Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
5e019ea19992ed5b040f17815b40aede_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e019ea19992ed5b040f17815b40aede_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5e019ea19992ed5b040f17815b40aede_JaffaCakes118.html
-
Size
118KB
-
MD5
5e019ea19992ed5b040f17815b40aede
-
SHA1
1295e03737ee651292a6ff85b58a49a9c623aa88
-
SHA256
7d956a6979e7982d8427553c9448298f8006b329a993daa0295edfe52f232002
-
SHA512
5a18502bd013c449bbc34696ead4f04e86002475ba8a5c2582973e23052ee05478bd70312bb0a78811c7a5c70f2af54c583a1255ed4f1803e91d985170b5b01e
-
SSDEEP
1536:SijRTZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SijRTZyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422354160" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000087a58003f8e9d0251707b328bbc502324d86885289f2fe83dd6c9dc502e4c078000000000e80000000020000200000008f769b3c4f3cfc35d5f45be7b4876ac22b68b2596f986ded81fea576e32b7480900000002244382c85796fb48515fbe7a9cd35e49726416797da6f0ba92151901785bb2ea7b66352f799de991afe4741c6ffd700ed8379f5cbc12c7c6aa48fc369c7068f237c050187b15d4e13deb418e28a3baafb450c078a9301521ff96cb7085bd86cecfc8a45e429fbef8b5f474b9e3c304ff15ebe76c870a733a482f0bce5dd2a16525d1d344b06012f87d7148b4d53ebed40000000d5177b6078a8d1bcbea1261e5b833c9cc2838a595cc03ea99f25da92b7a6073edce72b5a72fcaf469be08cff90f1fce72826c139de31b5c15a9b783306780056 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307e9e778caada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A24C0761-167F-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000738fdac4e85fdc65d5d7f0d0916075177b2f50da20126299ccf1a69e3e2bb380000000000e8000000002000020000000ff8c036265bd92206ec8d089e7614035b4fc3d90aa0102450ebc0f1a8141062720000000dc6972d8db09d9942dcac9f059208c43776d8c29d7845c976a7677bae7333aab4000000093937883959413e2b6c512f5cae3472f9eb0383928bb8d0f8c7703e585aba8cb61f9b486e488ca2bee00e90fa099200bfa218ebf8152862b8af4bb9395bf4d1f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2804 iexplore.exe 2804 iexplore.exe 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 1392 2804 iexplore.exe 28 PID 2804 wrote to memory of 1392 2804 iexplore.exe 28 PID 2804 wrote to memory of 1392 2804 iexplore.exe 28 PID 2804 wrote to memory of 1392 2804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e019ea19992ed5b040f17815b40aede_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b9ef974780826a4e98b8d24e54298ed
SHA1f64cfad9ceb25776c0d858f87b9d46fbaabe23b3
SHA256604e93b6bc90283f3d96fb6e85c058a306a31ca710fd6c14fdd2709a6905dd4f
SHA51248f0572a05eaf784f44c189c3c9887a4b731421ad31d78947db4044c7fa2801fd38938210f423c98153e686d689f4a811f2d1b74a541e348069904fb7133b51d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e10c1babf0539416173b0052fa875a5
SHA17f084e252a0088909c00f5fb56ef294b50a2c76a
SHA2565375e5b2b7fb0f961c45f5389fd38826e23053c19b0a69991f976fff89d1ce10
SHA512025a211f86f45edb320a7770f70df6d072e7b824c434d51cb3aed391c9f3c174ef0cc3593dec7d378e8b76a0a2c0199b8c0d6d92a007a981ee1f20d42e34ef9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cec93d9e18be7c05ba83163c07b93ca
SHA1d3383cce04de9c5d0c0ddf7a229aa8fbdee415ae
SHA256ebcf466aa16c5baf86a0dba06878c477a40e50a8422ab88f2a41a2374d6a882a
SHA512fc69782f3555e968220590e4a67ae865cc67cb5971a94fc7c850a65d3b98692c12407765eda7a97713edf4b04e748cc3dd05f19c413ccfeb37fd8a632776bd54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511934ccdf79a428696681ea6a2fd9f29
SHA13dfd9d4525cab198eb0488431479200e14a63bb4
SHA256b449e1b5371b8307edeff34ebe3094aa2691065911d4f4e317fc2bd40f766379
SHA51240fae5f4b9daaf7f0bc3aafd0591442d1d59509075371668a541fbb9a49598422c7768539fdabe79e2454fb8fc779526d10d5c67df006ab805d37b767f60dafe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539ddeacecfc95e039978328ccbb891f0
SHA1eae7a05f84f8d21934f2f8185768b7acaf92f241
SHA2560aacd6c9de3ecbcbc2d06a4ab41b6f8ad687b363fe59e95f977a5702f208a77f
