Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
40f05d0379878886574bd9667fc74fe0_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
40f05d0379878886574bd9667fc74fe0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
40f05d0379878886574bd9667fc74fe0_JaffaCakes118.html
-
Size
37KB
-
MD5
40f05d0379878886574bd9667fc74fe0
-
SHA1
d8ba475c624cc65f2b14030df990d63aa103700a
-
SHA256
07f90b8305f8bc99b5c1907df54fec74ded324ec124e5df20bc325949629cb1e
-
SHA512
109c250d08830888d87801871b5a8ea87ac62b90d8cb82b56786e9d19adfd5e953e2c95979dde7bec98172156fac44d29038d557672bbf38b114b30eef8f7260
-
SSDEEP
768:YNxsNXOcFgxpuq2XH0sbhpuaGxt1FHUoDsFaW8vVflHJKT3xKiifF2kcT2lg4CIL:YNxsNRFgxpuq2XUsbhpuaGEoDyadvLH5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000be172e46644b7ae50373fc709e93ef22f7e9c80b78a29bf61ec068cce0364b28000000000e80000000020000200000007a24469eee43307ca16ab9563ce0024eda72cddfd180c6587c69b9ec664b2bdb20000000c92f27b45e4794a8c4ef75f9e2feee9aa63b970030f48f64abd172e2365cbfb6400000002da123369d35a3f5039203f080dd5cbc50ae8d01fa0a5c2c6b274cdade73dd65b76c8448ce803079866f603cb36ba7ec46d6e20da642f97e00a5a30275ce2e52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000096af37f6a7b8c1c4b5dea052eda337aac15fe37b496a79366d76c732cf6d6123000000000e8000000002000020000000b9797659762fe3ecc77189be09b9a200adf658df565f2662b46b68128bfcb3e3900000007be09c33d59a6d7ec6d6a10a8fe6087103aa62f8d240d8f5a308da805fa353b3a36077272504d6e312a97643248dbe3c3ba6d93805cca084ba95c0807c674edcf41f19fa1a2af7730c320ae5e033f00397e838b268bcec5ebea995c195b164810b23ca15bfe5dfd68c41ce77755b17b0763f18fb4fcbed1631999ead880e204813b3f37b854e8446469abc9c99cea0fd40000000f21750becf1b2eb32a5e951107d0ace52bbca82ae394c2e5cbbb43e4fa2fd05962a312afe26d5de991670af2d615db28ddb8f9747ea3ed4fe6eed81375b2bb73 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421839094" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68561B31-11D0-11EF-AE27-76C100907C10} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9025cb3ddda5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 1988 2488 iexplore.exe 28 PID 2488 wrote to memory of 1988 2488 iexplore.exe 28 PID 2488 wrote to memory of 1988 2488 iexplore.exe 28 PID 2488 wrote to memory of 1988 2488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40f05d0379878886574bd9667fc74fe0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518f894293e0eb5fc4939ebf596cd9919
SHA1947dd608181dc6b40ae6d214e2805bfe833e6178
SHA2563ece67390d49a350ac9bf6f87349e1b0a7970cc786edf3abb3c28f36d94b093d
SHA512030bcfe07a0f254d45c21be87b5ddeab4556fbeef89f74be98d4057c0e4751ba9c3aae7a408c74d2ac833e3b08cccc6b1be687d19f5e50a944ff53219f97c581
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6890939686067badce909fa81f49fba
SHA173eb74c5de6bb8e7d35d589e2dd8d9687fef68cd
SHA2561a67be88f13315436f513d275e902504cfbbf33b214e70d44074e57eca6f26f0
SHA51260f0b5772c31e6666fa548bc2d39f022f9e5b1aaaef985945470cba5d806213183285e55f17165ea95c32639a728d6ef0b0e65fe3712cc0640f099818e6238c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553be3ab7d9cf8aa371deeee1dad3f8e8
SHA180ffba67a58eff35e4d9ac78265fcd87c3edcbd0
SHA2565def275748b1faa8ffc90f7fe4ce3e8b863730bd3a08edf5ae99468062966998
SHA51238ebb8110fdf9afdb6a31120ff1d232da093e7a6bd66163e601e688e48c42022ea96c83bbcd7409b235d3ae3e1f3835e825e73b10e2df020f47f51b6a2083a4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc0049e0e0d8cd6dd81430c5c7ea576a
SHA1b78f340b49eb4398191f20c74d7a42e2b5194b2a
SHA256df23704a34375a7ae377119a6bd162e81b8ce29425cd7e8ca7fd40a163936451
SHA51280415fd10255561d91aa9665366b497c1bfbc9a8bed9c25ad3f6f6a6cc0937958791a00c5566d822fea2715252a9644aeaac49fba171bf06da4e2b69c8b1b33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f612df931f91a3d049836b0d69be9938
SHA1dbf4d3ab4a0c09554ef2e1ab7cb03ed39bf9804f
SHA2569bcba3ff24947487fe593d9e766c390ffd8d4f09a5c8e1aaf51bd0d43f1f2b5f
SHA51213d3a39138122ba856898be8f1a5370ee0c32bd65485ea487e7784c2fa92b8de20993bc1dd5021868dbdf926ab6e893d7b4bfa80a7657719a83921f08a96793e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586ba3e470e23100562f947d817005b1b
SHA1ad4066644ca461767fb74c9936af0a0b4f72e283
SHA256646775b994d0633fe71c1655fb1437d5106ca60c4c35b2e9309bc20d18356414
