Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
402ba78bd2a9ac24eb9248dd129bc612_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
402ba78bd2a9ac24eb9248dd129bc612_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
402ba78bd2a9ac24eb9248dd129bc612_JaffaCakes118.html
-
Size
462KB
-
MD5
402ba78bd2a9ac24eb9248dd129bc612
-
SHA1
9527bfcc7cdad1c659b49f77dd18786126a502f5
-
SHA256
2cc28d1ff8ea19f38d73402ecbf153b161beff46d903f8a5578f6a20957e6be7
-
SHA512
d4d44a432c4bab9f45185bed91b271e97d36a12bbea2a871030b027cb7579d6ef7e38544c0680ec0a7d4fb4d54ab4dcb20293462616a7ef9351f6ce12d808858
-
SSDEEP
6144:S4sMYod+X3oI+YUsMYod+X3oI+Y0sMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X3g5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421776222" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f0b1dd4aa5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0524E011-113E-11EF-9A38-7A58A1FDD547} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009c4c46d70782560e0148bbe1dc61c2ffddc9d4bca26ec1e0ff26eb517e754eb5000000000e800000000200002000000093422dadd7506ff34daf5a120dd919ead88b910a478b1292a916c526c575ab8d200000000686549c55542b81029d770caae6f97f1f9eaa444bf31cb236954cf30098b972400000005e62a9bdbd314b0fcdb550f57c13f2ae7887fc29e1cca0fa2cac4b21dce63b4b85da03fd4b19c130b0b72b52f8381a7260ea0c9f58cab63c479d0251c8d95f91 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000eb48afadfea37bee3aa121edab0c90b01c5634416b18d33df95d792a875247d000000000e80000000020000200000009e98a691a1ff694b58f85c190e18d1b4d702845f521e1de170d4a783011544789000000021b554eebdf3e716bc7b72e0dafa031e9ffb066300f1d75e27e4c0ad820c46c793496068bf56d5c843df2251ec5645b910a07908a2b0528626a6e59ae7b42998a401bd461723ae1d0ae0edffab517a22eb85fed7a7ec81355a2154c5600e1f5ea64abd34c7691eed671644a265477f8e5d18084ecdb5a86dff4ad42642e87777fad3e621248689118df805a51242e0cb4000000082d346c4ff34db2f2e398e8f95813c4541670a1176cec4c7c363a772e192e194f508bfce5b92fad513af1b283a3bf6dd381be2b2d4dcd58a97676d3e784e6f76 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2900 1740 iexplore.exe 28 PID 1740 wrote to memory of 2900 1740 iexplore.exe 28 PID 1740 wrote to memory of 2900 1740 iexplore.exe 28 PID 1740 wrote to memory of 2900 1740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\402ba78bd2a9ac24eb9248dd129bc612_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e30d35a822161bb4b3b184216e3448a
SHA1b840fb21e6aa4530ab846c3b20bab8ca58806f0e
SHA256ad005a56ab612c73c2b60ce103ff55ca72e85cb7efef8d7c2cc6c614e1634786
SHA512829daadd4aa8a2402ed16a64fb9165b1408eecf45aab69f8a66c0e8d2364baac104ab72d6daaa38f202247e853442d09473fc232ea1cf314d6c92a0c37c4f4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9c4ab64c3ad1d805545f74b8afd58ad
SHA170a05430cac7cd456c0c9453f5f44d27ebd63134
SHA256e06d3d58cacf9e2040955e328024c60f54e65ece20e4fc4c3767434ff3d3e772
SHA51243c45846651d9cc161df53b4b242c11e9e907533d2fd0907cfb15c4781330175e8d64317c4a3a9885bebfe2579678760749fca339e1ddf3db2b5f5f981807277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524d97e560d3c69d7711cf839a67e2d2d
SHA10f941bf4eb7a450e1e96c0e43084fac8a2ff5947
SHA256a26bb6d1a334407d0ef87c50a6793f27d0f227f70830d46c8636df9d408c8c7f
SHA5122e0521feebec407eff430bf1dfe8173092efb9af06592443d07cc1e899eb0ee35c3e1780718c7083df90f4e9d06076c2d1ff9d81909796792031a7365b86f6c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516f5198c1c6fa5f098fe659682fc4f0d
SHA1526b983cc7ab45093f2f168324fa3144785ed5cd
SHA256d39ac26a7ff034883360f1977dde4e879bdf664923ed4d09b53f7e8e1af61fc2
SHA512592684a52c080477ac23a3b39643b42a12b368da5fa18d85bdacd55b06f42786dd2521665ade8479b9f91c0aaf2252d3f6d5c202a3d06ecddbce5b41f82fa042
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc825f17c21d824b38569e7058e1180c
SHA1a5edcb756c6c1460fb47d62c272fcb9665e5f226
SHA2566a72fb0aa8d737031a6cc212abdfc333769ce76dcf216fe0a58fd7ea39755011
SHA512680cea7f57701b46ad1979c0f0193cfde3537a355397fb27dfa4f27c6f03b6f1ced2645c88a767bc691bcf72e47011b6d4d76556ec5e3d939f5d043d70df4aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d38086bcfb644472569051f16086aac
SHA12c7fccc1cd90703a599fd55f6b1d091f69e701e1
SHA256c99cea23851653bcf143ad90e6e323c6b0e86bad7030228ea21ff99578775d9d
