Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
48946544f1f6e83a017123a6024ee63a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
48946544f1f6e83a017123a6024ee63a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
48946544f1f6e83a017123a6024ee63a_JaffaCakes118.html
-
Size
4KB
-
MD5
48946544f1f6e83a017123a6024ee63a
-
SHA1
8dbfb8d6164e663b1a1f355ff7f6026ddcc70fcd
-
SHA256
1b89802f7a364131cec01179eb9172b58c6fd25df234ac95ecf7e99f3275a8a6
-
SHA512
46ee9e21ee219f36972a67272c6a44c1c590964ccb342de2b1bb5ae3ac63c6c0f03ee1198a696148e312168b0bb055f72647691ae0d48cb2fdb046d30f1f4bd9
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8os9BEELd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDv
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004f8f368cb18ad6af86b61a6c91049682018aede0272545ecf058e993c8b8ef77000000000e8000000002000020000000143d7a7339f9668e7d2f8b647cb450b0b93c46a0f3c1fd02d055692a3e0244232000000051f97a60a1054f644a11171bdb48bb962c55587ecc34a888d58b8ba8f08d355140000000fac721e803c68ae226ad23c212336236943073b34199298799af4dd98dad9205001256bcd0aa1866bcef723c47f07dbda303d4522ba2afda6d62218df067ec6e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEC1C771-1313-11EF-B04F-52AF0AAB4D51} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d949c320a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421978047" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000db377b146523a2fb1c5dd1b42e0268415888a13a0c594565e77cf1122f792b9d000000000e8000000002000020000000a44457b9c830ee4a62a97b29458806020a19f42b664e0f28dfbb51caa7e257b990000000e28dd5eee1a7d6dd7a88c3fb87a29debf4ba25b974c487b8b115729c0047353eebd15165fe0f762e3a12bf92762cc9ec91c1da7f88cbd72804352f664083e18cdcde5d931c76ba09dc17fb73b946b370db46568fb4b959723147c65f3e62359a037654e301c8a432d72ea13836d6365a4ec465ba7c5b2485cf49575d81d7e07542b01e59fb2acb1e3b636ed3e49a4f2e40000000810aa8e3cbcaa97adc402d8080c881672a4f1d04bb202db1992f4885dc9b9224dbb75ae7f12f4f12a7d5145b95ab96097fd55b7389f9e013b360180ac25c8c79 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2564 1976 iexplore.exe 28 PID 1976 wrote to memory of 2564 1976 iexplore.exe 28 PID 1976 wrote to memory of 2564 1976 iexplore.exe 28 PID 1976 wrote to memory of 2564 1976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48946544f1f6e83a017123a6024ee63a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbca4abfdcb09e9e259846daccbb14a4
SHA1f06e43e41aa7a17196680061c8adae66ceab3149
SHA256bbe2ee76d823b0779c8b30cdc284689493aa50be254bca12b29c2d53a5909730
SHA512bba9d2713fade52b7ebd7436166db2aeef0f6a09f99e69bbe7b6d1ae0343c850d4a3d26803ab59d8e0562119b64e0f1b3e51161e70974896ec009c81909de03d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52174f73d917d2507d64e783538d78cbe
SHA116a42330095aa1712dca4efed1a58eefef06a569
SHA256e6a0a210bae172c794faf8039008a26713b8f1c55190eb0ab9fbe738998ee2c9
SHA512bc67ec48c3dad55176457c605918f0da8ecece797eea7184ed08fefb4feba9252fc6b2654a58f376fd7ad6c4ec32cf0d246e42a4cd281e57ba0e768056f7bdb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500e10b026d669954f80a679bdd5a4334
SHA1ce3f9448dcc7407d20e0ca47306d210c253c233a
SHA2567f1e9196957fc1ac3624a487338de37af05bf07825071be6c694b8c9c4fc48d1
SHA512724b7024ea66aebcd63e5f1d50418810961270193b448766624c93a40405f1f940ab50829c807bd8b21758ef008b6599fffd74fd848b6c1103d23434bdbce1e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4b2d2a960da14b0063e393c7fff72c3
SHA10d7eab4d992de06c7802c79f4184b49b5eb4ea1e
SHA256432516ff13fe8c039b6137f3a055c175ec7dc3242e646119c58a3fb735957fc3
SHA512e4fffce6c5b4c7a527d4ec9acc399401b03deff4d851d28daa54b2f23143efad603781fdcc8432d8b6278a973e9b6452ebbebc8a5090d3f32bafe2e01fc0c2b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51377f4a4f5b4fccdd83cd23196619871
SHA1900108a2e732bb8f3c19ef3b081232c1c334c567
SHA25639524415241cff98c70a0d39f45790efbb21703882c4e45c5de2a16fd074204e
SHA512e46f07d1839e2b01c846f4527e96e79b985a8234571f9eadb8d1dda2f78cc8b19c0e5ace6af9627ec752995da4501e9477de680d5f75d30a456e2132944e83f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b9fffb7c00e7da9a85897df854126b1
SHA1c75d5d2ce8dc414cc702b15c3457ef1373d84fbc
SHA256e75425d8e089ce94821b56f756f1b1a8e9ea368fd222b19570db2e6774ffa24a
