Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
499f6649a62d7a42791bb3657ea9de29_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
499f6649a62d7a42791bb3657ea9de29_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
499f6649a62d7a42791bb3657ea9de29_JaffaCakes118.html
-
Size
25KB
-
MD5
499f6649a62d7a42791bb3657ea9de29
-
SHA1
d3f69b248ad36d20cf2042b2dc47900653b92e1a
-
SHA256
a084a2872b51ec48f16ba951062db8901933a7bd2008816ef8912539aadf6ac0
-
SHA512
85c77f453eecf8ee3729bdea0da643032500fd64e4d5a5ec6155df70777ae2dfaa6e367229a5aaf5fb31612307eaa75401cdf50a0015d1beadab42a9aeba3c91
-
SSDEEP
192:Nago4br5b5nOnQjLntQ/ZnQielnknQOkrntPMnQTbnanQBYqCzAUpdENwuXMLnF2:AgoQxQ/IcfL8
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009fb8b45f17caf4d955a78cec50cb613fe09e058bef2e842e64827f7bb096b917000000000e800000000200002000000069bb40ac80c8f9f49755bc5d8e8e8bc884ea2229a15fc7eb820abdc65aff1ca220000000bf6178fa657f49d5a422dadaa26f9fae05c0af96bd0f02c9f0c9dbf1471635ec40000000d55a7fdc7ff35d217bffc450a41b59a9665eb604c729fa65b33550f16287304f71dd1119eff07303c3239a3175e44ba3621c1bf86803c0b456fc3a5b0ad0da50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c5ab6ecb130a596c6245353fd245f000fd4296f7de1854906918fbefce798e19000000000e800000000200002000000027393911522cdb2c2c5f87874138b05490c4288c9e57ca85ecb7a3258ee8f30c90000000c8e58e8aa61baaef667c4adb661b9bd05482f1a0679c93fd23794b5263148f529dc50041d202cc37d22151c7dce4a5f48889d456669d98313a95be033191b6d2e841530daafcb8d96de618d3030d964971996dbdb1da61f4411beeb30b8a8b75a2b52e3b3b3b344c64bbeeb98983aee9de22c719f76b209586f254c00eb9ed9ea2e5a5a3567ced82601f01a34995a1e3400000008a1e220def048e2063b0a0b8e625b3c05c8073965b1a3a4d83d5269a578ba37b2aa6a56bb577af0b8dea6296a0afc23ec74e86b23e3941d1f33ba07dfa57eb30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B744091-1346-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421999732" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20094c4053a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2532 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2532 iexplore.exe 2532 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1272 2532 iexplore.exe 28 PID 2532 wrote to memory of 1272 2532 iexplore.exe 28 PID 2532 wrote to memory of 1272 2532 iexplore.exe 28 PID 2532 wrote to memory of 1272 2532 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\499f6649a62d7a42791bb3657ea9de29_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fafd16cf63d2010454446d1865a1f64
SHA18d8607abe059919b15eb0a75373d736edafdf6d5
SHA256caa2f90f85ddd5fa9af365f5e33ccf3f9f8721445e4fd6f7b273470cab359784
SHA51209a7a766ec9489af1e83008e6275ee033a4e16b7d93c1cfa70812e03b48e91fe46269abe6a37ea791d1f9bbfb5e47812f176cccf70f16ef77675afc1129dbfda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3348f72ca00ec358086c95d7ae5989b
SHA116ecd258ad7ec59fd00b2beb476f7cb23c193dc0
SHA256fc83a7dd38bd5b514728264309bb1fa2ae4678e0d3c57212c5ee3f56e1fed2e1
SHA512e9bbefe2a0ed5b852b4426772230b525536e4c8c790c72a5d4aa389be6347233c36483b2db132c4a2a583c0927ee07ff358357639022c708df2c035f0eb6317c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522f3b189d31e8891415c1f65702e03dc
SHA16e077944a50abc5b6a49a4c138a379670a43af03
SHA2564a6c463ff82bdd01225588344cd9f5d81d6ab45b980cab62cd4815704b97482c
SHA512e05a694cfaace0f411339610c30e7aa9f80992f7b1e64382bfad9c6f77b50a80ff9b699da78eca57cd32f2cfa0991e6a36f0dd3a5d954b0b5593eb2139a831cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0d32914df59730230d2355af453679c
SHA1c78dfc20ff9c86e6d46585770babfee5e75b45ff
SHA2566d5a86ed6f2fbe70c67a71cb7ee71d4b9787a648fabf4c22e34d3f2fe8c4cc4c
