Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
627b3d3c3804a49d3ea69a259f01e955_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
627b3d3c3804a49d3ea69a259f01e955_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
627b3d3c3804a49d3ea69a259f01e955_JaffaCakes118.html
-
Size
20KB
-
MD5
627b3d3c3804a49d3ea69a259f01e955
-
SHA1
3b12201e05fee795e9e7a7a1a05d551884cd95cb
-
SHA256
cf4a895c173137d152ec3464a761a5386b2612673e971d4ab430c71da354baa8
-
SHA512
015f4f645aa3aff163283143434c95afef94e56a6059fc627ccaeecb50592ba87ca67fad68bd6d3b6a0047390b0df80b0559b55b34a8cea26a8f5936c2884a4b
-
SSDEEP
384:ziFK9XjVBD8c+Q3Rua7Cg7bYY3bYEimTD4QAmccfIk9xheUzVc9x:zi+gcR3Ia+ubYcbYEimTOOIk9eyqx
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50af12ff57abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003c3f1a519ad44f846427d065863f7714995b21546965fcefa41494112037ab89000000000e8000000002000020000000e9d79e7138612335d4308e821403049ed72e3be07757a273a7d2dce8722793a7200000002fab012254d177acd3d16b0e9d0b74ff7ab10970711b80747d646a2c9f5dcc6b400000001228f1f7e354e6bd8930b62b94a507cccbb9920ea99f04b3b49afd7fdf78f2990bfce1e5632edfc91d4fc11b744e3d4efd69f0c83e2c9c9f098ec13ee3376cd3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422441571" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000476c98c6ab554c6981b05b452a1fc63b6a565388a3a24b58dd353d180ac5b494000000000e800000000200002000000088b217c66f0611b2649a9408f6801454a50b3ffe292861f864ac14168f85091c9000000009786010ad1dd1d9d98834a754a314a2c4348dbba8b568956b47ab12f61db251238e8f86f2cf5a9815f6c391bc7dd260a3e2e14467f3c6f8ae2f2b1249c12059d9584e8e0b125a6be586395289fab6a6c7ef5f674f488b2c488eaac8a79713b1098f858990937069ff82cd27821d9ecbbe6fadcee87bafa9ac8e9406f5d023542af95a0b967fbf28951fcef97599b18240000000cc4cdd159e18b9bc990a1812176a217ab1d4e48ebdd5c94c0e88dd893a934db69e2d310a1b1d2ea0a67e8fd5a132d2629b3d1e4888cfda0894dae50374f74347 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{289FCC91-174B-11EF-AA6D-D62CE60191A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 640 IEXPLORE.EXE 640 IEXPLORE.EXE 640 IEXPLORE.EXE 640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 640 2116 iexplore.exe 28 PID 2116 wrote to memory of 640 2116 iexplore.exe 28 PID 2116 wrote to memory of 640 2116 iexplore.exe 28 PID 2116 wrote to memory of 640 2116 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\627b3d3c3804a49d3ea69a259f01e955_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f88c746cc8b99022f525a71bb738da4
SHA1211d346835e0d4d011f3deca2e5227f540bee35c
SHA25668c49747f53c3cdc732be73cde63e768b9e64f955d10622192729ac566c7e425
SHA5121b950fa90b392b397de4919039fa66d6324e1fb20d1da6d61768fa1566e7ec661dc3f172532853f5f3a553a0c980a75967c6be837ee868560cf978638aa49188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590de002ecbe018f3b93e1d0f67c2eebc
SHA13b2a47c6f2c850bff1c265d8de18913f5e440199
SHA256744dc5274a24766f3243566f1c2ae320afe49dbe8a8302e7e535f694fb8fa957
SHA512de674c8704e7e0fab69f31a0df67d1ccd23854fb8615da4f49fc69254de285829209ab18b14e132a4973fd62073332ac5d633770e2a08fbd91011396edfaca0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c16dbc7da197627c712d283fd02e404c
SHA1f415d0ec5a9827c9fcae67538627dcc39e52e79e
SHA25629cdd97f90f1e34ac2877468a198aac79f2de4fa196805252d96c23357768a51
SHA5125da17d1bc2480dc12116bed9084aa1e12f0f8f31888e2beb540f911cab0a9291bf7e74f57b1af0a072a0cfc643ab4d6acb9bab022198ef928d1ef559ad7d925c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5847d8641af31ddb2f3c86f5993801765
SHA18f9bd1c6841736301d92d61c6f91b4b47e9fd8c1
SHA256e315f6e10d17eb22f8d77fc61a9a46f2251cf2a7089ab49d83f721ce19419af6
SHA5121c85c160b144fdbdf9f0889c2767ebf710b3120f361e8eacb4fb6f474694ae663c29b93ac12efbaef3de496b0f20c10e7e8feddbf36e5c0e3578e057c1995c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a5a7c1b4a95d4b90b2231c4921d35f2
SHA1b9b7c65aa2ab52d54d3da568681581d187fe557e
SHA256cf7b7080ebdb647b4fe1023ca31d11dcf802e603bbb811d332272a785d7a07a4
SHA5124a5befd9a5905a970f1a9eff93c634506360661eeeffbea0131d1e86feef6434502093550a8ea7139ed0063c9b7a716f6976aabdcc1fc84690a100b165f648b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597e08ef67b29a0365d6e207c6687961f
SHA164bd240708a52a22263c6a8ccc8e0c174f691fee
SHA25678ec50386e359f05ff37a44273a243a901989e9171d4aa8c9caaee9055f7d543
