Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 02:32
Static task
static1
Behavioral task
behavioral1
Sample
697585c124457c50d152e6f8643d9c44_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
697585c124457c50d152e6f8643d9c44_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
697585c124457c50d152e6f8643d9c44_JaffaCakes118.html
-
Size
23KB
-
MD5
697585c124457c50d152e6f8643d9c44
-
SHA1
bc104be68925b41cd1c3c61b92d185884c64a057
-
SHA256
055db847d11585d44ebb7b381b5d6639a6a059cf3243c46a8de6b226e52a34d2
-
SHA512
06bfcab39dd993a319af6e13bdf63dadcdeb6a503b84bea41ad2e408a180810edda5e5f3e916af5f2540c50919cafc1025b5399d122330964df78004c8cbe6c7
-
SSDEEP
192:uW/Ib5nZOnQjxn5Q/wnQieTNnSnQOkEnt4+nQTbnhnQpCnQtrwMBzqnYnQ7tn8YX:UQ/GlS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a0d4d7b1dbce099391f37614e7e4bf4663c1a8764caf292c32a4512550b02ad2000000000e8000000002000020000000d092dab41ef96f000bb7601e5baf1443bcee0634b360ecac7411d60da2385f4790000000929cdb359995594e0b8b12dbc0e07d58fb9e22b813bc8d297412f2fe85fb160e7861f7d1f5425e9f6819ce8e78e38e260887c7c62a8e8a60e89786272f8959818fff0e4a0cab23178cab70a45716287dbad43f5225026f5c9c3bff9cd629616751ca79b5d4ce13a8053b20c9324add2213295f69c1fdf080f1df3db8e028ded9de9002cdde5f0b2524206056cfc613f140000000fce495095618d18d323bae488ae51c86036fafe19168310229a98b6cbd66039b26b45b1e8ca912a862889f6ff2e90f6a1358ca3a409ac6ff14e1a24de26288a9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60282e98b9acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C36D04B1-18AC-11EF-A9A6-4658C477BD5D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f920a0909f24356c15ec8620ba247fd25200a27fdc70343435fb2c8cdee38b6f000000000e8000000002000020000000b354ee4cbcb6d764a18be65bffcecbcfaa4718d844c098cf5db27ffc07b9e3bc20000000bc6017c8ca13ca9877d0587fcad4e174cd1fd4fb985885974febe065e07c3ed440000000ff2ca4d43ea43f69dc2703106dbb6ce094bfc7686a322afc5eee414066927b13da8e8b82722d4a718172f2b1fe4271dd9d7a8fbbb95a41a12c40e27a7354937d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422593443" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2604 1728 iexplore.exe 28 PID 1728 wrote to memory of 2604 1728 iexplore.exe 28 PID 1728 wrote to memory of 2604 1728 iexplore.exe 28 PID 1728 wrote to memory of 2604 1728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\697585c124457c50d152e6f8643d9c44_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502340b40daf467ee0e75fb828c98de00
SHA1f3ba8b29bfe436e9338b1669590c92b362d9b4ad
SHA256ad6e96f0ddfea15d99987cd03970a8b96d8e9fe6087f942d49ba3270af635440
SHA51226237d0bfdb4963d057cbc410a6b59ad6c7413c147cc8e98820b5fd22105cfdf06edd47a7e48926157acb993c807eac5c1943fc9bb543f1f9bc3a9705b953abf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bc8543ca3763e695ff9bed6e613cb99
SHA135347e7c800e668f2e5a7cfdd3ca82594120281c
SHA256670a6f438943e58a180a94b6331d04fe7d555d6f7caf8aa57397c925f1f815a4
SHA512f60fab947a40a5f9c2781ca4536f91feb8c4bb43ea74611758bce773859c41f3d136d9b28a15eaee0a2188f418edbc6d1d3de44a3b3fc03ca8b555f9e9591809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa86332680da2b1b29e6d27bf424ca1e
SHA1a7f6238145aa27e830f272fdc7731c67c955b5be
SHA256067f7f3fe53a0fe7114edb663083254ccb831230ad1914cdf37a215d5f7e6631
SHA512d2bbaf748dcdec27987dfece32f7437727ca81558ec80e27a242fd881fc1d87dc77945579a1d74fc8ae285fc7b35a3beab6910406ca835c1430de17effb9a976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e4b97ce5dfa70e95c71bcbde96e966d
SHA1250c8adac674cb4cfb1454f437fe4a200dd0c4ee
SHA25660701e37da15676a5f1996d404ef809949c4a2e0e9331eeeaa224f288b2ded9a
SHA512edb2afaf51c89d59736b2c2885a9e7e55be22765857880a3132ff2850641bb0c5d88e1994ef717bff0ccdfbed628a7b0a40847fd12bd0517586e614aa86a2896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5119e290aa2ea2dbac947e30f43d09593
SHA13a565c3b9a13e0e6ce7b44d85792b650e3d6eccf
SHA25663f156f7389d83c0c769a8d07fb2d0b901fbad6bc27f0b5af1c3f4bd69651162
SHA5126cc71697853c46f41a61a9174e235e22ad1a93590660d2c4a77033425d1a898b35ff4cdfcff7d5d29ea9f70ffc8736a2e3ad7961d54d49b671f9eef336043667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5501cf96b34582f3b64ce1029d1520c73