SHA51270031ed1fffa4ca075e99ae44eed4e9261b31deda450c87f8980634fc2912f6fcfbcd7c100c5953a0effbab62fac2d843cd57e87a794bf60f45fa7aad3c157e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5813b9b9b0083a8b46c67aaa0c5a0ac62
SHA1ff74bbd9cbf71e693588b00b4e524703458e8024
SHA256249a64a762c270d342241508ddeb5ea1b4546fdc74ec4c48170e24c0885a7997
SHA512053e78eecc3814cc5369b98ddae984a6eefac3576f523383f96f42541041992ca9c2187fa2403c1ead0da27a4576c8fb852207ddfc0c0cca167a6e4917950a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be0f96b32641230f1459c3317ba44c5b
SHA1a2f4ef7d01124c285b0dcf0d4fb586e799e5d36e
SHA256cb36d62192b7885e8419135bbd2f002ab22ddeca82cb3bcc2f1941152b6b49a6
SHA512291643036457be3388ac91a90e0d50c1b839d821e326d9d5325f57eb2b50e2fd530a2484c36a64068c81853145c9208f5eb9404248a51a8997fbca31169327db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529eb0eb44adbadc6da75f465899bc0dd
SHA104c2b1f7f80229fd3d452957ddf0b0dd6a840b37
SHA2562510349d0bb93571d188798501703c338b1941b7a494f1e697acf476a6eed016
SHA51277e10cee8ee75946b5127572ec9de1030fb13c15e11d8f4f7e17ec34a419523c396782b23f259923a2288ce82ad2f6b2b9ad7f7f878214347e04a108046e9479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e50068b3be8f0cd176f829b643c7fcc4
SHA1532ea0e67ed77307a9d3917da97e64dd12f18743
SHA2563777b7e113346af592522edd7c4d2709b6b50e44961e9fd363e412cf11fb190f
SHA512d2c353bb6ef5b46ccf18d71dd73373fc0b4a337bc548767675b311f29ffa4f1c30df99365fc1f9f0365b6e103e6423a7b95a2469c4913a3a7c8c0dbad7b1f3ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c61dd17c3d2968d3f62fb145cd4c3bc0
SHA1641b8e25a615280927ab3b2d3ea1b95e00abcb79
SHA256d499c34eba4bca0ca0ce68fb2d2f0c6e60c0b5fedbaea5ad8d2d10c7897d1989
SHA512e39a4d9706b44e82cfe7598fd981a40a5b769542229dea9c2612b032b0b81cf7796f7ccebf0dabb272ac454c597a3bf5e876ded7b1a7a57bd3d11b251f9c9ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6734d2bae69ecb6125e6533a46cc0eb
SHA1f19290dc108b97abae1c7a75c358825e19c6b072
SHA25631b77d70e06085b48e1eac3bdf80fd52ec743063847820d7b9e23b7ef7ae3847
SHA512510264fd1df3add117c8b52cae3904dd5b6d66146b504248ad07a355a30dfd5386ba1511a9660f92f472aae4d76e6c132eeb70d38d38f59c36236959466b2dc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523396b43e5ff9928f1a70f270e672291
SHA17d96ae147d8690355c92e3e7105f2d69c62ec300
SHA25610a9bbfe6703d1516b3c0f343615ca92d7810a4640a070dedebbbb976b33d168
SHA512afb9d2cfeb55d6b0e7dca9a886ee621fa7d44391bc5068bf47165eae8eaf91acc80f855ad7fc764f743c39111fcc3805638607a8a8f40958a3257fa234bda429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57857e8946fee3d3ab5eac8dba6f07c42
SHA114d339c15763da25303a82874917b840a8e343cf
SHA25627195d77c38fb0da275a6ba0559d0532f3952840d6750d87e6ff4234a66039e3
SHA5128b43e6676df377aefce83ccd76aa4547764cf65fa01c5da3b3f69218166dce8079165c59d6e91f75714304a95ebeff033bea4a7050a198087765c8108e808fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5046331952ea58173254869ac29dc997b
SHA151355c92bb48ee5ad6aa3cef33db3455622f639c
SHA2565e31370fddf55b0db38a7660953fcbb71a55100fa9fb5785d03041274f270735
SHA512e9c3c4e9314a1a58da5e8803510fae381676c31151dc8f39fddfac37d71f7b434b07fbf8e00140d7e0c7f01194fc2125d82e9b3dd89803a360ab5c5ee7b9ab82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d48107720149828b703a29a67910f208
SHA1a31afb8a23c4e18522aa56aebc64cfbc4c684f46
SHA2566a87c4c3d821783d23b8585e2a3c5bffe6b0ecd1aea83ee638fdfbb2ea7b674e
SHA51231a3b14ded6af78c9ab603851e5797b9917a949a6e79bb68c3fdbc020cf59599a388fb1ad45dd7642f312a3b2f4fc53adb145096f364b7478d71f9eae83c82ab
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a