Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
684035c6a5e30558faa89953eee82f8f_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
684035c6a5e30558faa89953eee82f8f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
684035c6a5e30558faa89953eee82f8f_JaffaCakes118.html
-
Size
13KB
-
MD5
684035c6a5e30558faa89953eee82f8f
-
SHA1
c56f16d7de66e2f58d88bca0a137e42d76036238
-
SHA256
b2a11b02a946eeac2239d07305919099a0351935456ffb356e0acc0dda1ed84a
-
SHA512
03e7e37f67a0584b5930f665fe881a49d9f9765444dee3c50874a51df1df2f15f0df0dded1121b44a631a59cb0b5e5dbcdaeeb2c34b62a322d9fd25bb3400c36
-
SSDEEP
384:KnT6xLK+Yrrcy9H6YGFKX+i0xw5Zb3Dq3j5e5T5k51565H5a:jd0wxwzygp6nw9w
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93D4C1C1-186B-11EF-831B-46E11F8BECEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f0526878acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422565447" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003422190813df0c47a40c334ba71b5db000000000020000000000106600000001000020000000ae57891af285d8b9530b612032ff602d7c5f3067119ab150882f985102a9a50e000000000e80000000020000200000002317832756f02965f662e13611e10cc2ca22651ea42277d2ee96d796587135d220000000afeedd56e91fa5e08147ceefe75cbd307764b82ebf36e022f2ec182cea9c08c540000000edfcc2d6dc83292cc67658430747020ba17d436f570bb8c28141c855ea770350e624c843aa001ff7a2fa805803c234014a01eb65f572926cc25abf5a7cc974a0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003422190813df0c47a40c334ba71b5db00000000002000000000010660000000100002000000048cb1b4a1bc47786c78cfc707505f6f9f877acc55576a337d29710d59190ce2a000000000e80000000020000200000007f9d7bb8ec7c4f5ffe0ddb442aeedda6f3bc56911b15ca586dc922fb02d4483890000000805860bea145e9d5b2e0519c22f3f6266c6f45ed8fbbf1b92f0f1dd9ce8a6a1cc79cc0c0ea4d41ec0d5255baf3839689675afccc78edb4fda659175bdd4df5cbf8ebc0edf1f3f600a3c15110578be67bf9fc8064b4d08fedd4578339d96c78815b03160ee8689ed471b84b2775cd990062235b141ac305be95444b064847c3afb0461f1c2abd995e14deaf7906c4682a40000000aecce5ebd70d9030057c003ff92b2386b85777a2101b56628ad5578db2f23362aca0ff2db7165f46335cf1fcf9c965b1dcff7cf38cd1db111e62f4286441a690 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3064 3032 iexplore.exe 28 PID 3032 wrote to memory of 3064 3032 iexplore.exe 28 PID 3032 wrote to memory of 3064 3032 iexplore.exe 28 PID 3032 wrote to memory of 3064 3032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\684035c6a5e30558faa89953eee82f8f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b547fc6d1770b14f9b5696a90b4c8912
SHA1af3fe4cb28341033d4711825c14729b2aab4b031
SHA256c6e633eddd10bb105cad7fc3a7de172053b4245b14354c802c7456e54c2f49e3
SHA5123ca91cbc4b63be58aa83499fb17e2d84356c0c84f4b5fea8e7e3b9366de804282863955871e61aedeebf4eea1d8da50434ee463cd6d359b71fd2e66464c3c99b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d253f7c029d0f8bbe735324093fc3e50
SHA122cb1bec8a61dc1bb19f4f3b5510e8beb0991b35
SHA256cdc9a7950459a4cbc9171e40c74208925f8fb16689fcf659e9d83f9555a2a51e
SHA512aaf1e373fa43cac6e69d46c874c4d6839c849dfeb0d2564150035f6ce680af6f9219233b2d953df25456b81dc2792e1c60e46d0e8ad3a80ae8afd483d68ee7c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aa5f895f1f2edd7c7829a94fc675237
SHA118d4bc673de73e61902978e492348d033bcac895
SHA25610fb16ed19bde2c040c089533eaa8d3c7cc74fe40a91f2ba3c3b5da651b4fd00
SHA51295093c796d44baba6cc8cfc870a78567d318530ca77e4be00e1565c79dc58e2b405b2f58a4c8f8648ae0e6d762763abd4317b05e60930f6031ad38cac0e8b808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533699ce980a808c13520ee800e21d9fb
SHA16b1a93a9142d915066e917d72c50108f7aa21711
SHA2568ddeb6bf2f4dc0effcbf91a7a502e80e4bfdd910b69667e2c5aa0c08f349b3db
SHA512abccf55a11ae3448ea48a6f7cebcf5485ac39c1909bc7c6de2a67325d0fd599b409a98e607cfcfec1f6baae3bb285f2e0c59793bf85dd3ad2f6bb617851013ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ed522f9d309fd49bd0e9bb64e3790ec
SHA14fb6b38db04ac4aceb5742a61369ba37be010db9
SHA2567f71eb513fd8059dcec8743f288c1ccf840ddce1fd48d91264d058dca322227f
SHA51230af2e50e38c15a457859ebd9a147ee93386544369997a143b1d127cecf8a6c2596dd45254fff64fd7e897c856941beb8986d3f15239c47b85141d9883f808b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564ec7140c8eebb83cc37f63f1fd99e26
SHA14762943d7b662d402dfd08ea930b2e40c7ab97ba
