Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
5c6374a24ed1dba971f5c494d6e1e3e6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c6374a24ed1dba971f5c494d6e1e3e6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5c6374a24ed1dba971f5c494d6e1e3e6_JaffaCakes118.html
-
Size
4KB
-
MD5
5c6374a24ed1dba971f5c494d6e1e3e6
-
SHA1
2d19766beaa9cdcd900a55fae9a603169f7b144d
-
SHA256
b077a35bb4bdc5b5b58781a28d11a68e4961a3535adf1d89689f775042956d33
-
SHA512
17ec909e2ed4e71b896f2592a67f120b81fde9ce162f2c998b37d878197285adb5fa6f12247b30a780573e22f8adefe3476e23df944febce88407980c10b7464
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oF6gKd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f610b251aada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f8637afdd88c4a939bd7bcc6ecbbbe781ac2898c38d648e9b555e49af106fb33000000000e80000000020000200000006c681683c24e8214ad53d4ab2ff43b4d71ef749348ed3bde98b9af2871304dfc900000001f170cae57d05f6c8b4ad64933c717e96bfef1ec9be12d5042a36c4af102e7b68c8e9dab24b9bce017318f1ddf5b96bd3ae08a280a4be685bbd76b694b10667f449e2f23225406849638582efca26991da961ee6d5cc3da678d7ddd588c1eaea5ed351ba6714dc9018a176142eb249d01838723668e3b2f0871d5ca0801a8fcd2eaa222ca137f0e8a23aecbd51a57ef34000000099b670a239e2e2ec36a5fd22499eae274c40422a4b91a1163764408d525062ae5cd155c754035a6153783f5c5eca7c1bc2a24e9c9778ced5f5c0c8e4dc04a5e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f2797081e661c63f10ff8be4fec471a0c1033f6f587a67c1edbb4bb598e2450d000000000e80000000020000200000000c714d1ed90f0b4989f8f8c85253391ede9765e30a3b52772c5f0cfe8ed4e194200000009ecb85e39e1b7833b70fca8366de1eadc7e1f48a4f4128343b91b87fa14bdf5b400000008099388d4300eda23a42c5e31a6cc22b9af922eb4662e66e8fd9af2c52c1c4baf1f32d0774ff89fe6eed5acc703b7f8efbee028d6bb161ffb81ab080954eb829 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD9947A1-1644-11EF-83FC-5267BFD3BAD1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422328919" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 iexplore.exe 2724 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2216 2724 iexplore.exe 28 PID 2724 wrote to memory of 2216 2724 iexplore.exe 28 PID 2724 wrote to memory of 2216 2724 iexplore.exe 28 PID 2724 wrote to memory of 2216 2724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c6374a24ed1dba971f5c494d6e1e3e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550d6e2505005b6c06790cf0d2bf4d8bf
SHA122c544a86d723580aa963dcc62b526066f98083b
SHA2563d91ece490d68fc5d58540abf3e4a31110418acab72281685ccdad284e2d2057
SHA512f95597452d96a2f3acee7511106306ffd7cb663fd1fb189c8c94f8942bd88eff9c9427a1255674d3c2eba023ad946536f80d438286edc674b171ea9e05345fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5085a6c13d8273041587690911a717e35
SHA1c31d012dceeb0334097b877bce71fa2c7cdb51bf
SHA256dd6c5abea7da51b91f471301758d1ceed68599df27ce61850dd96b90228bd45d
SHA51222421060cab02134613de257991fce478c54cf7e1587ef8101aa301ebd33ff8311aacf9baa64db5ceb158ecf67eedd034b40170b16364aa5ddf604cdf69d4a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560a5967216c9fe57cef13c3c405b0d7a
SHA17e66c45b7667eaf6a395c225ced12f2c5e91c742
SHA256fb3a9a40dbf01ae4df61235743c96172f9d6aa4b8bca94c6e2c8e5db0de7d4e0
SHA512657e6239c58aadca6d13fae56b1c50a42e7b6cd39b0ecc8eb16171988047ee186d5410262aad152a13e26275b5d1a7da58790e493a91e881e12a94b114835210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56afac79eb49e1ff96d3125934b172070
SHA19d865d7ee7ea73c18a284eebc12a2de61a9f6649
SHA256a84947030f45c30d57ddf167089eb93d56196ba255f188760d838af3a66abc69
SHA5126ab3c078cf45c8a529259c8f3fccb7f86401e6f19d75145fd1330e516e471ac2c6070be435548544cfbe82c834f4874ab2d8a81f298e0fa6180e2f60ea7b7a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514b4ef268207311755577fb9c6610f6d
SHA1ae82631cf8212067959cc1375b1948e52ecd494c
SHA25689951e2fb51be6e76be0363b1d786380bdf0f6cc2a10467ea927366d9d75afaa
SHA5128fd005c1f5446b7c69438ec495ff19fa0893190bf0f9006f30ba43ccfa16880822c9a4e152d7b429af3bff59e9bb95046cc59a1a019e1c61fed66843991e12f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557c14cca8f2a1266a13f305de1d3aa21
