3c82bae7155e721ed09b36aed9
SHA1e9b3f810c9798f94cae9fd92bbff4ee1f6604ac0
SHA256fc2693e1248967026602798800db7e668d6dba9104d2c343dcb0312220f04728
SHA5126803e2eed0d4ae9ae585aca0bb39c30b0ebfcc664ca1fc59dc407511b3a8c4294808ba49636d4285b11126e2afa3c89726f25249c31d1871ffa8f5bcdb56601e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cf136ef432f7ac0058d764215bb833b
SHA13933b8f382bb97a7f6b64bcf46c1f31b906eee81
SHA256c094a7b858f080399794d4be211fb0a214f5db94c107be65a8f3c0c53dc2b2f5
SHA51212d8317b0fc22368a5a9d10e16e8aed34b57f1c8e9ec9b62259e1c0d66d83ced8cae831aaee622bf15e3b0a8b8fe604c19086c18934bf66b33bf23bec19ca590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ec921b4d58f9417dabdf77c48be69fb
SHA16c1e04f8e9c530dbdcb94aa92c302dc7a4959096
SHA25617fded8ab41513525de8a576c667f37a3ee786d6d6f00301f43b3eb3c1620535
SHA512fa88ba861652db620dde142b9ff3c7806053400c6d4abe9e1ec6c28b8247139c97d5bed1b1949b35aec2974de4a44d60b1ff72335bb6ff30313db1d5a37debde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554fdcf3c4a8875f9628e3b35224ebd25
SHA1d33a078e85d808dd19e35344ce3ab38737fc3660
SHA25626f9764a264ead7b483705836c17483aaee47b7ac9757150e910dea45251457f
SHA512b260bf1557ff1c9e7ab5498f0288296c62c887ca5a30b28a8382a20d5f40e836d6e9cafff80a5c62e3701660c1e6b9fcd79633dfe85122a7f07361d20e09801d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5179e7769cfc8df0d4ebebdff62b5ed60
SHA131f239f106cabda12112fff0dc4c73598647ab8a
SHA2563f335cdc7630def6801639cc8e4ed9b0ab538505fa813bfb9a26815e7d0129f9
SHA512cb2442c33c2843fde6bb73db284df3f9106be569cc95eec0d03f8146e59e73ef9ca99f9ffdb9c43fbcea81cce23b8d5c6764ead67e3f2338285c30af04f492a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55acb2f0def986da36982a6a2d0832417
SHA1bae3eaa24a9574562970728d9a1c78cfcfcbca83
SHA256b16557b8434f42f37fb321ae938743b9da4b70fed912b99e9b5c70730a513818
SHA51277cf1f193539381d990f6dc4371387d0efff7b3914762a4d7695150db2bb5bdf15961a50f57a3375275cd42b8604a70cd55b2f31ca5110dfa65bdb5b50a8a5e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5127af316c10bb09a7ce0d4787e9a6a73
SHA1c59b7ab54812ca4c3de4b379fb15eb2e5a78f331
SHA256b75cefeaa4badcbbc311bdbd71fe64cb7f41befce82e0b2f4ff471f1bbda755f
SHA512d42233c8f616366638c19616131f889bb80a94df3c32f114ff2ca0723934b96f025fe763fe7f00695fad13cf6696b41e045ccdbc2c311572215222ef9d9c7433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5740cf642574750dd215b11bf70e15e8d
SHA16266585eb94c9505bbd9d0551497d5a4014fa051
SHA2569a850a177141909aa561e9e745b85038463c8ab81bae1c42f5b04de621bc7563
SHA512294fad20fb6513be20441035c0cabb88884a3600f7b6e8146a36b17868ce63c59243eb46f5b6ec51ae2a455d50b2d87558c9c4cdfe4db566b95d3ff254f711db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6210292d4eb5315ec1f3ee54e09dccc
SHA13d53d48e5d1d9d0d0064ce4ad6a82923ba43fe64
SHA25624703b354fdec857a26bb9d0b3dfe056ec6fb9250699a17f6b93d862b3dd57b1
SHA512ba1502ee4a9d13e8bd15580169f269f2f81608b52564067d56f09ffde218782f54b18f7434ebf3fe1eaab287aedcf32d6293e626422fe41d16acb733b87ee6c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7e68029024e3963a8594f05bf53c23d