SHA1ec6fddcf2c63da76c70780e3bf90da723895d4e4
SHA25666fa7c1c4500631308b3a762f75dd4ad44fd799b1300cc4d4cc8b82532afcf79
SHA5124cbc233e0db868f390cb44bd85c45abe89403096a8ea5ae7c5cc3b1b31464eced9c2de0d7d8a457e6e493ca319546dcf9f5076efc3036f8a131afb1808e987cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541c86c6bfd6fd82665e96b15dbdcba3d
SHA1d1f2ca7730f6234efd8f068edcdc489bc6f8b8c6
SHA256ec173e15eeb84493b325ac4b7f1dfc5ff949f83a8783a5b6ff4331b7b595458b
SHA5121dee30c06ef3b85a9a6d9e5005711788ee2cc297e237271dc06d2944b8fc13fd3c3a6fc7ce2e59a2f9559b5fc044f55632337b22ad459243afbeb5c1973d413d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558e0120357ff03b64e014dda864b329c
SHA15a8a1af4c0d7750160afc8bd7fd12c3afb7aa139
SHA256d934a9421134314f109b96cd872126468c9462b51f93e7c4689cd59838509e62
SHA512cdfe3a798318b6fe6bfa2d29919a8bdaaa4873c3033d104adadc6992a431614353d3314fd5829df1610d7c0143f951c871d0c11afbbdf0b59843cd717d5dfb2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e58243891f1c18f3a5d2b43c0537383
SHA186e7f8bc206c12c0d946627fcfd7506e9c27b6d8
SHA256c468edd0aa6f89b0a7eb69ce84e6154154a620abe77688eff8f5eaea8645b23f
SHA5126ddbd5c03eba0b6df7059b8454c6c4b24358e0810d21d08f8381acb850c7774b6c8937ff1128f7c9bd3ed33f980d84f63747267606260086fd07a947d6eaaf2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b58390dc7248d2f0dab5b9e1c4d7131c
SHA1e3586cbb7c8cdb71bf798c08a820234830954c9b
SHA25632071a1050b6afcd5d0247ce6715bde5fa602b23061af040ac8beeb81c772aeb
SHA51279bdd05d9a7017df391f695ea4154e2254eb84937bcae8d4ce57fb659f0be835606f16524e9a3794b982c66067b251a3c5ab4cbdffb3f12f62e6aebd97cdcfcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc2165574d0e98259ff06a63b5643200
SHA10a16a6893ffa52b111ca82575f56a54ab6dc5b42
SHA256a08178a8e0aea08220aeb3f7836ba61ed8271614051ebb145a4b92e1768de72b
SHA512af8fad54a5b9241ea8637b9497ad589d9920940c9c85fa85c131aafbe7e239db4a1872c834ac46ee6bee8bc6751acbe4504a9ad2123802a1bae3661ac953cffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ebf3504a95573e0072c05bc83feaeb4
SHA1d88ffac78d2100bc4bfd2d94b3d9ec648b232ed8
SHA256270162aba0b3fe8cf29b1427b8da7a25613fa05ad68021c902ff77f7f7649dee
SHA5121e8361308a8d8a7838f3ebf223639a339fc396abce40944c48d3712eb82586fe4e4f11d42ad2f68497821b94bf58c224b961b8f6c22b910f06251d651d7344f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f6fa123ca163709b4392b97a13a97f2
SHA1d34cc021098aa7c7afdd0f10c57c0bbcd7eb8a7d
SHA2564acf366f2f67f34d55c50c9e5c2d8bb96468d4d4461444b641f6a8677cfbbc51
SHA51236708b6f40e2f6036308750afe7167dba49d40d07afcfe26ff6ac6b6ee44320c5a0376cfe9e58e26796ab4fdfa3a82cd6a877e58e9129d3cbd1a52bc34dc25bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5146e479efbc3cd5bd3a070342baf4857
SHA15964e7ed0978237933616c256c57de4ce441dd4d
SHA256c3994823721747ffb396bc5cccae16d1ec1eea6a71128b40be501851c2ee37d0
SHA5129a913337e1cf2ba438ca9fbc743a99bd4a9dad464c15043c89365859c57d76a1b295a07dc3dc7ad622d94bbc5dad73d1075bb5e34637a1f30fa5948502b81ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b58a89e9634af9fcd034acc0a4cbd1e6
SHA1a972a70238f5273e5c76dde8828b1def83f08fa7
SHA256d8b2dab558d8bed6adaa2d0939bef079ffaa380ebde85658496a1f63a527ac46
SHA512064fa1f6a3ca413540d77f2e07291158bd802e38b1aa82315957a48917c675ca7405cf5388a37126bf5be84a9f6211aa3693fd5ededd3b1b45e9ca41c41b4a9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e974f5c417da443131969b8f3e81a87c
SHA16f2f04c302b14e10041540ce28480e6b9b821887
SHA2565a8f57265d226b0da156c6d31420c041b7907d0a98fcc1a88b0bcd446141e8f5
SHA512438f1699cd8a1e1b16e8ba26527e40f722f6af4d3cd01a41d7224f91fc734029bc158e016c1b2e6680ec5cb345a31fbdf279ee5bbb665d21cfe4aa138e7bca01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f131f1e635405f21c796152523075039
SHA1b46f960cfa0e140ec8cfafedb70749b84ee82908
SHA256efa62ef3db2d5c70077ef3e3b3f0c3b24db09051314b1d47d2d958385e991ffc
SHA512591b29013da00f0f10428e0f0fa578d96b32ab241401fe7f55c552f902d05a51c327ae60e3c8696ebbb260fa184608b5dd5da0954e893a507e90d0f75fcf25a4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a