SHA512314b64b0cf28280c14f7d7a561d6fddec955471efc7762e76ecd7a8226991dc1009c2869de5115087fdd1e9afde886ae3df966494e0376cb429cffcab77b44c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5382975d1a9621fddb081041b3fff5ecc
SHA1c676b03b961330b2545d82c88fddd282d4581c4e
SHA256feb0c8d094595551e39b509a8b8c10bdd9e6218c7e09c733c480ba6439060753
SHA5122a8f98b9fdc501d1909efc940e7b1929178462f5645edd6d0e33815afde4497fea8ab6f5ef308af3f347ef9cc5ed6922fb7d2eff706894c60a9238d18bcce525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfb04530619860b3ae49a59dc6f2723e
SHA1bfcac5e3e3d6ebb7968325a740463c1d76eeb0bd
SHA256a248bc5a4deab6a5c072eac950d431f9a76541cee503710202dfdc88552b5239
SHA512ce90bc66cb655eaf6309f69409940d879cd7a40c3c8bb6d27369b9a250da4e65992825b1709be8e2a70dadd21adba980798fdb3fcd96080244b21249820296b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515eba1aa5f96e248c7b241b1e090634c
SHA1efaa95a77cb84303206f210620a4bed0ae623aae
SHA256646b1f616aa7f36488a7c37c6a9c99d5ce2b59986d9d689dfc49c6fe72c4f665
SHA512c7cf23a0d06ebf24fa3db582c916766d0bdc3f8fcee4b8457f8f1ed5836200769ae78bff61b7431fdc71b1b1fa14f045ce68307fa701e0b26359658affc3a7a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd2562ef1fb649ef1702a03576c56911
SHA1a4a3d54ee149d0bcc63fed5d4f6fef3e1381562f
SHA256d1302b9a665e11a7a70e41b813a316fbf7b81a90c5e1b5bd2169577410c3d4ad
SHA5122e2cfdfc2ce76032d7cc0c3a2553dbad5acb7ac6df7d6225e62135fb3f68af39828d36bc975caa2be758060f500b9262e7ca98fcec4b0da0cc5ea21320b3d965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff6e02ff9627e0c2ca2aba0afe93094d
SHA15f95215286b32689a343486a757eaabf1fe77e3b
SHA25615d121dcffdc1dbd6a907287d3fd17f6ea358c79270d8d6693aeadb3954659b0
SHA512f4155376a73ad4698c5bca170edf567ef7f14caa440ff1d5bbb413d9d2dd6a6a3398480932c73bc8aed077c46a38dd5f62cf769b4ee139434fa82ef5e6809c6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585184d921dde3e553036277111f89607
SHA190feae2770caf8ce1b40238951bcd9a83931edc9
SHA256695b72fc2a243daa30250a62c852d545cd1e92ee3d8e7d584fa2a74777d721d7
SHA51203718ea7344f847a6d524a0e516e1af67a7f1ad596b5556d623081bccc0ecb5b540ddf8f3e7ccc0e30d5c8a9498fcb115a3c57c45978e7eb09f4f8b882c10e80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0b0f2b1b84d9c676396479a752cb773
SHA1cd1a86345dd3f8e5d1c9adeb3695dbe9fd647c38
SHA2563c0f35074ee61e0b4f6d2cf3a69582d1f11eedded58a5a4bd9e6819e3b1e2adf
SHA512dd5d7739c40ac8cfa4450043f7ebce98516e5840f3aa1e34fe72fbf0f2b25f46ae2029e55c73637e37735b16935fc11978fc193f6ae1022d539d2326938151f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bccc37a58f8ae6ba6938c718e4651723
SHA1f8b044393c0883e77c12f7210898c89683319cc4
SHA256161634b8294e0dc96dbb6bfab17140d258602a817ee08bad8e4519dc20cbb105
SHA51276d42dd544fc3e8644a446c7f461e6138023dcb9754baf5e39eaeebb9d63e6e478638a525fc9272cbaaae604fc56f9495f9385db3b38595bf6a343dff3a1c29c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c2572ea7141d74a13a2e592782455b3
SHA1bee23a74208d95c81271a77fc61809e01d908bc3
SHA2561615699ef124f1d64e739293c5aa319ef07e378f688642fca7177d4c9b7300f3
SHA512877b97150535a0dcfc881e97e6480253cc3d82aa51142aaa6c78f4da380ac21a9644556ac284499534ca9cc188527a5655c737d728499639f70d7f6a23084c32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507162a1a978995017009d1b802bd42b6
SHA13356490ed9f7b1c3843c9820847269624e31e1d1
SHA256740ab08b9a8f18a4cea3f3308e129a3ca9f2c1de1e849fa5687e9ca1fab532ce
SHA51265913b1b49020e039773b928588eed759c6666f42024aa8f2297c9434853995c1e048b7f92d6f6976cbe760cac4f76bded7eb42fa1d672ded34a245de2b01aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0860d560989d9540eb42b43d9db8bd8
SHA15f0ce550b5f19a1e52d1da2e035753ae398e608a
SHA2566d7f574d1884994de889cb80d867e1734d1cf613643fd44e883ad9e31be898f6
SHA51221a7e536769742e54210def06826d32915f4264b1d6c29b851b996ef0521892585f6f480adbd5d4846c1e5aa5cb661a991a6241fcf8fdb0c88106098dde43a77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510c657fbbb86f9531640a452e2945054
SHA15745aefe68de08705aa031d84dd2c8cfc4eb7e72
SHA256e23edd2dce9c05cdc38d5b7606c22d256823bfa7b5113f6f13f32f669428011a
SHA5123362317969065a4ee5e8aa8aa3867a8452c75cbcb8236e65afbc3030701d9be1835344e75078d35044d88a7596eae7ab435de09ad2cf96f11a9f52de044d33a5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a