Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
3f320efcc10d72bb71a501f1c3b7aa9a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3f320efcc10d72bb71a501f1c3b7aa9a_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3f320efcc10d72bb71a501f1c3b7aa9a_JaffaCakes118.html
-
Size
72KB
-
MD5
3f320efcc10d72bb71a501f1c3b7aa9a
-
SHA1
486d940db2d14eb63c666accf658b1cc27b83d5c
-
SHA256
e44956f43f3cda769bb389d102205741176a44d0293c121af2aed400436c0668
-
SHA512
b697105c6af1cfd809d24bf10bd61405ba76b95ca07f425792a3cb893db99c180dbbdf7738b270514212b02e06cdd63afee1fde2ac26802ff48b62e70a31fe61
-
SSDEEP
768:JifgcMYRdsI+mInDD5BLd0gGezhyHFYYJoT2jwC2aZZGMdtbBnfBgN8/lboethcr:JDZT42F0tbrga9nhc8nhVW
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a265ff2d9744bf44a775392fd2daa1c05b391706125586518a3ab277c167496b000000000e800000000200002000000042d8775becfe9c986f572c508320337d950bad417a3172fba64bfaab6ff397df90000000d0a591a65c4898768a87ebb79663eb92b995a1ed003f902923a10f043528dcc728e6c2bd06c10129b59096a6fe29bedb371eb138784cbe2908a0d63b721ba33c752aa03417995a183b53f0efc261c049b59b95f30728e4792a39217cd08975b7f80ca3580e6d1ad95fbe6a4351ab99be0ab6a971990e899bd8e4acbf4f16c0b82e1f1e8fcee9becbea0ce9aedfa3d8fc40000000a3502a28c10cea2e553e0d8ca254ccc7d7d340e409a66e1a3cd3fe63241f09a747eb43904e2885a15e9722fac9347e0dac01de4d630478ce4657cc45913a4c02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82F6B6A1-1119-11EF-B671-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421760544" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006abd811147486ad13eb3bdc3399f04ed7534b9a26202a4767c8ec90ea02b58e5000000000e8000000002000020000000cd387d9826f758cb9815d030b378113117057b74fe94b4838b6581145ca4ff282000000072d7a3133021712e66a86164c63d522e5cbf91b6898a11464b095cf093b7a2424000000078f0a2f1b5ded4e07602978eec55490589c9ef21c5aa2ecc87a2254bf3ad098d103c710a82a59ebb5aeda6441ba0e1b19bf5b25515221bc28ffff2fbcdf824c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0043035826a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2116 2740 iexplore.exe 28 PID 2740 wrote to memory of 2116 2740 iexplore.exe 28 PID 2740 wrote to memory of 2116 2740 iexplore.exe 28 PID 2740 wrote to memory of 2116 2740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f320efcc10d72bb71a501f1c3b7aa9a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e07ae56e200ce29fdc781cd7acbe879
SHA14a86f816933df5a8303dfc2c8d103c4e79d4b5ff
SHA256337a7c0709f3c0df50bf4a69590bc51c794bc5428ceaec5f9b8b5fc13b61930b
SHA51246a58db04928e2a6c4b23413413575c638edf3d7b9320ecb8b5240d2fce7e62b53b903c9078119337ca480744b90c3bb46758884d0da279e76e0868609c503fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eab35d89990e3c41c07a25b54999b7c
SHA1c3ddc65d279a3a3c41953d47df70cd2b0ea4ee9a
SHA25686189ac59552eb6a822a8498095996912f27186eedeb219387b74c0c3aa57339
SHA512bc36396af310b6d0d66015acc21f036e7594a1f6e58cbb20b950690d692c9c1712b1d629d3a864c31864f13d77d97f5ccc486c0109eeb0772f5cf7d8af2eec4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5aa4361097e6a7df907fc9bb7c68002
SHA1ab7698d8683b4449162ec7be5a4a56a6ac8cc2e6
SHA256a705732dadea89968f7362ea5b05d13c5666da1c72348a83214db619d8e24a92
SHA5129a2921dd8a09c8962df1dcca9b124694969395a354b24c814bf0cb8d6e1971a5910d54f42244e1e1de7df7facd0eff36ae8660bd65a65297fe129e1fb7ebedc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f3aef02593275fc25ed0c1b9c71dd3d
SHA1bd21eab6889450b129da00574fd05494af73f5e0
SHA256220a02cb51284b8b8a36b7ea9c5c6acd67e3dd3b3e1e58021bb237e4a74f7ea2
SHA512406381c35a2b73ee2713a47ab23469dc280c1fbcc07da6d480742b02d8f52772f753c7bf36b5bac2b520a508d7092c76849a53baec96f881478dc538a90a0cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d692dd8df8b72d17c62e26b66f9aa5f
SHA16180ef859dde9d571365faf0043f1a19c6320f9e
SHA256ec7a7ee9fc5938ddc14618ef287ed280d9d7ba959bf56d5a31b8ca48fb80faf0
SHA512be0015dcdebcf1ab7bfb66bdfefa7c2f1eefd6d7462fdcb0ca41d99d217923433596f83917f6f1a08436156913a90a69b7f01ec9b4a9a69ed14340cc311ff665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527dd40809ad6c4fa507bd9887e08ae10
SHA1a1ea30c20f3e9a0e3182e23e500d8bec2eb4ad0c
SHA256131053c88105ce8ec6df0259b13a340bd822c96c82a2bad7438fc0b2f08946cd
