Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
64103df24d3b7b25c2d2465856cdfea7_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
64103df24d3b7b25c2d2465856cdfea7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
64103df24d3b7b25c2d2465856cdfea7_JaffaCakes118.html
-
Size
193KB
-
MD5
64103df24d3b7b25c2d2465856cdfea7
-
SHA1
bf2856bc44aba94e53b2ec72dde2124c067709cc
-
SHA256
dbf3d1233c05addadd760c087839469dbd6c7324b952cf386ae366f4864a484b
-
SHA512
627c76d6f9ff32bc75c05180fb1f819be294472a9c2c57f53ea6694713af883b029c5f07465582fb106da13dc76e9962a1a2b7132ed3d22f86d57a6e236141d8
-
SSDEEP
3072:SMifLKzKM3yfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SWOMCsMYod+X3oI+Yn86/U9jFiM
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e97e5483f422958ca118810fa5037f20b92823badb07727662700eab9b919deb000000000e8000000002000020000000ca89eef90d4044183a865801ef9c3b30e7f23450cfaaa10c07090d412d18813b20000000fa99473ebce0f0eb2c4593ffb0ef7a7f772483dd0716b4b901e3d49b2d7d9fce40000000b6c0d3ddda258606fbda916db04e1adb96e4ed9637b6f932b719e2b3a3b781cea4520e967e224eb0e2e1ad6492d2c5e79144ee1a6c018c02b418e728218271aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b9b35b07c7a4fba72555421ab6e0a9cb9a5ee6d2f9650f2f80a1bb16508cade4000000000e80000000020000200000005a807e3c5a1f748927464c8adf59987e6b4c25994cc897127de924ae6b4cde0d9000000024ebc6e0d5d14276e51d0e1bc4a004af229bc485ee1bc86fc4c64d7532ec241ab23e987df94378459afbb4cd51c314d919cb84f5ff14567c85b497100661aba9f1ba561c4bd544b953be99f961a4f14884c5843c9d5e1731716d702029dbf0ece6f99458a00faebd5a6a499bd05ebe99dc8d8fe300f39654cf5266e8a31b84a15f3cb4043a9fef0d4c1241e9858de8a1400000009dee34c56de90969646be8440d836bf8f03735bfd9ddf0f2f5bf21e80ead00c193070603cbc13b8743f8c78ddaa86a70e87703e4311a8eb338b51bc92370e55b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422472767" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202ab4dda0abda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA4D2721-1793-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1860 iexplore.exe 1860 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64103df24d3b7b25c2d2465856cdfea7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0a5371f7bbc498bcb6f0c4a703a483e
SHA1aa565a70e5a988407ec6a503925e6be6be290742
SHA256bb74148180e607624728979b6ba89c807112b3e503a7827649c44eaf833d8d6c
SHA5127a69bb673aa2b3b5f577efc0ea8cb014eda62d073f9293874380d9ca6bfcbdcb291f4b1d2b34ec35ec322f0b3d517dc546d2a1366bb67d7ab54e843a477e23e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ada4b2630bea252f1740d57c5a4651c
SHA14cf8fed803d98923c7624b92287e700e0755c5a8
SHA256ea93bc1d0a0a2e60e0cb0d552b65572af96658b0768bcadab233810ec549b475
SHA51201d36d59af6d7d8ed6d2776c07c3cec4f016e5c98b3aaa8c5a0f1973388708df3e2d2aefb6dc6271891c8fd7398293d5c396acd2ab47008904e65738e8f60d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5132d06d88c7850bad844f796b92b1ada
SHA139df06d9e52cf587b4d47bb5134b70dc7afca419
SHA256e80b3ebff9ea0fc7a2f983b3681f23e675267e38da269e58095e98cb4e38f801
SHA5123579dd8522db3a2323619c7696b1ced84dcb3d536ae3c9d1188bcbc7abdb0466ce67af9b2d3ddc9dba4cf3cd08389b14d41cf5a03c2f57a7b19e6b81bfbfb77e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7f226cd2bcfb0a2fb9ff09af1571576
SHA19ea57a3d4ae9cfb7336f4a56332446e7d7f9bcd7
SHA256344daf77ed2bbd0f7e94a27bec9185c70c3f1a9f54515963299ce34e7e0449ce
SHA512b029f999e04d4b225e4533659e4fe50ab43e2c994d044a23555f1d1d7aedc4f0ba4aaf7bce24714df65f77643e672ea94edb44048b7a5404793af01eda92fd2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59320aa213b0cf2ba0736f564264dd99e
SHA1918c8d70e8d5640c331e0b2302de263f1cd4f09d
SHA2560b6fb07480545e11c700ee8c3dbcc21294b1a1f5d2ebb025b14c51f618ba6c80
SHA512e5c827525b66a36ebaf04c206195521e83dae459d27ae59c3df9f0465950bcb0d5cf98b9f650afef14e2d7f786f4a3fffb435e646dc1380aa3cf600734e647f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ced7ad90bcada55a4991c7a2b0cbc6e2
SHA1b560b0ec5060edba4595423853c09b89410d8dd5
