Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
4b313114aae6d7a1513744859393807c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b313114aae6d7a1513744859393807c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4b313114aae6d7a1513744859393807c_JaffaCakes118.html
-
Size
53KB
-
MD5
4b313114aae6d7a1513744859393807c
-
SHA1
86ec5ebc4b4e5859bc2e7d2725100eafc46879eb
-
SHA256
b6abfb778c1417eca130e87217be1857724faf1fbb4761385e62d34833571060
-
SHA512
5f71da1a69921e719e2c73c88cc96cbcf2d221a0a9ec17e7d085bead128d25a6592c7b36a9136d2399b258b56ee1d9813ce4e6225a492f2c0e3e62fae6b2ff67
-
SSDEEP
1536:SoiMcOvU0+yHjc2HfeaiDktVzlUKUMcd/aPFRGfkn:SRROjXP0di9KI
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d499e98cc388cd88853132dbfe7ceab83304b57ddfc94ef3aeca49fe8eec6fbb000000000e8000000002000020000000e35cdab8976ce2064ad83f2933a195bbdac1330cdeb804f9acc63867d9dbbc852000000075187ab75b46af203cf84ba2e7e72c6ed35b7219d426c9ecbc957a878da21e75400000008804bdb65be916862cc961e0551456f56d631020041ce94e2bb7497da75fcf8ccf0731aa6ed3a1cec204b04f1f9b0c02d4ee352c88cd53166b4401ae5a36b8d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a98bb5af2abae781f12bb4db676a8cd6d9f029320c4f961f6171d78d5288e8cc000000000e8000000002000020000000ea5fa666d8d8e170d8033bf31c7e901138f0f27c8c9edd0bdb751db745c07dae900000007c774bed1ab6f7a22ec2f1bd6c221ef171f18d5f81a08bd9cda9e2e3455128a35579e12c858027a27dc5340f6423db9507e43076e752b6d604ed2a1ac01fbfc47c3bc5def063a443f57ae022e15a3a38900ad82906e05c7fe16905eabd76f1436ba6e31564a2d1f0ab273d36ae3c94f4fd927ac37fdfa04b51d333804597223b97d80f3e1891c2a09586a47b9bf5fffc40000000797d06597cd45c14ce76c31d96d97921c081493af0df20430cf192b6c32f50a4cd2cd37ab23dde40447f004666498f9d5f1e81da849fe599465a031f9331321d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422026269" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{355EAA71-1384-11EF-B8F6-D6B84878A518} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01f350e91a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2092 3016 iexplore.exe 28 PID 3016 wrote to memory of 2092 3016 iexplore.exe 28 PID 3016 wrote to memory of 2092 3016 iexplore.exe 28 PID 3016 wrote to memory of 2092 3016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b313114aae6d7a1513744859393807c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bacbc0a39dc18bd6b33abbe8858578a1
SHA19044722a149767ca6a4e90b175d2438c1df987fd
SHA256fa0b53dff7d3893013619a7a6173318d8a96003581a8fa1a1251cb37aa1bf0cf
SHA512b2e07181c869e503c02a8befcb4b9c7f1efe6c167510e3d48a81ee4da1eaa23230452e7cfdb25b6b391eb1c7539dfc76f48225e2dc43747f49808d6a829a940c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da7e6e57a5dea19b80a72c9ce01215f4
SHA142a12d5cba820d58fbae7ddb6880696e1802e68b
SHA25648898e53ddfafb52861f53eb0f21896e532a62c9f181c8b58e61b8ec1c199024
SHA512c961b5c2286045cfb7095ef553c048c56050c4ecea95300013f0ffe668299975ecba9e67714ac725dc0c4962660bdddaf3d2ec0fa98853d48225cbf3278158e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edc1f6d8d7adda6230513942e754e1cf
SHA1e770ec0ad07420f4bd66d1a56c9e247bdb162305
SHA2569cb0273441a44fcbdd899fd4593915b5961be1929c2512d5758d2c33a09c888e
SHA512e020d902f27ad8a37cb6e5001787f5caab1d63b7e5ab23034c8433edf4d15a44b78499b4abcfe47201be9ad5933c0c83168ab1b41404acbe2f937def37de03cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584668744c07ea4a663456e3509d54781
SHA1be77ee5abc37a7fdc393920e5b52431b881c89ad
SHA2566345ca408d0f58518fa2fa34d81ceafa73c3a84bc36ad5f1aaedf23d9cb137a9
SHA5123dc5d44298c3bc21e0349317dc460b4009e67d315d684f5c238cd4c4f8bd4c23010a98b84229cea5f73017485e5f32e0a97a6c9b5e4e76f878cb2d4ca059f225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59055a14d9286c06c19275abc346f2f36
SHA1ff3b613100272c12eea10d9504026514e12405e1
SHA2561265b41ae210ebc650b1dfe0cb13e9aee97212639939e5e8441cd191b0cda349
SHA512121f3c883e9e0c4116ff0fba36a3a901b5cbc7c9034884510cd49c6279b1f96cf07f6d25bf092d0c1665830f492ee20cc6d9b4ecd34908f0006f5ee3470f10df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbdd0e6421d12d4f3cff034c126db2a5
SHA1aee1c1919ae9cf9f68c01c556793def4c54061ef
SHA256e249612f8fc32c048f80520e334b0ece857e7544fdbcd0dc219d75904f704c26