SHA512b7ba4f74faf2e6cfc35f2d397246c0fb3d091a4ad67bc34b3843f41cb95cb82eb723142ff4102a222b711651b5cdd25cde3322434c6ca6af1dd4e13befd1328d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c16aa61224c167fa61be55cc03c78fc0
SHA1890bdf5802cee856adb77ed877b6c47bedb1697a
SHA256c6563185c23235083964ed4b3a9d428c8bd2cf4663e64156a3bdcbb6839335cc
SHA512a1a6ff288b821a051b8a16a566907777beb81ce32c00e554165610552fb9cf5f903a601d403db1ad8c74e855bfd5f2412c3e329ee1554df12a22c7b134b014f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f124e9ab75c1c2fba57dd087c89e19c2
SHA1d27afacc12265e6a0974ffa6151802fe60ec7ad1
SHA25647a6789adf15b6be5250ce6e3ffb0ce156c6f4b419f3c6a612d40fcd4c5efe57
SHA5127eeec3222b1e8d80197f0e17422673704ab151aaa4b03acfee700bb41b64d0911ff5187d91623a93d81efef613feca4c69e087f7bc6d7160172ad27390e4cbf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553032233cc0cabf399a55965f902a6a5
SHA15dc8d0c5d1964b51ac9447b5ef76480ff85d8100
SHA25697a937253fea3f05dec68e9e20ad5dc31ebda8c975bbc1a63d3679a026a5dc2e
SHA51224264687c43f555fa1d2fca68b9d7d1c99ab09d6094b1eff22c6d02e5b704aa9b36afe272dd709d4eb52d57e5d8fa3081422eb604d5d5c92f662afe68265d045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4052e8c62be1402e952cbc8c2266f43
SHA158be01b412b69152695e6a2d0310b57b5c2c5357
SHA256b816f9f797c16ae75668d6c8ab3b1b95289ecac7ce6e386a56aa41d4e86a9672
SHA5121eb574ad6932af932beaf5191e32a745d21f4eac9b2ea18fa9aa72b1fa53c2d2421c787c116192584a2e9160b46213b3051151b1d25740cfe9064f2c86fa7f6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549fb6906c732258a62e145d385b3540c
SHA19f614a0b91af289367ee2b7011491875420a192a
SHA256904cd1d14c4c05bad0f1afd91e58dedfd66c52dbb3dd0360faaca5b3f07b7a30
SHA5120c0da723090c2ecd248666f8f6511d80c29541616c251ab70e3f4d6cf4bf5ad5b14a08a2cba7ecd363f65eadf8aed99a982b06637216c6714c995405c103ac60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0637924e448dffe472aa1f1f9a9025b
SHA135b5b00925f0fc61064e953a159f8659b56bba3f
SHA2568b1e7c571759ed0554eb8ca0e1eca39e6e93298a5bc65a3271d81dda9c555fc7
SHA512c18554d28f50f528718147af1cae3b3ff0fbda45f8828cec4cf2aab0efadcde15f0a1fcc101542ac722fa49eee3e0cf7a5d3aebb915f4f3cd73d0a48d9857993
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db663b6b734c81dbf6bd2ab2f2c99d1a
SHA17902db4350a4783f70af0a9162fb167fdc8d6973
SHA2563a5109ecd055907d04839cadf921ffe0c6a91eb33e43bceeddc8c4b88c4d1fd0
SHA512f5bf61b0500cf72a642ba9ba4956e4f74b72afa2238292ee765cd4eeb5f3095c8f38ce9bab9435c8acb2a8cd6ec0e11644cdefa3621f396946e3d212043a2783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2a934b3c3b07e4d9e494aba4faddab7
SHA1974a27c876bad5406945d0d873d16aa75000dc39
SHA256783d2b0f73f00e577e75e1d3c09786eec3075aadecd324c7cde763d08e93117e
SHA512541647852f69e1e978d958daf1aec9d91824d4ee7909c3a859c4d6c82d8e01c5e21c21b94912095432f0bc1c5dd66c59f795814d0e69685f2a5287a38a16d781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f1aae358b2c13b1be6a9a055b8cd29
SHA11267efba1b76b05035b5f8d342e34284b2ae5a0b
SHA2562e24563ac8d963e11e39891e3f936fd567a2f401126af20e90c1caf7c2ff3953
SHA51217d0f931b58de2b2b217b34f9486a41076a222404ff7a7041c2bf2709a108513dd1a7255bf83ebcc972d2335443e3c00872f538624efab6c9d49746cd65616d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579f7786932e1bcd2c0b33df7d194483e
SHA1d221cf17b3554781fd5eb73e5853fff44eea3c67
SHA256a9e620fb8a752b7bc5da5530fbbf6e5ac0f74a29f799b05313613ef083a6802e
SHA5123347eda51942a68a2327287572677829fc17f1177233e654e590756142ae0d642d3b04ea2dfd11ec5147c0cbcf58fa9d4a460ca020a5b8b6c33a8480918edb7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516426fc15c5309b638f2198ea0e80803
SHA182238a3d97e11fb6d745a85d912f576a3313e648
SHA25668f17d455392f7696ff634805930fa144a6e133f0832659cddb3a6a12cd6503c
SHA512212f4aba5fec7016338d0ce10985cedb06fd47f3603f8168fdd109c3fb9e5eec67967af976c7ebc2a72f029138f48a957f257ee2736989071bf8e6973af890b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b6ef8580c6cac12d9bf5aa518a47a70
SHA1520ddfd94e4a1dc053a3543ac8534aa37d42d54a
SHA256067593858d7672e680aa80df5420b0c5df141ae8cb5d3454821064797d2ac667
SHA51243fdd18639b2b2b525767451cd23c6f290d437899584b399dc00f135ef5e221e32116afd1fe03389750fca170ed582528a98adb3e9cca6dac9c6f736aa2a2f54
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a