Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
66319e2c0d61d8a706eb7c6314afb958_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66319e2c0d61d8a706eb7c6314afb958_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
66319e2c0d61d8a706eb7c6314afb958_JaffaCakes118.html
-
Size
32KB
-
MD5
66319e2c0d61d8a706eb7c6314afb958
-
SHA1
1f5573bfe2556c1c89adf63ed8ade6875bc49838
-
SHA256
0c1e0a24c8412d8eaae81b71558ba377037b93c026018fd63dab0a0582da8b26
-
SHA512
27e86de860f15092d371a5f5eeb36accf738b46534c8b70f06d542f557f7967606f8b5b1c09fb6636899d64137dac22a8193de7596816f929371a06f1e082bce
-
SSDEEP
384:SIgUc4SXRip+kzJHVjJm+Kw0vjsVx4ZmWabEy8qnoX6kq2J87CF:SpUc4SXRajJm5w+jKhWaIyxo4X7CF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422518384" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a67aed6bedc8141994991cefe006a94000000000200000000001066000000010000200000006f9f329cd4f9e8639321c44fa312cd9841237b659cb208550cbbcc05fbc4dc29000000000e800000000200002000000039dc02f8c4e828d8771be157149d0646a6b8f50d70e694bd08577e771802624020000000d4f12d063833d10cc4e4b9a8251bc89f2afec5f9fe5255bbaaba3fb529c6f24d40000000f70dddc0e95e2f5776d8f4e650824cafeed4bb78f6501d72249b99e9bf7e3252c5cad2cdafd273666cd15cfcc382e159b2896918f31ac619665954df6806a73b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a67aed6bedc8141994991cefe006a9400000000020000000000106600000001000020000000b592b09963f010fbcaeb67d2032681b4bf2d04a031d4605fa05f20dcd0d79ee5000000000e8000000002000020000000357bbe57d3ed65f76e0c5db1fb16816940d0cbf188d5e1572a41e68c1cdb9b1b9000000064a5ff7fd90065a267b76650ea16738dff6a50812afe15052a063cdf1602138995286fb502bc3c7aee3ecb4c4d62806a09e2b6193bf591018ab1bd54ec93110a7993884eefd62d7b6e8add8bd7b31399e3aa19e05290145435a5ed1a06bff691f434b12190fb5f2c0614c1ac29afab43405d9e0ad98bd1116c78e1f9a2e28e50fc2cc9def400794f628ef9074a1b28bd400000007ac9de50ab981cce28f8bcb551bba91f0ba40d9818e818b9324d426dd52b67fa239624c51ac4b8d286073eed9ade027d8113dcce0c57b0238da92395aac9f794 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f287df0aacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFF44CE1-17FD-11EF-8859-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2504 iexplore.exe 2504 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2900 2504 iexplore.exe 28 PID 2504 wrote to memory of 2900 2504 iexplore.exe 28 PID 2504 wrote to memory of 2900 2504 iexplore.exe 28 PID 2504 wrote to memory of 2900 2504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66319e2c0d61d8a706eb7c6314afb958_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c806a7342e6cb822d42951ae0ea0960
SHA18c18d92b7e42226988f32ca74f65dbef9075442e
SHA2563e3addb6de7c9f042d5e793b288cd30b7486620865709759957cca7cac644188
SHA512cd13023998a281c119963be42f747b2c3a327c40428a2d5ee68db8bc6f3033f8997cdb55406fc2ac16e3ad7e47d0ab29fa68ed4ea29cd4e741b317f5f97aa94a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f6145b4345db99ebfdaaf8fcbad400
SHA1b7401e2f32b26e27524009459b2df7b1508d9e0d
SHA256aa651afec80edf5b933c1b9c8a890c2526471aa03db5f1672529260ebb52c92f
SHA5127e1f5ee06bc8b51ac0127c29486525df39fe761c02e0475214e85ec1b5d0a1e93d7c589478dfbaea06627ceff195401608dafa60df1d1f0c58049bcd8c403f57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581306879e75f92d9341b87a1f1796e70
SHA1a2f93db7f6fb17eb8d808ba6ba244031b59c08ba
SHA256b0fd99178d7937033367e3ba43bd66c7a24204d9f6a8a77d77aeafd71f27c5ae
SHA512909cb09129257edaeac955d5e685bf1f697f6c1066d4f25b8b3dfba774265aa8dac22ff045c06e799bbfc0889b15c822aa7404b209b043c4becaf974927dc8f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54966ff1dbf7f4d88d27e608082f9809e
SHA1a0aac86468c4e1ee5f386b90e2859983a621862e
SHA25691998117a1d4b0916c353edcb955e47c4dc399aa9fe1e81782d4448ba977f419
SHA5127a540f9fce602ed5c0647214b2c917e81b491818b12ff89e01ebd8cbfd72a041d99f2654d28a6aaa6941c0ba9426ed5c11d328eb55d1ca9c48b1ebd86dba2de5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569319d0ebb83333cd67de6c8191d47da
SHA19bcbbedb2c7199e67cad5d9864d8843f916901dc
