Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
5fa515eac05ccfc832096df012e9d2c9_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5fa515eac05ccfc832096df012e9d2c9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5fa515eac05ccfc832096df012e9d2c9_JaffaCakes118.html
-
Size
858B
-
MD5
5fa515eac05ccfc832096df012e9d2c9
-
SHA1
c43680f40407ed22f374778e8efcfb7b8d81cac1
-
SHA256
12f924d131aa6c6a71d6433210467d352ccd58d84ebf3c88d3379acb902fc086
-
SHA512
ee54c3c885c02f957f7669e3430e29604d58a0daf57b06542802901a2212402287a2d0db8a280f7a495ef06a0a600a9e11e1ceb8b12bdf54cae410c4a0b1b43a
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000065ad1334581c124d980ee6b5baf29ae400000000020000000000106600000001000020000000591a568eb5b783c42d66c081827bc04f73daee779a3b06bbe97e9d191caed10b000000000e8000000002000020000000b56dbbd2015323bf9b7a5803b01353407b615b4536388bb289d88e7684d79a4c20000000cc69a6faae39ff7e8feb541571f17a456c411afee40af6f2ba84d4dd9e7f8e1640000000bafd1d813aa63169637999f9723ae3adc1c727380e40a6327c76da8de1cb2486d6d8c40c9ea7cf1424171eee167212ee96c58024b3c4bfcb47095f995d39a35c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ACB6571-16B7-11EF-B33C-C2439ED6A8FF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000065ad1334581c124d980ee6b5baf29ae400000000020000000000106600000001000020000000ab029369d41e2b99691c49fa2d2dae339c8f446ac1536d09c2de028256d88941000000000e80000000020000200000001cf12fb48bda8cc3f9839a5b0ec2bd8e525a0037c9ac3d603a6827dacb8308ae90000000ea294bb895986d9f5d1afa9d57662809701db820a8882b21ad437f8fac6059beea7cd7cad7e9e9768c23148dccd1eb529c88b7300b969db9a58313229d8ee1336a6d49727840c51a00669d01d3435126f34486f6b74f4a2a2cd95144404fab1d8984d40ec956c3007d06b0a54a8da4845cafa363c8f1f159c2ad3c7258ad2cd93cc3bc96b423e3ffb6a197315c5ad767400000005bd03e77a6aa525fb06b0439d07a02d6e70665d3adbcb739177a604c13628e21b9206a943f301baaf91a419b87547dc6b5c42e8cb180d9bc4b952ed2d6f79447 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a9506fc4aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422378197" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3024 iexplore.exe 3024 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2004 3024 iexplore.exe 28 PID 3024 wrote to memory of 2004 3024 iexplore.exe 28 PID 3024 wrote to memory of 2004 3024 iexplore.exe 28 PID 3024 wrote to memory of 2004 3024 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fa515eac05ccfc832096df012e9d2c9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f78fcb5cc1917c4b6a423b59f58891f
SHA1b850c1be6b3f6db696b4851c09ea720dc7590cdc
SHA25640fb9d8915e4e81746d5ed7656d20862f114e4c7706afb64e555a102d1818739
SHA5124858513cbb6274b9923229b79eeb6ed4e37c6f8e0ab34bf7012af94c4e3b667c6dd5736622001455b583e7a790f5a378a562977bc6fed6027d922a7d74cca4f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe9c1674d702dff5bf571d97521acc0f
SHA1abd80d3077358de2918785337d09fbbf5063639e
SHA2567b079b699301437feef70de0eeae3ff1e4a9035907934f2308c50c2168aecaf9
SHA5126d671e9b0d7e27e2dbbe45a0e311673a549a8c0b30b197a4c6d1253c629368b862663a67c6ccd7fcba2bccb092b3cf189057bd58aa03c7a41d8832a74ae15ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5527356ec7ec4e9f380f4ac1bc0101ece
SHA144b52c111b36cba822fe3a2966bd199e6aa11103
SHA256114cadaf6b4105994adb3a230461521d2550384dbf4d474efc9a305cc2736e60
SHA512bb829d946bf764c556778450cfb61ea8ab19270785a26e995d77a9ad59c6efdb8377a2f9e0609893ae2f17a78a16a316e59a7815391ebeae5a42c086aa2a07e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a08925c8d525e637e355f46357cc27aa
SHA18bc456243aa52625f22cb470cad680214a39daee
SHA2566e85410c3c5e1225ef722dfcd3e759d2c15ad805b3eb90bd3339c909fd7bd01a
SHA512a3cd0e82fc08204c6c02420c40b13fc102a953bcb15ea4dc22db2bd2b1293b0d6923c9caa40d98cd76080f6cd30bc1253dc91e70fbd615e29ca9f2fe0b088393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554ce353ee82b25cc8581643b8434075d
SHA1d41c1abd49585ba0fd9de5de7e14b3c1e2175812
SHA256e0ff941b1ab513f96017eaa07a931e43ad037d7bfc6976509681389d58380625
SHA5121d48e08f751fe92066c17ace1f66fb3b7499d51b519ccff5bf76a1bfb6459a04af6561a53ff9152c8396b56d9b5b6ff4282ed7c1d7169405f396cfc26f9b5633
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cdbac29167275c866979bcb566a4783
SHA127ab349353ef33ad51f7b7102a531e1b6e10a3ee
