Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
3d11dc97c4f2076bb80bdcd67f2d9bed_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3d11dc97c4f2076bb80bdcd67f2d9bed_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3d11dc97c4f2076bb80bdcd67f2d9bed_JaffaCakes118.html
-
Size
142KB
-
MD5
3d11dc97c4f2076bb80bdcd67f2d9bed
-
SHA1
856c4728b42c60811092ee06e9d21f4cbafeb7ce
-
SHA256
28ba25285e5baa9025f2d24d2450e47f1cb570c29b565312e0f4067fe12ce7f7
-
SHA512
0d3604ff70c54836004876aef66bb1207c6fc07e645db85445d6eb5a544218dbf9cc9e9e49bb203a67cd7bd25cfcbf4607ad0075664153b751c9efc5e76a8b42
-
SSDEEP
1536:SnzmlSpNQGx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:S7vzx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421805734" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBA74141-1182-11EF-AB14-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2612 iexplore.exe 2612 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2328 2612 iexplore.exe 28 PID 2612 wrote to memory of 2328 2612 iexplore.exe 28 PID 2612 wrote to memory of 2328 2612 iexplore.exe 28 PID 2612 wrote to memory of 2328 2612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d11dc97c4f2076bb80bdcd67f2d9bed_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5489666b2ea3d91b0463deb0e4d348f84
SHA18ded99e8b94a35d7da9d6aa0a0269b0757dd779b
SHA25638c0526959ec8f59fa086bb8b35b5da9027c40cd8929936379dc77f0979072a3
SHA512c2854a4c5a89cd96c5077e0bdd7231c02bb02420437381ba4eb9775fa8a899038d78b460044a67209b485a0a4d360b808c7575abdba3a2737b0a9f0601ec19b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ee1aee19c58798a1dcf3f3731f83f4
SHA146b06ec8b5a016b942b3b8cf3fe7c97f93d9ff27
SHA256ab489c6ee3229ecfa55995d034bf3e0c99469cf6381d2c5685007f5da4a55963
SHA512010f7faac389ffe4690568f0951b2a49f0d73661ba7565c84bfca3bb2a343a4617a9443e461ff756cc38f577b5656e4a5d4baead1a0884bb9a69959f173c4926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558aa470f69573713a99d03984acbeb4d
SHA14478ed91d84dd87db1a4e50da42ad94ed9c5f8cc
SHA256b0638f4e05d8722a482bc6acab49c042e58d6b17607608f0a44bc63e0774f47c
SHA512c95a2807aae7606e697b811c5b115be5a80cefad40176f7459528514cd5f8634d8a54ea046cf5820141d7d5e32d7bacfd8a7c2f5ff819279edc9e0f91df90924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5879a3d79ddd641dba29af52f0daee7d9
SHA10ba3711aa3a8bfe89df74bb17b5dee8ec42dcc3a
SHA25663b38b869085f34eca1aba1bf18681339a64a682f00d8e6cc3b9ffe2c3ae370f
SHA51227247f578469a09b6d45d7b93b01c3219e61b2ef713f71cd40efdf470ae30fe6b63cfb292887c6ffcd769df51402f0aaed4d4e6daf0742a8f46e7607cd4461b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbbfe6d859da06154b91d1b8080503ad
SHA1c37f3c9e8b353672e25c128af94db7e7b2246bac
SHA256452239667a65a571b991af01ae1031caa474fae3c0295913351d5f62c575e324
SHA5125ccc87e6ecb052c605305869b653e7623325ab1b17f7517c766d9e738bae2b38e7a9778f4ffc24b2d00ade8b062bfdac678250f98aaade7883ffb91af39052eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9de35c1c6a266df479307cedc3946de
