Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
3cbbfe46024bc1becc24af7a364292a4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3cbbfe46024bc1becc24af7a364292a4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3cbbfe46024bc1becc24af7a364292a4_JaffaCakes118.html
-
Size
70KB
-
MD5
3cbbfe46024bc1becc24af7a364292a4
-
SHA1
6637d839328ba813d98d5b32b941cd23e31beb81
-
SHA256
286c52601ba944790dc14015c86832f38d69fa424176c7efac63edf5ae58c75f
-
SHA512
b3079790f29e1cb4b86dd4da39ac01ba93bae5714d246f6526690cf4a2d9911ba39f706503f82f391eaa88c5a7d8d9695ccf9994675caa5c26aef16c69577fa9
-
SSDEEP
768:JihggcMWR3sI2PDDnd0g6dpn1gbd0oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQv:JoLMabdJTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000066557613e15862dddf11a4ca72ba91f9af0291cdf946baf49c6c78598b79638f000000000e8000000002000020000000a0859569242d144637663141e680907c38e47c10a619172eb489e990652245d9200000003dd5e23198aebad61e4c1896047781b475860f918755aa7778c6d82e3ac6cf8140000000b137e12795ecec157f7472c120ad631e7875b8aac4f477ad71b7967f98510a2bf317b5f2340076bd23a4c9687ec635c2db9e264aa1d4329a3024614504e373b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000068966b04130d29fe070656d94bee1c0944244e81b16b785f83bbae2ca4302c4d000000000e8000000002000020000000795bfb753b9a72ec684e765f2c711564a378078bc4162bfaa2fb865f512fd5ad90000000eedb4a0a883e1abc770630e3ff68911262a89662d75aeea5b9987eef4ecad54effb8a16c806b2b6f4174b3b2380b5cd9d97c870b12ee2c60dfab28d365c3de3d29b1cc7fd147d3a812c332ba38ee1ba14be2e0c458a86f3e60ec231576fd699cdd7b9daef1f116684dceb0666691ca7baf17bf00594d58406450ee61a300b4b49df2342c737c901d88451a246f85499540000000d46949beb09811e3f43d1904a7a48c742ad4f0f6d3ae95960ce27e2cfd6e2fc1606a81f4012783ba64f8574b59f11c9abb57666f5a772074604b6d66b1eef9e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dcafd580a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421799408" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{010CCF71-1174-11EF-9034-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 912 iexplore.exe 912 iexplore.exe 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 912 wrote to memory of 1788 912 iexplore.exe 28 PID 912 wrote to memory of 1788 912 iexplore.exe 28 PID 912 wrote to memory of 1788 912 iexplore.exe 28 PID 912 wrote to memory of 1788 912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cbbfe46024bc1becc24af7a364292a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5968f1da2e9d02ea6929a3f9c4fc4c7ab
SHA17ced8b483dbcb56166aa992a329a60e1166521ee
SHA256d910e8f55bf5e5b127db575a07e8fd9db62a52e3141ac8e3fb63d2d590f0349c
SHA51272e80f6c0327b20dfc6096e4e0dad5825ed194b892aa4c48a4ae178418e743aa8d0debd79a0db4835751a9bc02f3dbe80b6146fe092f2f0b2fdfbe584cb62c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b1589968f0407227e89f1a69631c1f0
SHA1b284e0816223d66e830b42f57469b60759885ead
SHA256b10f6977b659e82e51d0da939257e2d754499a89378afef41d1c46a82df3db5f
SHA5125b129fb682507c5bc7bfc24431816103010cac69deab9be29fb3f1a857656d0833e6c7ae69980d577b9647655776987c64f960c13755e98ec3bb75390bb00032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd305655bac5abdafc67513950099d1e
SHA15144135fa4c8779b659976498c170b0074110388
SHA2568da45832b1c782660d3932a08fdfc890ad1f7511e93fed21b93ae1da5196ac7f
SHA5124c1c0cbe43885c3c99b5097f721d430ff34a5094dcc992199f488ac76f65b846b1c8f59fddf196de8dfbf10ba15910690f2b0b60dea40b5cc7704b8446c7c7d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5340da8e833a33892f292a7c593858960
SHA1f74920b906d6cea4e7f520e4c0806e32b90c9d6a
SHA25681c9745fa4c34a9fa8087c3d36497a0bcfe32a43153847b69f28b4f51672ef36
SHA512fa6fe66f37e1bb7bc42eb4dd26608c570313bd1dac19818e54a67ca37efc9c872f18ea16c4ca01ed2178901702a0bbf379f61a298be147c7b4108ce1fa2d304c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b60f57ed3aa641fb8337de1cda65f5fc
SHA1843c6ec13235de8ecf917e890e627cd8d3386be7
SHA256b5b19584f28f8896579935c7c83811f41915c23434bd40528592a42e20d0bd3d
SHA51205650341975da2f0b90ca0f547629e73ee56f15bc029274d2d9c82ddc069b9e160df14a21d66a8ac68b2479c8c97bd00135dd04ccfce617a4b84d06aca72ee3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593652f909b4d8e2ba2f6a16d53102ce9
SHA191e1586ab75ae1298d70409096579284e3f0f2ce
SHA2560943c0a029c6e23a6efef2ebf451d98705cbc1928c545db750781e3421315476