SHA5122e7bd2cb4c6b638624fa363b3a45817dceee5e757358a5a1975f5c17856c3a96b371989c6864416b413e1fdb5dc3e66826d51a980b74ec1cdfcc17e73c557066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5186108b7e0ba008540a928867f5df587
SHA1ecefbf4e22a33a5f4d893a11bff3a0b898ec6cb9
SHA2566b41543f2e6a58fa81fcf18d0d29b7a107e35e481e5d262f584dd75a1efcc79d
SHA5122a42b6e16a848aa3599f9e9a9aae4922bcc242044852c5e6d036f149b2c0c500bb9cff9d6cc6b46fb1e3b3b65add4976dc67e833eb9a60abf199a7c6b9120ef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e88094373f9383852eb7c7ee8dfb689e
SHA137536f7b3721e799c0134094a502471f9b366a55
SHA256ffdcd2f01803e576e2039e6d7e9c9c01e509552b5a9d5038dc1ce2d90064064d
SHA5123e03194098ff110826bc95feabdc366f5259adf2c1e881c308693157e3b995b389319698e0efe7c2fac92225ff0ae36c96e58ce393905b232237d4b68a87e823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f39c551b8acb4a485a7a0a32fb5d380f
SHA1cd954aa6e9663d6eacb5f4555ea694463dafb236
SHA2569a4559deecee1549a4f544e9f84053258f5bcc4bee23a5bb82ab6aed448baed1
SHA5125e16547c4e92a5456b3dc7f430e79049299bcfb264dba4aa094b97fb824d3ba04ced189ec8325a1635294227b7d5976dc5407494542aab89ac6905d9a0347ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b22f073fc8f14128ad8485dfbe3b8c7d
SHA15f438164387bdf9512499f629f95f2ad08b5bd4a
SHA256dd482735d987ae40041e909e365a717bef6eb4c4789b161d0d4d6894f53ac855
SHA512741e9d4470e6601dab1e6e36b4e2ef17948e6bdbc323ef01f21ae9127fcf7180ad374a00fec251936d3c892e8e1d11157fcfcc232577df3cce3c52ee1a297dcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a8d3872ee6f83b1507c40a580363210
SHA10490cc3279d0cf9598885b50a10e6dc77daa1adb
SHA256956edc4c16da2d741485a39c4607bf11588408916bc958d8ced83e2dabb1231f
SHA512d9fb03b1cb16938b4bc56d03c882740719a3a5fab3b253e47f4687323d1526940f5935a6ddc087b53ea32081d2ce39bf2b0d8fff0225836ba1f3a7e97a1707b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d86f524bfd0476f6cf31795589d1029b
SHA14561d7a30d64e9523219efd668b82d9e2a983ac4
SHA2568e7e977fc9b0ddda7ceb9cd8008d3acf1e86de234a251b6d6154dfa269f851b5
SHA5121e1c9766029cfc38fdd8659bd6f86dd10c3c2a725ea812dc6d0933909d525df29986230dba0cbcc3a9c95f5a01d0d02ca681d7071c11b02df38cf98036980a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f41529e05ccda1e244d3206723b496d
SHA143504b13c08d55fb199c510fb29ba336b4816d7f
SHA2564822ba075f8f31afdd5c8696eb2ccee90580eec26558196758a2cbcbd0a6c508
SHA512cacb40eeb958cc060112b09b6dd619dc4da7a36c41a4ec9e30da4ef9fc690d9eda7a4aa05a9e692424410e08a4b5eaf8680f0dc25bff8ac1cb84624d75cd7b0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec7496e528eb8d435242850d11652865
SHA1cc18ad43da89f39ba73e8e1eb756f986eb93e19c
SHA25683aa00bb61751599dd6cb1087d41aef4bab78d2a89d997f37a729bbc93d07b61
SHA512c4b5f73ea01e9292bc15447c7092fa6e0c16519d3c4314570d615473ddcf6edce5fc5f8ea946554475a90b1f5980f6710b32132860da34821ec89846305140e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d73c804851fc3ae0d643d328727f52f
SHA1436080c09963d3cc096a020fef25d681fbca1c92
SHA2563754951fdabb6160ef5aa59379bb8ec62170262eafa4222e330f4e6294e73e5b
SHA512ef9fb272631c504de7cfd8006edeb69faf0c964e1a68f91989edc3a5a0b81a8651e4607335b626f5e20b75edd989d433fafd2f555bc9f8c06657d6c45988f1df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac2ae08b88662383482d4ee65597c39b
SHA118fa597b0a84236cd6085717cda439d1c5db2fbe
SHA256daf609a0b9bff0d195d79ce85f05296235b517868883759fe2225729b6f571c4
SHA5129332d491c69a6432ef826ae2a8126dfcf9e2004cd5661257b7dffd6686bdb732568f90e405e3b2643d6a9b602f2cce4b9d2c795a4eef7b0048825d55874f62b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591c2dae25f441cbbc6955a5d164ab507
SHA152442670cb578cc6e66cdc26b9f4dc6791965a38
SHA25697a9b4667c10627822f2db1ded5666dbd8a54dab360b2354a7901d8cc2a53c2a
SHA512a84cb356131c69f09e0003825335b4a263001dc032d84426e3a3309d785c1226315304b1c0942a4f49e36fbb9a10b3edee5f5e7237e04ab10357e35430c0d22f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a