Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 14:22
Static task
static1
Behavioral task
behavioral1
Sample
469456b9aa2fc9d714668a97989b4257_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
469456b9aa2fc9d714668a97989b4257_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
469456b9aa2fc9d714668a97989b4257_JaffaCakes118.html
-
Size
351KB
-
MD5
469456b9aa2fc9d714668a97989b4257
-
SHA1
9fc7a103cd0fa9800aac439d8107dd3a82d82107
-
SHA256
c8f7ae00e38cbf1f6a51f0efb92d8b9f4e18f2c675c3c458f0b4b49910a96874
-
SHA512
41e078317298e207076decd79185bc924161af4ce906a83b0ea2a51e150fb688eebeef0c7b29576c0de0eb1da754045cc880c44f42baac73c61ef407bd56ccb2
-
SSDEEP
6144:SWsMYod+X3oI+Y0/sMYod+X3oI+YAsMYod+X3oI+YQ:F5d+X3Q5d+X3Y5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F15A861-12C6-11EF-A4C2-6AD47596CE83} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c266b2d3a6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421944843" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ff818bbc7375bd4eab39775374cb9d4b733afb40404fb2daa4b6b61da2e78a90000000000e8000000002000020000000033ecdbc1aa16d5eef74afd77bd5d7d42ee5b182a846142220c793fd65540b8990000000f17d052ed291787870d9fe7ac2bb685a11cf123f4633d163b333427d26daaed44b2e6edcb80fba394e716b40073aa7b4d55d9ec4c48679a86d892558229ee9956310dcc5e351a18aaacef57174d055fec62136cda024b0d81434ef1082122a0e245f1743ba81a20b0052c6c19b7a1aed49b26d40ebd2eb5f67ae1866598b813b1be17c00f102bddb170b5d46f69756be400000005d71f47e1497e035abc11ab4897696d619d73efc0152f606370224b96e52ad8ef3434445eb60b2aaf392f9a8553b7ce0726eabfa26fd38861dd1f830a299c22a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fd74330a64198b0e0c8847090fa390c73a029883c1cfbbd70b3ea39f49b7fd54000000000e8000000002000020000000368f2e43711befd4880421e13177eb819fe752a0e02e110cd732bd1080ea406a200000002d71097356768d10da398092f3c352b52c3c41e8b5f93eef8f9b0e6718c2e6c44000000043f29d1d28a7c2f193561687a079b1cf33ad80208aca88644d3310b63f8973530a2782c156b0171d4ad3e1995c7daf97a1fe1742b0e73ae3487deee3838b2209 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2800 1640 iexplore.exe 28 PID 1640 wrote to memory of 2800 1640 iexplore.exe 28 PID 1640 wrote to memory of 2800 1640 iexplore.exe 28 PID 1640 wrote to memory of 2800 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\469456b9aa2fc9d714668a97989b4257_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d1321dc3025d7cfcfce37903d214a5f
SHA143825bcc97f3a947efeb5d52994635d8d8ac053a
SHA256fcb3f4af336ff43d2345ea32ad53b14d40597202a829cf7da6eede162d1c2ad6
SHA5125585e2df90eddd1a26777f344fbd14fc65c71844c4180eca7f2433c5473e170f4042ec59f49d24c41ae00eab8ac0ec7cf10d9706869461e2c9e5d1f0a8472546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547bbad137cc4646852512dae8cce274b
SHA1b1178ff7307c3361fea66386d526492e71d650a8
SHA2560d615223054e3b06f1531fd4a21e945aa67ceef8cd0659aacffda99b3ed4dc99
SHA512ca0197513453fc7c0a3198f4fc2b1ee9a7d420954321acbba7bc96db73006b917dd026e4b8362e04b43c58de4672567a64f62bb21e8c003dc5a6cf0be858cfd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5971a151c4e443fe1d0350f51d78f0ddb
SHA112e0699cdc3e4726bc2d8d18dfe23838a6608546
SHA256cdb21c7e4ab5bc426ac9eee9c2d5a2f91c8c250474873757cfb816a0a44f6e0f
SHA512d60f4ced532344d83438a18c53f48ab56ef3aeed1e4f951ce6d71523e3fd9efe3b416d0cbf3e2eb138b22d116a9f726d2708bcbb8b9d71955ea0da6f8c1614a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e4ef92edacc708fff66677ab0f46d43
SHA1c0ac22aaf683abb2306817f736b230a7faa64401
SHA256603dcdd628f1c92aff36ba1cff3cb57abe709b62b6fc291be504b9a9bdb0cd78
SHA51207afc6dee09ebd14c41b05a0bff000e9c8102373757cabbc23f2db1d934725e8d720fb4c0ea8c55f11ffdb87b25c35b0257a076bbd9fd9cda394fe312a3758ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ff563d9f417307972746e2cae76d66c
SHA1dd43fe05fd8048f3eec41d1c0a5cdb12590526e6
SHA25662e00d01093ef5cff6640eaab7ba91a6581bd149feab19648b23ec229ef2b706
