Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
68edf89e3c10babbf99d92223ce772d9_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
68edf89e3c10babbf99d92223ce772d9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68edf89e3c10babbf99d92223ce772d9_JaffaCakes118.html
-
Size
52KB
-
MD5
68edf89e3c10babbf99d92223ce772d9
-
SHA1
963f8dd822983710cb5999fff451fd00dc88d628
-
SHA256
cbd907cd17fe1685ba0ce0e2637e830b389f2398297957d019b32a39efdda3df
-
SHA512
d45cb9e0ebc57941d30bf13cd5ea66e83c8dfa42de26ac0fa62df99387f835333fdd305101704eed5457277920f337316d8d1e3f709245886f707f3b3567c893
-
SSDEEP
768:PX8Jrpje0DnLmCQHNeTCINdXZPAkePA1ZsDkDCoYNyL+qD4FEdR3qbdZD7un:Pipje0tIqdXZP0CCjcdR3qbdE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00fd23ba9bacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422580606" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dc41bd3e97b7c41b064af4a78c6016000000000020000000000106600000001000020000000490a81effbe936465f88f72ce4e3839b392278bd0b63b96d83eb60ace8296751000000000e80000000020000200000007e00eb3090d44880c791a06e41bfcf34ae271ec1f119459479d56e190a70c8b790000000216399e7aa968ed087913c6ffce455ddb2aab4a78fd768e6923e716ed46f202a993412eb137f09f10138406ffe24c2dfec4868abed433d55a1b1a9247907477f587e5e0a8097b3caff8d36002adc713940a3fde3db93eaeabe57f7d2131085cc402ed0bd9fafe499732c2365cec3890571852c3e28a54178266e68f8299548ff6d65df4f583b949c8df1ac95b187fa7c40000000a0943a9c00f9da3f96c049565db53bd53618ed48b1424242144eafa75f03994902b66be07790deacc1ac637c40c2f1b1f023312b2de4d86ec5b3694cc6ad7440 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD98FBA1-188E-11EF-B7A6-525094B41941} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dc41bd3e97b7c41b064af4a78c6016000000000020000000000106600000001000020000000a658743c35310fcad6a6e828d8ead46518187075e37f23213af74d8dd589f550000000000e8000000002000020000000184b1e2fd571951fbf7764174e07fd2ab0d286aef96d823d7ac2704e4e7a582d200000001463e80308692a53ad5b5a3547e410a1fe429c3c4ba8a810f6858d0c0fc3f86f400000004563b5b12d7de70bab599759733380e734cdeb2e74ac6d68a7307867783ed1943ee4b25364bbeae05661111d5855fc893d2c8eaf69ac1b5955908fd49e328bc2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2368 2212 iexplore.exe 28 PID 2212 wrote to memory of 2368 2212 iexplore.exe 28 PID 2212 wrote to memory of 2368 2212 iexplore.exe 28 PID 2212 wrote to memory of 2368 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68edf89e3c10babbf99d92223ce772d9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568
Filesize472B
MD5572ce74ba9e3f6ebb167fa9963207f6e
SHA1278aa8ba3ec53d91fec84d2529ca4248007d5b30
SHA25617520108d1756f8ae26f0f66aa0b175d9f29e93339c4fdb67d2687906e3e917d
SHA512fb8420b98a725c41301795fcab199e6bd8fe66bccae39b3d1c296058d4be49b6eb2dc5a48aa4f0ce62424c13cb16e0672af381f3834f35b25de6a88010e7a9d7
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5417c4c44225c4c45515adbdd15f7c5de
SHA14aee223445b192fe009af5d283fe69b2aafba215
SHA256094e9d9a4c2b1a4bcf153f70d0e71edbb91d7223306d30f31797bed83048b617
SHA51243b892cd8552ac51d3f371aae900b82ee823adbb40a893c3067621431dd1f35730115dcd1caa03dd017a26544023e2a783a4c1eae574840c398d1c13bc398678
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5d7356db26758870da73d0583651c99e7
SHA15b0c5fb2acbea51b1e3d831ff9ee19e8cb96297a
SHA256a741b1b54a8be93778bedee0f8fd0acea49c1e2960bd4bdc50956f0ca8d1861b