SHA118bb06dedceae54ab1c74e90dd07ab1c1296e3c1
SHA2560e5df41a0f1925a73da0c1f1d4ff431f8b04825b979aa5247aba672dda90414c
SHA51235a6fe235badf71ab37974703e91d80fc1c24935be0f291d3bc3149d6a1f238f91efaf1598ff26de22c8cc37a389c0eb65fd7da75e833e4a14783eb1f683bf16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2f466f14c4ed99b75d7adccc37322c2
SHA182b677ced117f3c56b9c4867df88c935ac20980b
SHA25668ce628dad1df162b5a34b1ab161197f800b0ba50a30c5b392b70fb0108cc867
SHA51290cbc2b977529878ec12bc09b8847f5e9ca2c2645f5b341432b915fb42421fe41b89a5b0adb47b1ffaa81fe630a95cca6900b6b776bbb9c4651f8c92a8f6be0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543292e6037ab98153629730a10a85ec8
SHA1707477943af9ad8693fbf2c5052578641ccc1383
SHA2563ae6f3e5c2b77fe758b58e48029735819c80b77d56a53fb677c9520e7b929fb1
SHA5121cb233e0c4e5d34ee5b0af6671663e428a382fbf878c45b19887fd019eb48be9056d66bf08b7fdfa94b944a026ce95d13c71f276bd5d82fe3599f5c60f325d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee23b3238180934592d5bf49d81cc32c
SHA11dc1482687bcb7fa88dd613b4409e84dc070335f
SHA256e712a35863ab75b2972db4c838ffbf73e8cdef68ac2a403f6070f06e1988ac2c
SHA512965005f7b2c6fb2e60fb7ac70707df91458f8df8be8ac7c5b8e6a2fe1a14c0a7229959aa97ef0884cbf479b420947a6bd2affc61333874a0fe5c1295fbd7967a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b0788d9490ef755906e532c8e4a6d9b
SHA18efb3057d5f8412bfa98094399c699c0f400b8a8
SHA256e3624f6766aaf3b7988aff30a33d71c6742ade74eb616ef47739207ed24991e1
SHA512d4a7fb8965953ef5973b55642abc6f1da897564d58cd3d270f2039db723f0a4ae986d3da996662f14e7df240c997e134583db2b55f44ef6172beb18da64b8272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf635840962a3efc4d716aa1607f6f74
SHA1c65489b65ea6924560d08a178620c3b5423cd8b1
SHA256121cab27610e86ffe89512047fe9bc1ab8a53812f1fd12aca571c33fd375da91
SHA512dc4e084631b9c656342573b26806ed5daf4f25e538775c98f657db6f2800c38315e7af477592e1e4e6cb21d261236e9baffa91be0ccc84eea8eda43574a7d513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f135eef6dea096f1634680c7c480574
SHA14e6df751a89f78bdbd4688f44c8575b97eee6534
SHA256368f7b2adcfa22339ec4dc5387acc4d5fe8fb61b0ff6f198c39345ae2feb17af
SHA512073dd19052aa001765abd37b8244609b69b6d6fa93807485f2547c37befcbc49435df7b7133b0ada5dbc99b7fa68581d9192e6ba2bd3739da4b087b114c1d658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57630f5a5f593c0ce0e5a9733869e4d44
SHA1feaa16a49ff7b59c95cdd4734934f1c2d775f186
SHA256a9050b7621b80d74d4773e433c9ab9004f5325308800b113b1d33e40de466fe9
SHA5126645cd125e20aa67dbdf3895413c1aa0eb2369b48b14476f474c5d33c42c2aabf8cccef4cd823411bdc99b4f164a9cd6f8df2215add8fa14af703fe7e39d440e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da2ac4b6c09f29c1a3f1e8f2f90954df
SHA16cdb5b4ff7aaf480d222b798ce9b8bf977a054ea
SHA256680d7828f524127ba5caa56418845edd5ff2422e4b1a6fc6d2e61df7da50af41
SHA5126b7ac41ef96f2731f7f2a0d5353c484dc6492e2c4461dd9102f80031569c0ad58fc488708695b8e78bf8f68edc66e65b0437ef6e8a7fc02892f82b27e650bd08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59801c48ad4531d27aee236bbc76881ea
SHA163720f5f6edd1b748ba5bf7b1d1288382c165a37
SHA25653151941ea46fab58e1889f4b6e459512e8ecacb7132d771d21538b1a6c2781c
SHA512191e090b4d0c10aae3fcf5b60461a6861b4180f672c46d240efa756e6f3f3c4e773e8dcbfbba88ae532a57af3a04f57aa98228f068bfbc24d79a7eedb9e26e9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cda2c38bc26f02062b3aaae27a1df98
SHA1f6558a293b49fcb54dc2ac0b4532bb5430e5a1fc
SHA2562a753e0275ac7809809e7276ec6fdd376e69f991a64ad62e1191ce3523173a43
SHA512e314376076c2d23b0add2647193deb16ec54ab7369819c55ee8b11737e0f3df08a980b3af4de0a77e6995cfaa8b66af42b04bdb1b3eedc9b7bd01b7c461b67c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f661750d2b5a7bf7d508831600e44c85
SHA1c25f776912d45ac36f36799374a502f60ff99bb9
SHA256a73e49a64e10965d0e6b4a81cd27c304414d5c079a2caadfa5d44e3f3e2d3b45
SHA5129229e52a0afa9be3f24ed54a0059e22dd8e113e6787bd4522d50eef91845593af28ef0485b74a425e1455c1f26d87533b2b7b3856aeaeb553a48b45f17e12289
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a