SHA5127029e32d8f37d4540b5b7473214df16e522857a114e9399239b8900315e76be6986b5b93eb6273a4da13e12267547c2daac5a017f4b20841dcf25fcd0fc2a561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528e891cf72c7d62a0cafb835e402083a
SHA1c4e4deb41d76bfc19ee348fa09f3032a255adc63
SHA2568bc74f5b70da4d165072771395d9c11c3c3042506fdb595b0b4788c9d3f5a76e
SHA512b2f78c40d593268c71dbdfe1a78ca651e6d6a6555cf9102f11df853827225063a2ef4e67d0083fac6bf3a08c3a41377ebc437871b6934b1925d8296ee9a4062e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5679dc1aa80411ae01a237f1ba16973
SHA140ac3f4d2b7c8384f66afc258861826bef6c4413
SHA256f2c5d15d000f18aa433df925861313ef87f01815b8c70e4aa88658f41d478245
SHA512ccaea848efa965279f7e4b22e96597bef1e37b141a454b63fa2fb62ec5735d6696563b5d763171f9fab006f7df9ebb50bb593905bea15fea7db59604609c6bfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551e5f168671dc3268db5be6e35ea6436
SHA1b9f5ced166bf821e8dc1b3cb80f1395e6c057a7a
SHA25670b92185d210b2db51d37d0f958dd27c32bcb1bc8622ba2c883b3771225569a6
SHA5120aea223a5b52aff9f1bb202abd94a9cd094825558191259958c17c53245ecfc48fc6e450f964b36e829a8aabaa05078c5688971111ad834ae3187e7ffd2cf2fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56aba95b31b448684ad3f2ae0bce069fc
SHA1bf87c524e05f9f01d39a8232b1121acde9387dcd
SHA2567c82ed93a0615053a947ee9e45ee0000a055f659626894bc67b7f5ab39013c54
SHA512bbf825df0b5276e98dd6d740566b30e27bb68316abddeb977a5180a289c7a4cc02ff185520f62858e902842ae5777ebea1a81b55185d3f76414f9069077f2f17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0ad8310751781ab53916e8438e2021a
SHA144bdb926d0dcafb6d920dbd1efdcb1cadf80d31e
SHA2567496276d511b21def8ef4e70cd620d4bbd719c211368afeb6b4df4a85cd6920b
SHA512bf3467bc9ab1d27b6d535f7bc16c4f700d327071c1bf547b4a67d3b1fa7be20d0b794cef43898a73615f4d5103a8c5bd73e49d6182df47ea19e87181cc0f8545
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7267e2594b5581bea02ce0261e730b7
SHA1802e2636dd5761e31f0a4c9ea19edbad6c7f63d2
SHA25654594d298a6033b5b52055fefd2092f039a10c7b992a064173d22099b1c59269
SHA512cab89be20313526b07c86929d9bcb8c62f40fc3838628665b7e4ea06ca4e831421892ba04e3b66240ceab972011468549f35034b8421867f83cca734a73c8666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0a299238e70a5d45d9be434758e187b
SHA185b093a65a5eff881c77154ed491669493beed21
SHA256dba648b76876d411f93080e115241f9516e50e4a70eeec3e42d9583b93390b83
SHA51259c843bc09bf5aa2ec97df719f9c0a54832042aaefa426112db5b522e78800d49ed931c32d7aead5a30b1c08b6eed75cf4039c016f7a88d17a95509f2e14ba26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d0cc7b6db3f8324b5a94581174b4428
SHA1eb61c06a640f2f9ed5ea0c2fbf91a6e7d52d1071
SHA2569d874cf61a88d961dcb2974e12d3ae4fb6cb342381f06e5ee8a88842ab5fa7f0
SHA51255f0319304035070b2eb303f3cffe86611dc8f669014641f68ffdb6f4801ad1894f2a7e4e61ca1d15370697bfad40058d5dcb2f28acdee82f6d922e6e94d7f28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c2c726d554c32ef9dab371d1aec35e6
SHA1a790b782bcea9f363eb6501a7f722e326737d19c
SHA256dcc4ac86e520e5eb8b369d9c0cafe7d0b3a8a6de69c53de72ddf24979854e93b
SHA5121fafc64a6a2b29ba2a5a03d1236c126efec43e83d82da6acb85d7aa1877824ebe0331c824f636ab22dccdf2e36c425f85ddd7dcd67dd9f9c734ee36c2640791b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b375cf63f59e82e6cdd5100b43013f72
SHA1bda46ec089daae1fd0d6d983e2311433169cd15b
SHA2564278d57c8fec08f6fc94006401e3fef458ca42b40b038e4cd71f76c1b29edec7
SHA512c07bb13ecaf49b17e87d11c077abd258a48691af6fbe5d4c25b9018e6f0cd3a9a304111503a996f7be9ea797158bee75db05da776d8b65ac32ed5a414213cd60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566171594edb6ffa370038333c57f3fe7
SHA1010b9916e8fb21b56f38c9951b700e270faa8683
SHA2565151a6c3ae789069b5ca24739f04883831102bd24b6e3285fcbcb89c65d6a5b2
SHA512f501dac3d8420a9afc19599519b109ffc7f2a9ed1a75a1dcac6b79b4478390d341796c555e82ad2314d60ddc2e4f186bd845373304e68d743fac6ad48feecd82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577b69832000af071be0461b238954dcb
SHA175902cc09e1155995d59fe851d738adf6ab4a259
SHA256da4a5b8e160fb74b17475a745783e1d622331606b9f318f3a94c5c3fc6c8f82d
SHA5129512fae5fd74f96f89247a5d42564fbccafaa638da1f7b3451e5084fbfa2bf05c87f54b0a1ca6bead661796d2578987f1bd42bab928aeb7a481c2f9c1a991c77
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a