Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
673224442256aa5f9e36ddab1e858f8e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
673224442256aa5f9e36ddab1e858f8e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
673224442256aa5f9e36ddab1e858f8e_JaffaCakes118.html
-
Size
23KB
-
MD5
673224442256aa5f9e36ddab1e858f8e
-
SHA1
ec3c2b6ed1fd1625dfe22489c4b94d8d5e07ed60
-
SHA256
8add0d94d8987bb06bdf5f1411f4397ab5acbd8fb9ea8b5db2be524eff39bb0b
-
SHA512
5da8e25a27259da22adbbd665638ce49cedf8544da4b2552709c07882e479bf2d1cccf462b943782454e7cf8750bea813338afbb2d3c1fcb5fcabbcaf66ed29a
-
SSDEEP
192:uWvAb5nS+nQjxn5Q/ZnQiekNnSnQOkEntPHnQTbnhnQWCnQt2wMBEqnYnQ7tnGYd:HQ/wmO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05517D41-1833-11EF-8AAC-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f89c1b3a8de49c4ba4d962ed94080f1e000000000200000000001066000000010000200000003014cbe05f06e29a849ad463b34d8d520710cb3d7d9402e395eddaf0312f8dfa000000000e80000000020000200000009691dd72333fdad0b712191522e6b5751cdf295f395797974a1bc3b266f526919000000060eb6b1149aa00178efe1a546a4be685b0c877e14b4a1ef8d1a36bc8eef0348e5fe743f6a74cab915b1251073393ffff64e04e0dfba15785ced4f6073b78ba7f200749970494951f54281740a6ef97c9a39e77a111d8fc62b1eea33ff5a9d8857bbbd319bf9ea1608752fcfec67f14b5ddd53dc3430df17f85e0f3d16e899094899be4ea483838a9bdca52267fad227440000000b3c788d267a2edfcc901cf483061ee1daed2b835bfb942e5ce5c19a9199db2e7c0c9e636f379664ce6e712fe676d3a79171869713fb9a45570a18d056e0b69d1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422541157" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600007da3facda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f89c1b3a8de49c4ba4d962ed94080f1e0000000002000000000010660000000100002000000071de2e32eb46aee6f3d22ea7e49c6802a39bcd61dd67be3869926df26f4253c5000000000e8000000002000020000000b8c16f537919f684123cca9aa1038d72385b2b757eed44ce823434059b114add20000000253a420af41a96dbf0ad27635c10430094716c75d4450d4ac30f68f073021853400000002dab1834391c922609814c97c18e3b2d566451440228b758fe04a5700d5180676f6e11e54936332176829b22fa79c7ca109f79a25ede46b5309817467f95269c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2848 iexplore.exe 2848 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2736 2848 iexplore.exe 28 PID 2848 wrote to memory of 2736 2848 iexplore.exe 28 PID 2848 wrote to memory of 2736 2848 iexplore.exe 28 PID 2848 wrote to memory of 2736 2848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\673224442256aa5f9e36ddab1e858f8e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560282a8d4bae147b06a55e7615c71f61
SHA1c4b89e2206477a2daac664ea67fc32e488ecbc26
SHA256054baa88a73699a1762f22de7814545e83a9a5a4a09dd6b1affc065370395ab8
SHA512a89fdb5845ef6fc0324058a9714d9f9c4566d4f810c3e27a850972a01b10ec6134a55ad79499c4b18a839807e80d6da7e421e1e872abdf064e13c72fa6614925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfa887f2934c1388d6aaf996908d64b5
SHA19d3dbc2836bc58d9a4dd848a3d503d7acb254250
SHA25663f1625b339443c8805f237fc1f4c6e5624a2f36506e87bd99907692395cc28f
SHA5128bb68fa3276213764441f31cbc199df403d1a8f4fd886ff891732e5c2711883bf788d8253bf78f96f477c0e0b9087d26d3d5f83cd7c8f79fe82df7fa7b40e6db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58440d28ad32f45ecc0add95a0fef9aee
SHA160aa81d6b9ccf8d8808acc4e35aa52805b8b915a
SHA256cf8dcc68a5956b4fcfb7e201a57c26ad9ee28ee3ef6e8f4117c076d7ca1d3476
SHA51229f8b93b83a83bf9d2b00a525395debff4b3aa78ee425f769cd01dd3ce6fa39aa752f6ec9b255f52d3c8f160610593601f79825202ce7336cea1b7e16b3003f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ec79be5b967ab934aa0f348ea934010
SHA170d120b8cd158d67c39fbd47298c48d471c19cca