SHA5125b44571af893e77ffbe1810ae1d620c8f380fd7fbec997050368a09e84c51c4f755bc7f3242ae542f4f38d791bc9e6eb68f012641a8f4bd298de6c63225c61cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1cba9f80a7e70e2c6b7df036aee4210
SHA1e8964b340f5f35091fa02fcd89fc93240ab5dcf4
SHA2565516b9131b0cb46a03a424afaff6a4afc0f69ed569523ac9bd9e95010ddf9e1c
SHA51280220d1c9de96d84f8fb7ceeb2cc6157e14b6f296821ad79fe2aa01cee2ff789ce86b18528a699d933216e6e0a604bb7576d32795394895a532ccc784d6b7a74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a125a3ce49614e461a85fe8d91aa19e4
SHA1484e68c9c42b028fc05370fefef26c69717d8bdd
SHA2561100c118efaafba87ead7d80d4bcc227d2a14f92315ce58d008241fd26012e15
SHA512fee29bf5ff758cdcea130c8c390f7dcbc9a62a3f1b15649d466c6967a8b1f2d9756b859347a897554cbcb17ddbc2892fa8130916f41f2e0385db9f63d0159fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b3c5eb3a00cbed6ccd9b64d4eaf7c4e
SHA122075480ad84bd7f7b18dda53e5f790a95a77faa
SHA25678eeded5002ffaa5c7d0b423dc05560ad9c247fd9b531e622ef0b3a0a54591fb
SHA5120a9836f4ce52f2a745d016ab7d229be55144db250472b1ec7cf0a2b7d26b7ed13a8c7bf17adbe92adff706cb276da01b0aa70c525dd70e18a692a81e69e915d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e86d3b77b958187b844db5f7df169944
SHA15eadcfdb74e86055003ec33e0d5171525270b947
SHA256e966a03ce5c4e75d4dd74e35c9be71ff11245421e024bf9c1096db28b9693cb3
SHA5128fec479c62a67cf49e6a4df9725edbdbb05b964234fe6a1acda92a5c07d6f0587b16e265a11b92a94584883837cf8044ccfe5d627eb5a63a4fa19d48d6cb5eef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9d3654041ea16761d27638bc7ab4edb
SHA1ab2220da9f5c23d7120a3b285777432be7ee3aef
SHA2560bafd484d9803ee69109521269dd3b9ffa745a3dad9679f083047af69d47e9b6
SHA5129a537d054fadf5af2b72512a189dcdb0da35baa3ab3f9ea41b5fcb81a44cfad14008ba4d8fbaece59d4310328b069a5677ef215aa6e9c1c1ea0f0e297ba07579
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d5194b449f18821baffe4b3abc5aba4
SHA174772c1d4b68369873596779f4547a64342e550d
SHA256e141bfc8ac6a5231cf9f75b215cf999f7ab42583933e70bb75af1c55fc1df909
SHA51231ad624f34aeb58c913b8e895eb3a3b7d77806dec4603cf49ca8f247354af3950f80fd48e25b86614faedef0b1e80780a32b363f6d085a1d7f80a544ebb4c3f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ec6cdf7bd8b21713718b40d53b2bb38
SHA1c5df3389ba6b45db9fa63fb795dc4ed4da64289e
SHA25629ba93f87c0c85dbe628711d81b49a26b33f455ee8c55d856c8dc4d80c2d18b1
SHA5128854c3faa4edeb43d330f909a50a499b272503092745d325a07b7c84d286811dddfd4924801ca6c6fff28ce6b4ea708441f1977218d3d38f2eca4fec07310c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbabf0a22e359424b30521e75b18a452
SHA1c5655418fea516ab45e7559d29e0bcfc054cba8b
SHA25601ebd1251b8acca3aac668dfb1cb8203f7704bd9969963c9952dd9482e241f14
SHA5129c567a874a7ab6cc5b9403f19bd1b1c0d8428a552980e97ae8c50f3826f19113700dd509656fe6ee9dd5b2053c2706c9d991b6f16b9a3ba96680ccc88976fd07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ae4da6ff81c3effee154f8ed5e8ac45
SHA17a525c875f71e17c39c49950a13187136187a2c4
SHA2569056eae73a4dfca9ac42a5a48f9fcd41e4f5e5978bc53d26f20c349d933d6879
SHA512e621392256b4ed3d39a33d12d7f1d0eb208b0ef5775c042e5645cae949407d69ad55a41284eb65821c48e885ad1f6865fc410d608bbe60cf673b71757244f363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ade54139480c0f5641f6be9ad057c90
SHA125b47abf2e538e821515f3541186f9032ba991cc
SHA25646e3993751274125ead16aa6b56d2d9a2ba88903158f227bbbe486f3cba4acaa
SHA512c20dd3802b5e44560b4127d1953ad2abdcd1552b4489adcb6e2bee9a9559d978a1ed6c1e51cc0ae2778f3431bf004e2ce3024040de53d13eceee2f475d817883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a222b7bad0f0cc462c8b348b3deeb5d9
SHA174161403dd0c47ee58f735023e0fb1dbb939e188
SHA2563ec581b08cc11689d2e0a564577dc4517f8dc80017958a945c6ecf937a6ba198
SHA5121ae42473b9dff9083eb83b2ff7703cf9042910ee1656cb1bcc2928d235f246c14cbee62e6592d201fb0ac9be7e6d94e2329ad58b78b40c1222c830d378c813f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b054b050986bfe847a21f6211a8565b
SHA1be6c5c83106603fbf903c285aa4d981140e35b18
SHA256be9399936445e2d7bd75ee924abe0f9393db5e5448d21970f80c398b587ff7b1
SHA512029d20c0ae62de3615b515118935f00b79481af66ce4cbea297f6a311763c0b4708a133c0a978abebc4a9db28c571441bc83f8bd5c009f7cbf07a52466b69f6a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a