SHA10e891f40d52a110d7e786b5fe03aaeda643f4e86
SHA2565142e0b7e9c43615c012d3e5fc356726c9c81333b57f96e6c2dcf14fee815753
SHA512bdc34b9c9011641be219b79b26592419269b3588f1d054e9e5b610bd5638b20587e4c4f49cc881d32a3c7d686cf81b6f4624c96b076fa660aa3edcc193f27ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc2db99a0387e812c5a7a6913b16e039
SHA1a028dc49d45057420f911e0106e0e7e95c08b117
SHA25603471f7e4a3fe80063ccc1b067c23188e59ffad73b295283e5442098121a225c
SHA5123f994257fac7b86af34af062026e6cf284ed414a501ed5e3ab46a32c8318c03a69067d41f1b1e28f8023c458723ad13a028e06172793e9faf2ea3392f9ec68f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553dc6daa86e036a6648ee044afa2bfed
SHA1862e3a9233f6529369dfc8660e8725b8d9a81d32
SHA256551668cf927ee1311fb3adee7b0574862e84a37fbf029c688213da720ec16286
SHA5121de99566007c2e2afa78097426dabd083bc9b53f3470353078acc79d7e8233ccbe557729bbe98a7738fe79942271cd351bfd834410fdc0b8fbc55f578cab29d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50670d213c330f254bce8815d876d83b9
SHA1030e98b5dc12d32b069c6377a16c6b2ba7d69820
SHA25688bddb385a2922cb038400b7a78d9297176ee272af327894389322ceb73ce621
SHA5121de31f7f1cbf6b4ead4bfa20093e701d7091d5569e0f5f07e5a638c5130c8ae6e67da0fc25cb976f2342944f697eec88caa868c396286c8064ec62193345748d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbcc17d13b3baa2e2e72619a6287d01f
SHA1ef7e70b093ef0ce5a54a9a8c06911248e6520d53
SHA256b5f8b6992c89ab2365e40e298787ecb67bcc4e13b7901b488ebda2e24d8b755d
SHA5122ea80349611d8ebce4bb38ea834292811c4267ca977af14174eac4eae23aa4c6a485d986a420aab4486ecd00970294124d473b270dd808a9fb2d32b2f54b486c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594a3fa1dcc2002b139729bb86dc482f3
SHA145241d589be55f74d83310940938995fb91e5a53
SHA256fc18da5a2092235f3002870a70d3e9d8a2ea9d0b9fd2e9bd6c044110a20a250d
SHA51223f73374516632294e64ec9cb1f560d425b06eae4d0ed1641727627527472d246043ba58e2afaa89cbcc974e10dafb014701bc59022ed89e2306db8cfdd99f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e149bcb6f031679fd76555a6ce451277
SHA1920d2e95ede62bf4349e4202a41dbbf4999efcf3
SHA256e1ee87f69a8a58f088678c34500b72b11c841a6bc6b410829f11f33d7619f6ff
SHA512b9ce857112c5a74a58aa93fe0a42cd2a19e16321ee8643a0abbab1e46653d1cd7745d6832717b15fc370d810c6f22432953d3e3004ef3210ee4d14c227f96ce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587faa852f51508b0fc5ea0abc09863b4
SHA157e1c6e1542276a25b951adea83fbb26a01c1739
SHA25660fed801982883e83d12af9d61561c43b73574e2203507f45210607fea25b02e
SHA5127ab5bb18c5db53006bf071411ea04fddfa27c9143fcba112037548d60e2944559aadf99856ba9e3ac8fe806a5f1a177e697bdc105f7b7d50cc618cd1735aae5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f6c4be0dbce93ef3ad3513da82cd0a
SHA16fed6a743d7eee947afb043840acd7aa76816df0
SHA256a2936a5d64200853628e7b3a81608af43c4e2bed79efbfa46fde89964bd745b3
SHA512d2a497215185fdc0b0a0f89568390c0a668c7d918acfcd96663ed10238d402f6dfe2fd0f49a9a2108e45efd6833332f94d2d033dcde4d864cc6b179fadba182a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a