SHA5123072536f294da9859dba73bfb0eb01f094664ec1c0046536d326d33234626f41f6f0129ec7acfc0f63f4f2ef26712efbee58272f9bbb35e094b88451e6cd6adc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521003153f2cd0c6ba7916a4bde29c9dc
SHA1e43240dfb76daf4a6ba9d2d22542dc07fe7dd05d
SHA256b3bb0f43d25e8f54a898ed512755d97f46f54cbd132db3634b23bc55ef5422d8
SHA5129b9cda1028f6d69f1a6eb9b9ee9b113e1f4a69fff9f0dc346725789cb7b3ef4faa2a9c17561608ea85c1a6194cd0239b2e01f78caf1d9525d288f80ac4944abf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5838db9c750a5719591fb2f7aa23afc10
SHA1e10563876694f76ad71fd1b14edeed9fe1afe6d0
SHA256733f7c31635fba28f7042cfcade6927b8416671d3692d17302a87024d5f454bc
SHA5128ae8096e6a5b6469b4a469bb22df70e20d426eb67b84a67d36ad941bec690344df426ea48a210ec2743e1cef45731d212eb02097dee8f0ea1b9070b21f24ead2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf124d5f0701ee79e634e8b99b9daf7c
SHA1cc87018c3f145c1b9347700903ad1c558aaf89dd
SHA25605acd2919f17d47089563dce3509b0eaedf5db5cc9749ed022727e93d0a1e988
SHA51239779d8363ad294d6e04cf123d4088cb1183c6131c28070f73efd711588c8abdae4330d8248fb3f45ec5a2d79dacbf166ff99f94f9cc6584ab0e69904b5093a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca3cf764b080cac68191b3de06b324df
SHA161c2ae3d22ad999681596092cada6ff9f0822e6b
SHA2560eb2ff90678079b647616001665e5e352804906ccac7df614074cdb86f55b649
SHA512d7aefab2411b482435bacfb0c7dfccac8a02921c7f07e3d74f81158b032091e8eb554d5572c7ce1fafc12737a39b7732e67a3bdf3799f4b24a799d94a78fe4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e085dc17960e8df9875cf7f19fae81dd
SHA1800f4ab049f256a2f6fe040fdf2f0602761f0cbe
SHA25641a911849eccd7e76ee4ef86df71a9c9ca36542980d6719a088e52e8a85ea5ab
SHA512939939a245476ce7e9f38d833d1ff085289579e5ff270fe936a240770a66218378aa2b8c960e7d7ca2585054d5ef8435bf6af3a239f015dc74de1ea8da941a10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c949b37c41a633b32e810eeed764cfe
SHA19fdc717a8ce4ffdc27e3e9327b55ff405cb8f6d6
SHA2564132fe75b83bca90063f1081cccd946c066f80cd9f55c8da1a6ab1cfd92d0f04
SHA512f980c896eed16e5eaefb761f965395d4d394b966d0d65af8ffe5a9154719d0a56cb066a1656719566cc51c0dadb7c95afa0f515b8df2bfb925ad63aad82fcffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f3dac81c91e982e6f7f897cac0a064d
SHA15742b77125e7e3a04e3fdb6a5cbc41ab635e489b
SHA256e57632b9c66432b33961a47bb1b49833faa3f0359c84f1dc7b91eac9396b74ca
SHA5126b3e9c67eff9a8afa26efc7dbf495d9bb529e9fe360efbb2d3062fa8ad9cf466a070ea3f2ddf628ba36d3cdc6eefdc3756bceed224ed09c934f31f71e2ca987c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef5b2ce87e599832b84626b53133eb4b
SHA199db66c1a0c22aa5e105a27f0fa5b7c41f3dd7cd
SHA2568c890bcb4e5bd06a0813e01114386cf5975c78bcdb2b9ec0b4ab4c136bc21171
SHA512c1ca38bec04d609fa44c1d93bdc5894e905147bbfe4db77fe88e88e940847a093c65a25f987166615db7f9383c52ff65d5b2b0fb95a65faab8f25293ba2fe5fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565fe766ce7b931ae4c3c73ab88d8a04e
SHA11fd5659d43924faf1d414c17aef29bc02f741e21
SHA2568f255511ab9e6e81ae1db046a048861ce8b48337e0f53a3a13210ecc4c43a651
SHA5129e03454ac2fadf911fb33ad07d8ae9b02788f240ef2d8cd10ee8ca3b14c74f786fb6decacb5da77593744ebf73b77708869a8c2af0edf023833940b2036b2009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542088335ea9371e84dd73b3ac478a528
SHA1252696ddd1fad19fd7e44686b6efc672ccc1255b
SHA256aeb993f0f6b275f00c028ce10b06c41b80cdbb755d6c9c661d19c06b35ca3808
SHA512837c209238ab60f1c9bb8b955d1ca545f95f4bfdf1e19649bc435968bf422d473e12c4b939e508e380e07dff9af1a9de4e6fd24c7f8798ec0383dcc2d0a48733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf6215cd69149cf2da129d026badb1bf
SHA1424b5640c693cfea557995ed4a1f5d23d7d2071c
SHA256cad5d866ce065b27ffe798cf3f0eab0c5540ce06591cc7b6c7004efdc5287e54
SHA5128af6498d717b2d36994b37733f488d3cf3735854fd7372b6f760e1a01a55ef1d8c40ae071d09fabcd1085bc82ea5fb02d3dd8ae2ff30690ca1cc04719237bd83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549a6ead9d01349157fc76d2dbb9746ac
SHA1f24d536d5a526414f2b6930494ef9356efae7aa4
SHA2568f2f41a8917f0b1e5a3d72e230d2ca6de2ab946a0ec59cd4cf1a74ae685a84d2
SHA5124cbe71f0d0c98e1b675fc80f5d5d3404ae8594a4d8a0faf72569b01c79ffa2889c57b04db6361114f925457ab550b1143393e1217de995cd790c639b8ba6b429
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a