SHA2566a1095a20cc8c56d4edddbe7766bbff47141285556fd8046733ad14e7dc7affd
SHA512af6689748b45beb439ff42573b54566d7436300ef5fda575befbe93783f7d4859fad217cfb87114154d2229c2958fcda4ea64f524ce388c56dc102a6b753ec23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57522cf18b1835032c43d198156b35ca4
SHA1c7c172590d21de5894c4dc9a2bd7673d5556dfbe
SHA256b5a5e7467656f3ddd44d598f2fce99002e0e8f9ba64fddbb7dc8e0482b8da0b3
SHA5121b87fe2696e37199a6ac510208b5af3d90b123cd12effad1b3260005c604e0fa6607b984c80b995b0d721a390d767ed548f09418e69e2c771552f0bb2e2d6148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54163268a96fe49ac62f681b73c08c749
SHA1ec64d4f32dbd770c9f22fd338269cb5091ccc526
SHA256f4841b865fb63a9898a593da1514f1ec7ff4368bce56d30b8ff4b434b9c57fbb
SHA51266bfde34a9000b62a4b3fb33338e339b5087af058bfe8567b0390839b785d1bd64f0f372713ccdbe5db29cd93ddd144994e7af705e764e49bb5425c6e3c770ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f39576bc5eda336057606a6016834313
SHA1a719519db5aa82424732eb67ea0c18d845796b8c
SHA256bb94d01836a730fa0d0f98d6c7a28072136b7125ff6f2fab781993d6fc0ba8fb
SHA5120fd71bafbeaa3101583e4bd12112fdeca896ce20d3d7d0ed805126fb67fc820645f8812c75ad19e1b152314606bdd897b37edcb543c82fc9503610cb6c5cfde6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51189add3799555a9fd9793b7669b8236
SHA1ef59f95cef62e3774979e38df16db1de1da1b891
SHA25651ad8ef71e6d2927b8cc35cb2e80915742bfac9bdf6bd305a00a36587c180880
SHA5126eeeff3763c522eb9c3f9a4a5229e9169c3c7a94e6506bc062884c208e0ded40c53ed918e8a5db69a43912fda1d4995cfddd9f3e7001425aa92d79f4381d4adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a6c4f2e2e13faf11191dd5148324224
SHA1fd65db3ed5b58b1a8e6b7da1a3138b67ac0f1ffe
SHA256bca08163c43bd9ff850d98927d1b58afb7e7620cdea70e1933309c57a502bd4d
SHA51277bd75c40cef18efda92d2d250e220be194a638d939dfe4fd5a9def121fc1dff167c18afbaddcc245a9f98e98969c6f12272d64bbf241df167cc73e714757742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea173e959aafa30bf53d5dcd248db4b2
SHA1515faedc13db65b673cee03624f22ee017645fcd
SHA256c43a48cf778f14196407dee6589bc1fe6f940468eeb82b379a53065795d3f409
SHA512a0c1a805278721df3305c2250ef7102eecb78cf9e89957a3797b037f24ff4f117a5c34bf89c53483caa851ec20a6f04998a2732a0e556981a81294cd97d438e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509621835508fde1da07762f1fc4871ec
SHA1075d4baee4dfaf52f35bcb78505e546b345f2bd7
SHA2561cbb620a78e41f4d891aa4b7bb89b1d4aaf69947236da57740b381c987a5103f
SHA5122ad2e227c5fcb69c821a42e67623fb4d35685413530f4c7b9ea7f53217c5006ede38d3f4a6d2aeccf221733a048c46f4fc5e56b1914fce847dec14d92b08e1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f22257dcbeef211aad74de94eea6867
SHA19b269d6ef66c7a89320901f11c3806b4fb01d067
SHA25609423a00bbecfe0c1f9aa266204f7c35b558f71eb549f9ebab830b89beeccf5d
SHA512b68f47ef71507337bd21551104d7243f5dd21ce2e6a60061ffdceb13aa7d09debbf926586ab86c6a15e33c4aa3ce3910af342c88ee340955b437d9a5c0e73286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7abd6575935955dee80bc48ebc6ea6a
SHA10283e02aec3eefbc242eb7650d35e166d3de36df
SHA256bd46cb826e96a54b8cb51b9863e300c253e726d1431c87e8d9fb3d67fb0297d8
SHA512f266c92155539709f98cc18c76385442e65d197eebd7d490c89cf9b7ff70324d0b1c5ec10f90a0e2dc7bffd1891c4efe97f8e2e69e0f53b3898b8e523ec94cec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5455b1d9b47886dcc6e3ed7f86b9e5ee2
SHA1170862720e3cdad4f60fcb0ef1eaf72190511e72
SHA25638077bc6ff76d4e328a091aeecdf696760fbc17ea95b8e68f21b1b8069943852
SHA51265bcf4a999fae68b5ec4ddd39ab8a40a8d9fa6193114c963107d5f1a3ff65d0624641182714f5c4875aa700cb96be541a483a4734529a64270408a2d8f5cc733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c7021057b938cb0c517221ac452a331
SHA15c7ebaa440364dff3d6e469f86c0b6b692d94bb1
SHA2566c032b3df26ca97cfc3a59107b34c08413f029b837091af0351b8bfc2770d15d
SHA5123b8f441d9e87f82b1ea0edc8fc343adcfd4ae183842af68baf57326cdf87cfdb94ed508579148258f2b3f99921bce7574f6500f14f1da70086ebeec6e678053f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5485bab18e016fb5ce3d7e2126c9ba0c3
SHA1dc5225dc356e5a431450496d5c2bca1636c8528c
SHA25636573535857509c3f788cef189308f4095e7414b7265e9aa957f89d8ccccb1b9
SHA5122c6b4f437da69900e19ce88ac73193a209ed3178269ec8bf83e09951835210ccc6a12ab8fbed75814440671b381d67f8800979e037ae7e1b18bd96a71bc5f940
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a