SHA256d6c5c937f866259c513bfc13669a58f169b53e96e082357299074b9835de1559
SHA512f8f95df88e4659269c44f06b15f2f64cc469ad439dc1288a35ed9da7915145cf98094ee2802e5d800064e6bcfc2456d1ceaeb0739d4682eb5400017cb9471034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518ca50abae41a7a894d377055d1deb4a
SHA10213945410b51c1767c7fba89688bd687700476a
SHA25638c1d198e2b7ba06b64227cf777919bda36dec785924bf9b10405a5689e76f7d
SHA512ded1f37e25179ce8657d8f29c7df45c3b8c3ecb1040aaa6c7faac999622c56f9bc4b7337a52a152f3fe99ca40a9b8613a69492667e27b2f526eeca623582c22e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532d1cf6808f541ae54e430b3f24dba03
SHA1da3b5727c4f393b5e521defa9238a166e2c71662
SHA256c7c4b5d5a5342fa4a904fad3c39d4a4a65131cc33a108fd648200dd1b57300d3
SHA512f6cb76819aa2a4e3eb7c7214dbd10fb6ce28743322a2987b3f368a386041e8a143ff5f51645246aba74465677ed409282e15e01678c43f0eec6921af2844209f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce4753571d77919d88876a8b61209057
SHA14f3eae0cce9a716597fed20db8bca085db1fc54f
SHA2566b1c68a58073eb41de080452fb90c64c2c4409f6a8418af35c96277c47bcdab7
SHA512da5927da13ee4c860f4a0cc6d44276bc10e49321bb516906983d01d3771b0280c2fb07dae5a614a98195f3798cd3ded6de4286c9ef34b6ac999566c56574c7b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c167d4c04491670869a47c356769d7ca
SHA1d8073613e50f3198603431e3d5be91df0d31a88b
SHA2565fd47951c4fabc3db874b84f3715e986aac9cba70082bd40a9003f3de712d59b
SHA512f3cf55c292530b11000cea0cd92403144527d0c7e72377bca9120c8636e7a554e88b12927ca1984a19bd959fe1900f8f23c14792046040bdb3a5fd564244d534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f4bfa5cb50f1d039e5deb5ae0ea7e3
SHA1aa6cdb1279ba29173c04622e25f7942df0c8a7ff
SHA256751607eaf1107801341a295849b4831d0c1c6e14fdb83ed799a2f03a5cf08c9a
SHA512f157360c6ab8e36840cf1d9c929788a5a9fbc2d2e8d5d9fd144b15853f70cb008a868bd91abb6f1a8e3f0c857b2e56bc9695b6dac3b3b52b8849ccdfbe3740a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5d152532875f325e30925f7c1ce7456
SHA1961f1fe7af32b2e65404820efbf2018b9ed540d2
SHA256b46550b6c50337975f8634903c536870ddcd2886d39c59688c0c5c8e5bbe086a
SHA51216e4a51c8eec85b9f847136cbee5aa6bf38e5a1122fcd83f925bb2344d363e6be3a23e020f99675b8120dcea8184e5d6f0036024818d28588f9899249607b8b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e89756de2dcb4d16f6ce28e83857b36d
SHA169588b0f271b585d1ae2b7ae406e27e34f7ab9fa
SHA256f09f54180471842271b3dc4dd4b33988aa4013dd193bb7435e254cb15206db4e
SHA512263bff00148257ee76fa9bfadc733913126afb87d77a2cce99f8bc7e7ab427ff0a03f1cd81e104f9542eb51d20664b5bd53bed8be3d64bdcab0cfb67d2bff3c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f6308762b82d4c4e1342cb4b4c05413
SHA1bd334cfd8e19a89d5e1abe16311cc3eadc57aa64
SHA2561280561d3297996078d3d1a22774e4fec0c507651297ce9f589f827850c147de
SHA5121fb66ba013d5acb2ebf6f1900ff93667602c81b847ec19142ad33881a8692ade8c4d93e965b24f3c34bf9cfcbc1ae95d65d12b4236daae707d49587570c02366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f4313649adae5ddfad8a080c1c18dba
SHA11892711d2dfdc1fd537a933e6cd4e26c4936a7eb
SHA256a50a914ecab7f3e16d76d91b1d4d48333b4674d0eadeb4bc33067cc16119ffbd
SHA512c0d24da888201c829089b3c7c73179a214a05ee4a71848a4db14148d8695849648143f096c0b1637abf52663948bc1715938f9655cb54f77f46623a7b1272f3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b83b2fd193b2186b76fa7b88a8069f6
SHA11ffd4e931a0eb9e32f337c2f4ea43fd6ddb16ffe
SHA2562949b311ea2a4c8d300f1a8d69870db4c74cc50bf21d61df40dfa579e1f54ef4
SHA51266d1ebe4721d3dc7bc925fab70b2ea3b95dd5b058071e8fa05434167ac49ab8fe02b97486b8db5f82fc535cb6390771742fa8ac9a990591e38a66fbe53189869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe1378e09ea70d905bcb5cf1c500c40
SHA1a67bb9d479cc76b88126cdde0155b687d24fb67f
SHA256671bd334b2427ba3fb3e2dfd8884e2cc9bb21aa3fa75a1859a6c3b6b9a7e9f29
SHA51219d926a3150d2fb1909683b3bfadde9d2a92adf869a6911afc78538df2cec78b71cea0421b9a7bdccc0fee6aadf02b35bd57e8919796cf5004fe4114b5f763b7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a