SHA256f49d5860b97a5f3eecfa27953cdbe5c26866265a7cd4a04fee74a309e82d01d1
SHA512f3966d31a0a6f5fa83fce56a74acfd4df97b3a68d70c7737b3b2c92ca839aa3a3f3fca4113ac74ad16b02f2fdd292c39d640110350b47d78e0bbb413c0923327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537fb48149a36e3a4091f06c17e4364ee
SHA13d37a92bff8344b845f46569b3497371aa80fd25
SHA256340c7c7352ab8d3e9ae7f373a7c30af8e75786c3741c080055de6d5dead75dbf
SHA5121be4bd59bdf29787419d2605697ef8a4996a14a1affa73073755160fbec347e3225a64945ef152852b1e4d484ba79d81a749c882f185eb5e5d7ecc1f03043ca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e49e0c700e82d04895bb2d4719f4077d
SHA18fb504230e7b465feca085e5705fa712f9c44a69
SHA25652c76f6ea436dce5fe48291d75b554b6e09663fc0ca363a7048fab0a862bc53f
SHA5124951fe4e43863158afe5b0a93784d6e96de4502de6b5c41c362eba641c29d616752212551b2efdd8b7b383b82d4f03a8b0046bc5eaa188935f37cce8c4e600b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517a160baeba3168eb83cbe19a8783d31
SHA174a2ec96ad4dc4a31d0f22fd9c902d1400cea9a6
SHA256bed1eadb48e91fa2f4ce8df2fa7b9055b7992c2fc925958c4cb1c0b2f7e2cc0d
SHA5124bd0c676c53a3001040deab18cd08e783283380d9a46e7d2742e799fbdc63ef966cde7ce6bd1cf963457a8e932bfb836dfd25d6043550163f5b1f53e5a0e7550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1a3d9057c4446942fbbd852c71505c5
SHA13b524ccdddddd8c3814c62d47cc61ebc3f069893
SHA256093de2bd37dddf381851375c5ab930758bdc2b40284b576cc130bd26779e4994
SHA51255e9c4a279a0c2fff40d8410fb875a2cf14ad9a6aaeed1c31a5fde751890d09e7a579ca8c062804d9a7fd166ae199880a6f84a26b08c01fa3ba3f8d13359786d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5272bbe6660bffe9265209388b8a88b
SHA1f367c0dbd82e1f51e6c6b93ba0589aad66ac6c9e
SHA2564c0c59d02927b8b52885c0cbc0af5e37d63b0abec7cf969d50cb9ff719cb5d45
SHA5127afdf9521f96575f0dcdd3b011bc8163f1567664f744387decd3555c981a58714f5f68ed4b075505925c782e39552c90684093f76fb7e955f8d2f2a20cd6934b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7b88e09bd6f5fc2568f4a100e6c75d7
SHA1e9d6ec921d92019b7b9f02ff1347e9a5f870145d
SHA256f437881426d270f6cc82b297f6b0755dc2e7ccb37cf80e3e623f4d959e365fc8
SHA512317dad7a578670af4af2107fc84bb8c9ec97085b42a0cde44a98f6f5981d473659829d2959668011bec993f63a25c589426cb8e3bcb187fbda479beb969b3f05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5be3cd42d0ca63ee0f4b599a4e02955
SHA18d60af9342843cc756eca4a9c90694bbde7523c0
SHA256e8a54c80405356952268310336668595eba27b0e916206a7b895d2a62daea096
SHA512af0f47eece197ec476e5061fa9b1b558737d4d289febcc9684bf01445c363bf0ed6df960ad46c1ab305b9a287971f3e08a68a188808430cc9c6d43c0a413db40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c59f1a9b687ebbdaaf7c518a97d8b17
SHA1bf079145d4a254cbe85238a82ad00683c87fcb21
SHA25665b3f344a00df51f83fcb9a20c5c00c34760b7758cf3919924b95225924f0981
SHA512dedd034dc92ee52d719a1eb5e8b8b4af938064b34161edadffd1fd2a1345ca3fa26752863e69a4cbb1139c11fe51dea7b387ebb06e921f96f5f406291a88ac50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd668d79342074cdc04feb857294a81c
SHA1200a8302e9eff59a4b511dae5702fbb25c29f2e9
SHA25643024ce2bda8a041e2c7f1e3060af09e88fdcf28f93d4b8ed5616e315f25f0bf
SHA5124fecfd149b4b649acbd818b975a092f0a43166a764ab4fbe5df5be7322256f348e53196aaf69ce0326c2737368549d5d5ef81581221fe152c05c9995945fde22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562027dbfc4c63f10dcb0e9fbe117d28c
SHA1c611986ba7e9ea8372b05c15676e1b340c87afed
SHA2569391142b85baee4b3e75b93bb4a8212a2b6eac0e82c5b10af4f33e2715a3bc80
SHA512a2e9eca35dc3c3a142fd9a9a41c073eae9240ffe57930de7869f9e6249cfcd99552f6ac8dd25364303a95bea5c65c4ec4238f33c36d3be2be2d330e64ab46798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58380a0f903cb4fe619106f4821827726
SHA16839be6f9b57b1b65f0a6da9bb7f90eff33d3a31
SHA256fc698137197d14277a2b4c53bfd6a3f8fe4cbd186988b358af61b4ed0a2097d0
SHA512e438fcd370bd491ce4e43b6376ee7b72659d1fd52deb44f854dc052a9735296546a1c450a3952867a350ee3228d9b4ff7e1795a03235dd0523188b54e768e89b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6b5f54b9a857b7c5eed67caf90147ac
SHA138f33cf07c2964b886e65acc408ef1b16577cb9a
SHA25604ef6c1bf53c7b3f806b4d7450606246996d6ad8b37ad3ad8e09820ea161e2cb
SHA512448ef448182495bd030c84b9539dd2ea1e26e3497de5f6a64d2280300ef0c727381af9696465c677b8739091eae18c66ab508ec31559e95ce6e84eee949bb940
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a