SHA5120d55681fa5d49be7f9875407bd7609ebaaa58356b9dc020618007fd22542478ee7b307ed4719ba4f0e5bdc811445ad1e4e95be9925fa0d6698a51baca17e4c02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f11489fe14ef5de0e49191f57b4d9c6
SHA16858d5669ca57aa81b09481b5d1fd123761969e2
SHA256e800f9ba557c6d1e06e262188ee96117c55c8a70fb4e8247de5deb15fc851761
SHA512374776c69e34d1e31a25aacaf145618b31a13da59d7463436ff565937fa8af2b5386cdfe31555faa9641f464b078459ec7d6984fbb2beec8af654c3f3de3c452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b315163a3c09e1ac481ace9c56df53d
SHA10d5b6fb161326a8166df5e1abb0294ddef24eb3e
SHA256357a6a571dbc99f4637bb871f6331d18e4a01d55fefe0afb24c224b05462163a
SHA512d6a2bcec30aaf42230244d6a5851e091aebcb69aac9cc83d967c2d974f6807e89baf29ec08ecda714097e1129519b58aaeb85d358b9d697d83a42499871d8a19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da31ffe3f5c9c7292ef028265e1efd38
SHA145f95a51902baae78abafa3421fd5b72b67dd1fc
SHA256374b6a1607fa2bf15c4e2b8077fd0325924a49034426e928a00a31c38256dfd3
SHA512a9027705d31cd4942ff9f75f63cf943be033cbc1c76222f5deb1d921fd5fccc47952454e511c60cf8dae1cc2302cd55180043797e52e88da15c2ad0994ff613c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8b56e7ee17116ebfdceee8ce6794607
SHA1ed55e4747ec33db8b1a0a595a762058b4a1c309b
SHA25699790572620319a3d3815fff009814077af8e7874160fa60bcc99cfb79773b6a
SHA512f980322df7284c146663075deec9a313a0c6de3c8a518df0266f62516e58ae38d04ccd2a43bb9aa82ba27be69e5e9c83c13de7753e7ebf52031e69a3c92c3658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf8534efbb7128917e2df90c16eb13b
SHA124fe8f9dcb4afb3ca874e63b3c773966817e8e7d
SHA2563f122aa1c2182004b419c6326c34330714e127b63332c95de8b78c4078478d6c
SHA51220a2f67a18c7ddf737bed32245f0ff5efbfd0c0571c74655d2451dc127b287a1020e6c1dff84bf1799b6cdcf1a5e3a39c652ad70ada5612296d7c30a95288dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57e6b5b2b664d23ca983854387a651889
SHA12673ae3d7de63b75863ecbb0c02d70b28ad9a159
SHA256883bb1e793e2304d5dfa907cfdc6c4f26074542837324ba34d39b8defd35c4d9
SHA512760b3543ebb42de57f357501c86843ed35702a75c4bbfd3d5f18d957ac6048dd59b76bee8e507e7358b4a0d1d6216712070cb13ef47c98c562bf478f20fb7f39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a60f8f361d72fd90f94473d41118fc78
SHA141cf9ee396611f03a7f36d703f58a36ac00a02ec
SHA256bae97565f9ba28a8e02b3f9aa4002d94a8f4baa67633d44622379f4e42e10fd3
SHA512a6d2792ac3d2fe15a9d17605b54db1b021c8b33e53d04b3effbb8d805e6a8328ee9cfbce4a82031ff78c7b8d0aa5b246cd713bd36f8b968727b9f09d49899d75
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\55013136-widget_css_bundle[1].css
Filesize29KB
MD5e3f09df1bc175f411d1ec3dfb5afb17b
SHA13994ec3efe3c2447e7bbfdd97bb7e190dd1658f9
SHA2561a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617
SHA51216164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\platform_gapi.iframes.style.common[1].js
Filesize54KB
MD57ef4bc18139bcdbdd14c5b58b0955a67
SHA1afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA5126c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\cb=gapi[1].js
Filesize133KB
MD54d1bd282f5a3799d4e2880cf69af9269
SHA12ede61be138a7beaa7d6214aa278479dce258adb
SHA2565e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\cookienotice[1].js
Filesize6KB
MD5a705132a2174f88e196ec3610d68faa8
SHA13bad57a48d973a678fec600d45933010f6edc659
SHA256068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
SHA512e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a