SHA256df46e7d65a7b0745f9c5018502e0e0bd759851b0106d2b461ce92ee458e3c27f
SHA5129b6abf80540c198b85da69ef5f27730407fe08756bca21742ca40cb4d8e336ba6acbb15d35536c693e24f862e254bc3e0c242113755a73c6ced587f8ff5a7485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0e0ff05d846f4726d003fc65a579073
SHA1158d5e9f16f93d4e99bd338379109f55633975dc
SHA25670e93b79a85f38247e5001617ec191f7a78587c7c9bf324e46d4a47c8e4bb9f1
SHA512ccff356c6f19a79dadb52eb2f296d63898bbf5961d9447de421d500fb5f93dcadd3e5b6f62e183887975571140eadb1f43353bff3febbac9d7a999623ebf52b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5078fed529a8c30d84172ca3477e5b157
SHA1f1ebeaac09173f8f710114d9bf9c478eae97246b
SHA256a12a53c629bb1ffcaf4f88be029c60a9b146fe50db68bc0b933930668c58556d
SHA512c45559ed8835c8ae3d47693afec7de7a3145a1f649e0bae89827115dec8afeff212ac8d6da74148c829c2fa74749213142096d7b4fd3fcbc0d4a0b55a85e344d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b71bef39f0e77a71465a3eb5494c967
SHA123fbe368d0640f66a37a6973489c2dc9575b6690
SHA2560421525c05d3105d01b0927770c9af0bd3ce053e469397f6220cf9d98997ab20
SHA512034f91ce4a6fe765eda122c58582105b035e1ac15bf820eecc6653704f5d0ec34d160e1af190acc58341d0f3feedb3864ddd7f720f4228bbca49dd60b7da988e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad7f00eea54e9cd06c41d6f2eb1e7da
SHA1c1fcaaa2c442b4c99a131f6ec58576f9d7410e50
SHA25616719bbad8e845f9efb324df7022910580a33db155a67872ebadf194332106d7
SHA512cc271d8d72346bf31234e1195890267883fb5c26104c19c74e20a7dfa7fc9d7cc8696249d2e96217e80261c2f65aecd0326c4eed4cb0bbc1d0910a6b30b7d791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51379740849f354aa87395dc2734aebc7
SHA160e1ecc284bb06b79132e72331e67054f3ef4c08
SHA256af0996dea60d279253dfc9deea8e57b9bee316a5ae3a5692a2cae665a81a9ed5
SHA512f8937ac67dc78e45bc0b60757c608106d8c10adda4799fec6ef5d92603761c0ec3d1ae5487e5d521ad9f3f97d79afefea91bde22c03f7cd94d5a5f9922802b54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e166fddded350c9eef4f1f4fca82b8de
SHA12ff17da6988fac0a785c4fc8b7c40b42cbe06e4c
SHA25628aad647e7fe3411cbdbc10e2492b0e5f28d8f526c0c386981a5d4b5b1af2f3a
SHA5127f1caa5cca00c40eac057495a5dffacec141563c7ffb4d098addc6e8e4e1bde5ceaf25abec035aaca8d31a787df9950960f1afef83551d425b4ce30d25613d6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d49f18c43d439026e6858497e63c36
SHA12a2c11a4c8a603c05ec7f384fe712371ead635d4
SHA25673b9c566f14d755f21137170aa7524ecd3f95464e9efdcc0c02a9fa1082e0d3b
SHA512d316d0906fb649ea18c93543986c9b8dd2d21fe52c091db9e94f044d05c670accf7d19ba6b06d5a0d87eba8931aaf30659646c6f351d4bf68d890038b1d1b33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4ad1e57e806318129adc8f7632168b5
SHA15960043d3a6f2b340fe621627ab191955daae3ef
SHA2568716ef3ac6f979c914020fcc1f19c9a757895c0d61f6e668ca45cab66d10ee81
SHA512ee1d664ed44b059e95adc8d5f5da82e9fb43efe472eaee469e4b17f1170e6ecd2277f72860daa6a1a1d9500a14b56889e79ffb9e03f65d7765ecc9f2811725c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527ce10236621ca06fdbf753e6b35d6f1
SHA1f7e5175ebb69186b5fc4d83fdb03c09d8f4ce7f4
SHA2564e99e5b0578fcfadf074258c4800e08f774ffd376838149c805024a57fd7f126
SHA512c24c891fc68a8ee352117abd5542d33ee68bdf1931bc8c3ab812334cc2d8df78dd3a920abcadd52e8c50913b1ba296aa7c07a26a78069e0622d39a0756c455de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555d6de337f99b9c16b56ec4b27368500
SHA1a98a74a62dfce6d962094f903bb5f423d876bc6e
SHA2569ff0bcd0910e8cec7053f8d8995f2cd0da30e1675b14a1c4b726dcd95efa8323
SHA5126b55b44e6da2f4cb489e3d6347ac9592fa367aa15b744d10a156f10f660cfe508252bfcb68a53d7b218752ff4fa9bbbbdf5a4c8802878a4bc165094bd7a92d9a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a