SHA25673115863eba54a8f08ff0c853843fc122ab149f905b5cacef349f72d5d8fbfd0
SHA512d550e281f34f29785c505f8943d97ce0a72b7e78758efc15dc6c98dcdcecdb400a63e31d192f847d7003313856e2c1e6d7178ba0f253fcd2b91d297040bee4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573d00122613c680c27adcf69b6cd9f68
SHA1cb9a6294a1b1c947247379f16270252788c7a282
SHA25655665b2affcb8446b654f302ba9599c1c2d30d4990593f44358cdd6a41a63e48
SHA512a9c1c41c17aa4b945e3b9843315d282b21962d95bf5fcdfc708a308323ce9e6e1f91154c46b751aa56b4c6396e173194f74ec0ce15123b6e30d99599fcf4f53e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b07917cdead1482cfc38d9fc4700b82
SHA162cfa8a86f77bcb429f866ae4048d26df5ffae71
SHA256e9d57d612b46303b36b712704c00f54b906259df0599de2f86f653df2537e3bf
SHA512699c371294acb049151b738cc677a8ff6d10dde21071e691074fb90ee16b39552b00b8eb850ea2b56a26d7d5b4151635a8b2fe0329a015c50a8911b32783d6c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5318d7d8eae97743377777288bf255db7
SHA1b028277a354864135ace8e0315e680d50623fafc
SHA25630ab60e55d4ecf7f7e1af13fe907280c74bd4708b8c71f8fb10714f8fd594aef
SHA51254c1a1560c477ea24ca171334d1cee828e21d489197500e24adb813035989d2dcfbabe5973aff6784c8cf27bf55af373e4c72cc1e96943526106281530abd3d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524eb00dd6f0520ba2d6d1b3490e3b3eb
SHA16ff3fda5341ae704af57c2626cfb9855f9c55eb5
SHA2568719ddadb7812892823976410af0769ad5c034449c920ad9fdc5c6f6144b3c9f
SHA5125227f62690175b30287e3fb478fcd075472c8e2f77a57c19198c8c700f942e79b352d8034b2cd4c79d262bc3050f0c9e5c31a8517729f77d37c7f14c4cec7a97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597249b9c8a1081df77f3d9d3a1a7f897
SHA1d5c2ffdbb8109b0161dbbf44b3dba22a97316833
SHA256d12ffbf1fea2fdd26efed4fe522c43fc4cd965de1d46dd592ec580cd30bc29c6
SHA51287ffe7d34cffe7584d75712a7940b75b9741024470d8f7261edb986df37d84e30bf1cb12807bfb4e3326e792c3e4f327a5e812de761a83f271dbc4cb7ec18922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c2782f0aa048ff21b48dd6a7aa8b458
SHA18868053291c763b8e7c14a46c2c015dbe5d60e82
SHA256119a6e86b9a423ddec53776ecbf9696fcabe3a5284f2ce1c25cb984989f11642
SHA512fb0f3023a1aea0c012cff78298b3efe0e1191d4d65a8700619eb02ea08c1aba3e96d25e3ecff9573a7bbd9dff98be669843e4f672a9dfbeb3b26a1da2b025d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5111904088f393745b38cd6be6fb3e421
SHA10bd1b291f9f4daf588d6fff20ce3de2bd65dff2c
SHA2569adf5280867e437617f94f4eb578c91faef676df5c241d14f5393f24f5cae527
SHA51285d4255fb07a5f80c5812e2e0e760c85539d1f63a1cde5906bf07fb75ba43e86605ef6d0b31ea6826db566ddc32221fb896d6a1f7d4980caf060c3727de680a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e62898e83fe421989df88f8d040603f
SHA1cd2fda0ef88d0ac58d916f3ffde37273f522124d
SHA25660f7f1b1932c3b3a1b2d17a0e5324d3ff32e93fff42ab30301e3b0ad2852ac33
SHA51289c7bb4eb538f8a02404c10bf2e114d2ae1ebe97e5007a1101d4991600b4c21750204ddf30de819b44203a48b378a7492a430a7752e4d1d7189659b8c3df156a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5305f847c2a928dcfe6a7b7e4130e3910
SHA12f6cea8c259e0e4d8504d22e69fa97cf57d7b29e
SHA2569da9ea70c559d5ce6cd2007d4049c9e912e756ebc91c73bc226f201758bef417
SHA512cfabcbfd17bc4bfff08e2d521d49d90176e8596907ff9e2ee3908d5406b1bc4c691f8eb539384f0cbc2c078ba7a8ba167101ba5a2e84893f9b8b3a54d2b43ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7c4ea0aa9704c0a057cf619b78d8986
SHA1eafe2878adab9bba873a715d7f3a1866e7af4c99
SHA2565543d8d0acdf55731adb77eadb3bf10b02fe9291f2975eb804eb18190297b928
SHA51272687e5ca84f44df80ca66e55e54cc0020903509f2d4c18fe620222ecef2119a759ce54aabf4d233e6260912d12e29878ea0b000572f3dc676e1db61b6a1b5c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b7371088435f14807cda00a48947ec3
SHA12188cab78e30632627fdf508553e84e78fdde2c4
SHA256601fd1aead88ece8ddf47a5769f297b242c523a299c8885de8a7231d212e52b3
SHA5129817be1bf36d1e3483a49c70c99d7cfaa6078343782d6c8afb1557f05eb83cb51fa351ad7d85b66ee1c7383802110da350e35cf56da8d9ce599dd87483d9dc7a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a