SHA512aa7a67814406bc5aa736d4dd6b2296438afd30767f67ef5ebf004ba52c1d42bd4663a76e651e3d33a2300a885b127a53488246d3c55e111c32c0bd02f913268f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58acb0acb16705b6d8c58787196719285
SHA1c5f1496579ef07c906b0f9ab64961329f6f09421
SHA256b019593776050965200af757809a2c22ec7eaf60fc1f1b211a3f97a7943c1fd5
SHA512235f9232a3a0d3c6432bc00c4566541671a42d29855b75214c7e0b13788e8d119f17869d070738f45d8b5b3345d84a576fcab97914b03894777855bd84cf07c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5385a6a844d4fa09a22cff9c07f067570
SHA14fad751b683c12c4649d8ce48c65b1fb2585e1c9
SHA256d73199f04774f84e322238229c5c32b00aced5f47108c2114da3e96a5981dc7a
SHA512d0582efdf780aa8b2f2db5956cb66a0d9e11f6b5c1f1cd53914ab102a1bd043811f3716cbc308fb2ae4b8e9142d642da36e37453d27e8e79462ee96a1215ee54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50600a36a453bcc45b84559ac61115a34
SHA1f2af3fdeca3c39e2f3a50de4625f2b91e5e89e41
SHA256bcb0c7a28c56f3f07d5da1802c9e9e15313444476c3c6b4b92e39ba2d09ddc16
SHA512eb5ca53fe83c079b3a246de1d052492982a53b5529ec374dd8b59cdc4efe1c0ca669a561687f70f56ec299d572a77cb6aaee1200d2b3c54c37eeafe3c139d0b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce37554dffe1ffe0492ac0fc8df6cf67
SHA1b20d05fb81e0f8118dae35abdd0757a3b707e556
SHA2567bdfda7b7172d3422204cbcacbc4de83908a756d117ebc0ece14c38de9c922a1
SHA51241bdd4c5fe00bcc4f16a17e1d71054bc88a448b2c70caffd31cb1b7901ec7556d0a585c364c2b1c2ba2c0bf4df7c01ff08e3ffe4fb569b511b4e4c273813fa1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569744fb0fbfc812894291bb5dd52ccbb
SHA1c607091f539a14aac47cdd08be926708eab0e8e9
SHA25623ad795d2a84f6ff2a8262c0c3107df418d7266930594339a6cc56b9b0262820
SHA512bee79489120b0e6064ba4b2f5c37fc573fb88cd9525975d9c3a222cebd5eebabd5eeaa9cb4f6a30eb9e2f1f183ba2e35d9c77ed4e799d25ae8b2ed18497f6917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088778a17539cc37ecc11effd9916f92
SHA1030199826e3d836006e65fe1ef90ce505d5ec762
SHA256872046fb2a0d8d0a3e2849d6c7c7c5291a521f8a4eeb0f763fd2f6aebf7b79ce
SHA512e4d912891e267057e8f583cfa6f8e3e07a71ef0a8adc2bd5de5feea5452a481eaef3cd8e24ac7929ca87ed79b3759e94e9ec5448a3b93a1ad228ad7ca34b98af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528c5c2a3bed8c7ab2c7a765c05e53a2b
SHA184dc50b3fe204e58be48a3a0bb9d9dc60c43bb1b
SHA256126a169209c856c2ff5ecfd2f5f2fc2bf55cad7e387c88cdafbce000568c1515
SHA5123e099b358d6aecb797810274aa4ec633319baa8a30593525f55c191c9b5f6a4962f2768e3fbf444fff1f40de705665a6bc7e32507ae4f0ca0497fb3ff3b4b293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6ecdf78b7289718eda3e55fe1af5f03
SHA18a3721f68c5e6b5a7a5c93cfe3b35696ca92092d
SHA256577fdbdf78b30708034b890213cde4887bf205215d5ea725aa7c2fcb3c70fe84
SHA51230f916e293affdd4e83fa5c64e825deb844c849b2c264b53388d1936ed921de088ad0431e6383bf9a2f21ba754570de475b2b71476b5830d8a2c9e201b49310f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cce19faf72f63525a10897f3b91ef44
SHA16585516e129d86c951ce31bbe3f16a9dc74fe7f9
SHA256fadc4076afedd0ace66e55b8013f943be3e4338dc4653b602d6a0d61bc5def98
SHA512df20adc12b630711d4b1ed49c6b136562def71f9f8a6662c710eb6581386ce892545e48a82c935e8e5a77028c81838575fa83ea7899badb50b5842c50e87ac86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fe0f0ed8ae38582d40653391549ee71
SHA12e7f12d36b7a867dfd54f3d025541f378e58bba7
SHA256b06bdc9039baeaec8479dc60ae64c002f819952de88b8b8de90cc7c85df0c819
SHA512d70d18a9eaaf8a948488c5c6d9903f2218e1b62e3a9677a57ba0ce863e29c017e6c6e7a990b117dd24aa91671ceb20404039ddc1475c9098ca5815bfb8027e81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e737ca37e8c7645eb93a35ec62eb3fa
SHA125dffae75c711bb86739c7a06ded3fe100453a82
SHA2560b105f5b8eacfd0fa0622eedfd9aefc6389370ab55ff2d46eb3c77c147b918e5
SHA5126c975afff01a8e944c8bb1db5fe29d7918194386106e4a69d20b60e82e3e20d8392d5d97dbbd9742ffd2a0ce9b8e635e5601b10aa8c40de47fcc9567bcece440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e44d027015759961dcde3483a3b94bde
SHA148fb9cda659991a090afad26891bdf62462b8543
SHA2568d163d55135afb2c82ddc6b04ce4d261df6be5b79368986dbc905dc8f0a94946
SHA512c97dcfab5e6a32b97a64c9e66355fab309e28e35d44ba683fc83149b844fa29a9d78163aaab671d7febffad147d39039a51a95c7ee3aee114d56be1935b02e9d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a