SHA51275df26b926da33fb8d8344664a23c5b9da857fc68db96711ae9da744677723da2777d7bd778623b32464c9ebd780793922a274ff6072388622aa2a7ce2e6ad7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545e94b4e92e19705d2ea3cea9d452435
SHA1dd1b229a926012028b4fd887aad19d973bb2e26d
SHA256685ffaf0a7ecc3ac98d16129da93d54a42b83d95e89c2c913c044900f7750941
SHA512f312c72c89d4267f7777ce98be4a7415bbf37d76d7e9e90ab026f12a2c78c0e9c3ffc8063954704c9a96794e25269a59b84283ee8cac412008e1c4ce4902b57c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a84888a29c3cc4a750ba22562c2d639
SHA11a00237b499cbeac5b121807a6dc5334e422b3b2
SHA256a9b33c2ff7224a7659233e809dff886d2f1a30dc86fe0de73497c04b0cd1dc51
SHA512afbf4854ac0ff892a4953c920b41de3bcf19f454d35429e23120b1ec240bb13b304dca6635665b13bc8b797913a7b864fefc680e812f37e19259a48875fbd803
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516b81c5ad4b610a6c72180148644f460
SHA117c56e976eddde528d53f5c3b32bb234ae55df12
SHA2567105ce7915b5b986259f44254aa12c9c71d80ee33144f38c66e581c281026d7f
SHA512cae89b4f1f52eb0ac0ddd34251bade53c45f28bd52e16abbc3a659404dc12fc6e7261adba4be55de7ea2680ecaca016e4b4637c62bb4088fb1ca32ce6c8755a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5632e66cbfbad87e3126d897a8a7a5c00
SHA101c1084d42b32cb1962a5c14133c6fdf9532c6b4
SHA256fce570abab039b8d428e768df025bc2aa47ebe45d9b570ea4db5a2c9180f899f
SHA5129d5cd193c7b55f21e791ed916ff88f270e3f37d1339c13d57946b761c83660a38e74ef1b7af1ca29510f550b346ff4b9ac6f4d925ecc52c5383993ba03e016fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da244f34d9c5c2c3a72d493778c36d55
SHA1f39ac9b519267c41259b5fec5bcdec1e12e3e08c
SHA256a1484cbf51e4e276eaecd649f98cf8d35b88cc98e6e50820cce224e7abb70e14
SHA512049af044baa3d726844cf4c1646e0d336d21a4273dcb327411adeebf12c5909db767539a2cd9691dad93fae16df17bcda3f38eb547eaee8a88b9b2f47491f532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df851f06e17a0637be1ffbb93860d554
SHA10defea805c9e0f669cc27d4d5ee18c0ebe9b424a
SHA256e6ee70e7b69c2171f1d374cc1edb270af0e1bd971c79795f2893b9b2735c080b
SHA512c1e68e8b840f35d13cbd4a0159045df0434454f252751c4dfa5d93104ccc0734ff9f22ca8345a329921d3fc673c49a88f5a49fb302cbb0e3e29e4049744a6d6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb01c0ff8efbb30056176c4f08ff78aa
SHA1d5118bcc48a5dadab1d51203c3590e3337fdc49c
SHA256df43b174ebe5469fffd969dd086c472c559aa843616485aad986b14fe068c5c4
SHA512183a7fabb6d0b780a408f8a089599e98518d25afd4f5063681841ba0e6a292825de0ea1d94ebbc173f7f4bb8605afed4d4dfd7e0008c107904682083c03f52a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccf34238cf1dd22e3efece35ede609f0
SHA17524195010a4c5d5bd0ccdf5f8bf1941ccba7774
SHA2569e26f7545780f8f2aaaa950624b1e437c1dcf3f14afa1e8a3199a14faada5bd2
SHA512208d9994ce732eca15602d8a02ddc9000574ba969ba89d25b41adf3b7afc1bcffec8fbe4083b360be9884a7c53306eb4d96bb40a44ff95ddd90054012dad92cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598ac08919742691fc08baa451f5baa53
SHA1b227925a52f14f54f8bcd623e10926d790ffe6ff
SHA256bd8cb9eba147396cf8c6a1f7308e734198ddee1dad66c7a853fefa38b353e013
SHA512d5fa10cd3facd588f91a9db6757a066c3e1242644fdb0c26408675e69028681611008ed1c5511ca30fd3ee3852dafe7d73f3e1b043ae565e5192df5d4f8b3e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee38a307b7ea5972f6106ce5c31b77e8
SHA1a1de4d15d6cbfcd1f39067e3699052e2f70a11fb
SHA256bb0421f30887160eb6f7c774f38235b8c2f7e9dfdf8ea9fc3d06cb0c18334bb1
SHA5129db2b2d6bed963ac07f4c49dc63b82264b82dd387459c16025a8404b008d247a57ee1af976dc73437d2e124520ca740e6d9b58a5a8270b260a0477ee54068abb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f18114812be57f43d79805dec651f9f5
SHA1fa8352abbeb26e9fb62fde24c0670298903bff17
SHA256ce12c3997bd3dc17cc7122359629aca82d43170aee3142e9f0e4a67808374c2e
SHA51275453d9e48fd9d2db6eaa32a63e609a135b21c461b0cefa695259b34b109802ababef54dfdbe7fcf843f12e841a26c2e7c685b6444b495317b57e3ab82d20194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5519ed50cea8041a1bc13b396c72aebae
SHA1ccc32231e76dcef50a9c78e6bf8acfa2ae55e760
SHA25675d95c97001dd89edfc4664b9fb1cf0d1f12d6bfa942ba28a38e34b387e91381
SHA512d9a1a477e6201a491d3dbb6b04e746d42e6db7b591aae7bcfd6ae8b56ab6875f6e841fb7af9c5cccd57488cff99873471ee17bdc456c22419c20daa3580a4d1a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a