SHA512c6326ae36036aae02f2e1c77386633281b0630e09d4abac4321d4609bbcd4b3270fb9ac372a1fed19ce92bbf20c5dff71fb9b26d1a6a0d617f433b3f14e62c55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f88030c48e944629e462b7340f4fd64
SHA1a4c7f60e0169753ba1bb8253109376e62bb56d04
SHA25644afb064b5345d049227d7cf87ccca4940a26442e09742a92c2105114b9c20ef
SHA512f6ef2498a235b9258026153a112b9dc0005f63af54890f50ae8b7ddc64a8ddaa5460dea583d890ab0560432e2e999b89861e40bb2d23584d446d20d3eddd71d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51644dd5a7817b02fe1007ec2d5600ff9
SHA11648f38b03795676ce9a6e6a9a4aaacbd6ee02f3
SHA256276d0b0442bb43d03766b586866e516d8761c2d155272b914a98eaf54e296b46
SHA512cef26531c42f323629c7362b0c71fc0d3514e28a9634a202aa07d4a6578fa47a78c8d781a31c2fa5413cc07c8e836115db71b4ccb5ae10751199e3f25910dffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56577b781b498cd6be23dc6649f372f95
SHA17cc7210b9080081014f1a7cf19fe12231734223c
SHA2562a438f908bf9fdf2b4e31a0c591e545fa12b23655c31528454839cf581b6b1ee
SHA512a56ef1c3a7340aa7f9633367eae48d4874d2539a7be276a301da446485a03c1c3d4d5c88d38a5d32618902134962533b531f1803bc591ea25a6f7936c6fbb2d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516ec3bce41432d34dfa94da446075564
SHA16071269d38a141aabcd2bcdadf7a77732a847c5b
SHA25682a20439ca6cd73b1268259c7fb994da235006349c48f563b9b0b5f5c041281c
SHA512c0c3993bb88641a22e60d419210c49bc61e1e9a2abe572fdfb8315ef504c5435d065ca67c71ad2c7485458464cc2ca0634806075fd513909fa8401251a5320ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b23e2cae3b4e9ac8896a32e7140eb69
SHA1b44ce34276c054d27c64eb1dd475bc430e9f8e86
SHA256df8f9660ede243b2c87541f729a7cfbfae9e473d2e35b9d50da2da88dba45cda
SHA5123e9338f140fbd94e421b584a67eb391786442e6d32ebfc712114c9ed4dcc9a3b56864a8670143373d7dcf524d817dd20617b18b9ce53950763a1ef182239a26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54edcafc150dedea46482386c7596c0aa
SHA158aa1aa854f0199136eb0718560b0fb69b817543
SHA256cd03c5f67762a9c2e6b0ae0509ddc3cba3267555ee97da588123aeabaef18b38
SHA51291b66bed1457f408c267721061b6e31639b1242fc490e14727d90e81d16cf2e28096b5b90cecded1e32cde0e8f6de33dcad6acc14c6e573adffcb1fb09d55236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb0b09ae64d593c4def493acf848e916
SHA1f2eccf7448a35165143e7bf4d748b845dc19ba50
SHA256087efee79b126d8ceffcab79f0d807630a7b6304d895e56dc8613975ca7c52d1
SHA512bd91f87bc1350e335d050bac757c186f28b802b22addb70b98f32091219cfba26aa83bf8bf4b57b1742c8751be270b582491d27c1bc17eaaf64d1208d61adc91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf42268d9625c57e1cd609d269f7d1fd
SHA192da4c3d0409ae31a573ef396bef43fea8a9c1ea
SHA256bda825e5f9b0d5db8d206afb9e438820db5e8ee06a967b02c3dc8db0d75a9822
SHA51283538d80aa12576002f25e50f0df7efd1be082321a5ad8c0833d631b46756270cf2b1647e8c8b92a7476e40f9140fa3d0bcf9d8663a4a267ba1c89fa20ffb08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965dbb05f5a0ae4f7ca73618e1675a8f
SHA101482be1de399a2bf6b11647a2019a4443a94576
SHA2568878ba8c004844f646de13bbcd134d6bcd0db705ff04a4af24dda387f7177e6e
SHA512910f445dd3071474109ab7caab9cabf5b0b5cc6a5472c8415c7c4a199bf874b723f13550191258eafeee831899424e0fc766ee336c3be408bbf20940f48636fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7358ba805dd1d94334ae07a81370f93
SHA1df27b6010a859172aec1969b819db407c893dfef
SHA25624fd99105c6a0ea209ba9aced71c5c80ecc6aa8fa7be42b1b21238b4356f4f4f
SHA512074de9ed0a345e4a1d71386ed2b69b13e17c29e6135ba3c8745b0c5994dfe0914d12a9a979a9da0817f36c0c858292bc549e61bc9801be883a36520306acdbf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e0fb122edc07ade8ebb0c22a3f4818b
SHA1a0c99aba2ebdb0441ffc071f56a7528c8dd14542
SHA25670520f465bb28774434028461dbd04c01c5d3917fa1566b4682a413bbd38bf80
SHA512f50d51e0977f1e144793922a16d9df9abc00b92d4c94d7e1d04f8f11fdb79da8d35e4ca9842ebb6ac1c7bcb91a89ce11ea31d65fb1bb36c9c5051cea14473496
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a