SHA1d84100232f784949d03a132a010e965d64dce28e
SHA256cc8c3a782d0ed26641a3576f17ec3a476264d9f19f0be619d62f2e2c77d65603
SHA5125521d20e294c78988b3a03864adb764bef7ecf6558868af2534be9b838977d9da908649b39ff3c6496b44b493ab1e03724e2f4e02cd21d8e159a26818e8b41ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e95ecaf223d8d62ed2db92a7fdf0b8c
SHA132bd31aff991fe7e773237c24784537c603c1189
SHA2563c6b303e266053cfaabbcc5cea9126cc636f9dc4eed8505afa4a8b9e0f4ccea8
SHA512455e3235145a0541fbd2eed41b00bd7270b8bef8260f31ec8e3d983d823a46218b814707d9996ace4cdc5db3bde583e3ca060b59636ca09dae3d083161115f7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5188de7a56649af88601777e75c7c846b
SHA1716e136dab59923dbc5a3ab5210517c37e2fe732
SHA256c6946e0e3855b1b6d2246775c39b61db71c4557bc1eb5a38671013ffc297f4ac
SHA5123873f32c8b58694e2c2c17ef83083ee5421231cf2a422212388773043a4ac9d77c63782ecbf2c7d036a847938a02a979f7a25bcbbd8eca020d756b2b4895e5d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b29e1cc3ee599ce44dd06b82c3904698
SHA160e856984752fd3194d1d02bcdeee3d13a827cdf
SHA2565d92888aa1ffab920c652bdcb7816b92c806ee616a8f82ea16068ff2fca9f89d
SHA512e980be41d63678a03e2a6681bb44c3ff4c3510a04fa1c231da67908443fea9b54ff4423d1594fcaf0f05407ec9a5bbc7b9e52e789b4d70ecec37ac17a9c68051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f5b183474953aa9e78fb13d4a196f6b
SHA12c44d6365a745d87f21ed385954eba837f7b1749
SHA256c1e2258b24f9c4d526ea7b83f3e646013d3cac7d2ef78f468258d78759f46ecc
SHA51295fd84539481cf772543596fe1d0c6d3d061ab71f3fdb742e619f1b148991058579b6b73166b667ebe1794e4e743a9fc03b1a18a165a5118e18f74d14945f16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de583c029a231c404e5481fe4341bd7
SHA14ef67328c472633c5fa5921b6c1ecea86ce4e774
SHA256cfd99bc38723cd523ca151c65b273f490dc653241fc249deae231b4b4321e66e
SHA5129e82b8fd84e193bcde35e8c444ead4726a2e98bc48a3ae501b1be42a3e583abb821ce5aae07379f38053da5332e88621a700553e5fe63363b263e9ead90ff4e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559e49748d5851be12b21cc34a9017bda
SHA125c7e476c74343490191f1f0c19191fbc2bc1629
SHA256df6e8f37b232836d9216e26667d5bd749f75cc5e7534759b38ad34c897477146
SHA512a9bf47043e0892c21d6bb82cb83d8cbdada4e431ad6a7b6d5a250ff04f912242fc46fb72783417ec8269ef73d94c2ac9f4bbc9083acb160b16c57e25e9c36bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e9ed11f26f925e1960c5b2045669d22
SHA1ab126bf933f86a8f241c1c27447ba6e978b825e2
SHA256a1267306b24dc35ed5a53249187d32abd26ac7fa4163c7254975eb5a0e6efc66
SHA51262b68596e0430317b3b129e24a00aad761a6172fcd3e2bb1e3eb8f1d63e57426f0458f75d966dc8d6df09f3e43ccafa17f38c3d796ba3d61cc6f32f2f84bfbad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa67932161d72fd0238a4335d1be1e8e
SHA1142766bd5995a8083268b88e325b8963ce5532ed
SHA256e8809a6cd1675dfa9c502678714609b1cc7a1ddcd21374ca38f5d4b3572debdc
SHA512f287066ef1bdfe095a8a3e3dab96af833c48590a0f514f8ba9ec50075791ee425a2553cba40e6d1c1b9a6e8ea905d6b66a9f4e7152becd21360b8bdbb3bdb221
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a