Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
698a213dbab108bf5eabdf571999f30b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
698a213dbab108bf5eabdf571999f30b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
698a213dbab108bf5eabdf571999f30b_JaffaCakes118.html
-
Size
62KB
-
MD5
698a213dbab108bf5eabdf571999f30b
-
SHA1
75042f8eecce09b374dca9f44e4d6fd2213d9eb0
-
SHA256
23f50a8cde500cb973fb0e2c0f26db7cf9f8f30666a8cc63d34b629c8b08eaa5
-
SHA512
4d58c13c51268dcde4ade372461c4d392d11ff5057f7a0339c76c49b4e89ba3e5e967012176ae05528735121d11594bb49819ff3c1fd1b2f6362281d0c74535b
-
SSDEEP
768:Jiwfgc86pGrbXWeDveooTyTC8koTnMdzbBnfBgN8ZKa64QFAG/scL/Ijky/IjkQd:JUwselT/pc0zbrga6vbNniK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{851B3EC1-18B1-11EF-B20D-42D1C15895C4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6006d059beacda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422595487" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000098803d93acfd1d4982648b377e100d03000000000200000000001066000000010000200000001f560cd9beedae67ba97874ba1d19bd18e892158d63d11cea2a528610a264d6d000000000e8000000002000020000000d644091a19e1744a4523e86e7e26f4b183e4fbf63909ffb0f604e9f95d6a1cee20000000fd64c4c32a256052d12f9373f04d48fb26e1a396a7b5c2b2582f4938a7664a8f400000005e83d94171a5fec654e65a1d62b5b3040a4bb77b8ceb023c7ce8d15ab0319e1d36c4b610e379eb156b1f10b60d6c0c1d685d1ba60267709653c203f037a272fb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000098803d93acfd1d4982648b377e100d030000000002000000000010660000000100002000000049f2d3f63788087f5df50fa28d6c03e988266be427b452e50b1a0156d10f4d6a000000000e800000000200002000000033baece47f37800c759c8437db010ea12682d3f0e1befc8970d714c1b962370c900000006d5599eb9986637c1063e1cab89cc405e6843551785dd8b853ba5f528b562937687f63c427821367a73a1a4e1660244eddffd4a2bf6764e7b5d98b6d2fc7e3e3f9dceae98d953887b92d269bc2d85143316e8932eeb11ff1265aaff9341f0dbbf318cebbf8383a81b4078fa25cc5f7ea7fd447bc56d21fd78d48cce3e578cf849c26c2221f9ec9a5e0bcef721c1dbf4f40000000aa4e258287db04a5bac0602d9f0a13ecc1507faefacd8455255a63967d617b66f082291387c244293c944254555451bc0056541a5bf41de1e765f477bb751787 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2520 2220 iexplore.exe 28 PID 2220 wrote to memory of 2520 2220 iexplore.exe 28 PID 2220 wrote to memory of 2520 2220 iexplore.exe 28 PID 2220 wrote to memory of 2520 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\698a213dbab108bf5eabdf571999f30b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586fa990cc85b9cbc755640c02a9b8570
SHA1fcc7df18110b147a139ba44b81454121ee9bb8b4
SHA2567d1608c190c89202b12506564270d5575eaecc2b423804d627ce44ffeffd76bc
SHA512d58b8c7217c4187950b341c52c6d98db5e8d61c388ebd1d64142cdee7fcf12296f831af0b721e37734434c42af36d05e2638de036a39a858afa178eda703a923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552507af66a8e122c01cf1760412866d0
SHA1f50a34e3df872cb95920abc250f9ea5e169a87d4
SHA25680b448be87eab594987e765122a211fb26607026d4223cc50b30399faba3db05
SHA512b5c02e3d9f293087b56a363c63570d4f9f609c9f93a9447e53c4185314207fd7983405cdd7a925f0f26f16e0428a1f5116f93fd8ffab786c221a6b7353d1f738
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50727ba823962216a7916330b9d38a90a
SHA194b3fc6a9691db7f2bb7f07b5186dde7517fe9ed
SHA256ca2385b326a229c43a5f21a55b04fb62318eeeac5355f34f4255120579745bb2
SHA5121a5e217b6f78ecaea2e410b5a5fe13978085c26893f66f396ff76e16cbe1f5bb380e561be56059793094afcea31a7aac1475347e2856430e05d1ef1d24abea69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565fa1695fb611f8b47e5b1c4a592c417
SHA15f17e391c0680ddcf328f57414a703027c109153
SHA2568e1ec235852af15cb8defb9858a13826059fa9ecca3681c14df9d5143ebb4d68
SHA512827d2a0d022eed9faede2d761642d0fd17d82c78d20e40b6b7437b778dcf2547bfcbb2d980e4b0dbc357e555cac56011a6fdafbe06f5631089f971d16ccfe3d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5709e75907a9939e939cc39ee2ac49347
SHA190e8dbd1ab1e64d9f8a15f463999999538f8d924
SHA2562e1fe0cd57d6d359863350a28ed7e746374579089c953cf9caef8ad59ccf9de5
SHA512789a8694d6aeb49dc64247bf8dee77475d0fe52b213e66328cbc6837e90a1b80eae499e496f9911b73797c612854e18becc10905d930fefe6dffad7dc2c51fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3db9b9c24962f97c5d6a47631f6533d
SHA1f43f9fa9953292b0fb577c70ed98b64898894aab
SHA256ae92523c2000cfeb2c54eff8305bb7f3ba4787900f7a0c072a0e3ac4646eea74
SHA512d4b43c949d0f07e68518716c4ce2d63cbca816ca26e8c436d9ab413e46e43dd908a8b9d0c98143de4c69f0b678a019fbd8046ffd55a0a7d437bbc1224cde333f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506863206912c62b9db2f69aa014da9ca
SHA17eca9fee988fc54163107e4c37e973b8acca9696
SHA2563b387c5e80adcd85aa438a62404ac19528f4e62ac4968a3265a5190e6e203598
SHA5125cfd321a19f6a9bdc0827fee8766b0aebadc3a60898711d58dcd069b58d2ac796bf789911fab1adffcebb1e1f3323754ecafd24bbd44b0f7a4b80eac900904fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502f31b68f49dec923a727e3ea92cc371
SHA15164d761f5eead4fd4ac5018347ce61c2b43beef
SHA2561991866d7e94788739293bf26d434b57a2c830687fdfa59d8bea310845cdee0c
SHA512eef6830b2638f7d99aeb01762e81966cd5e42685a45753ab475c25307425868f0edbfe35f3f250d46a879eb7e71f10f876f6296425144236c31cc865a1af69a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53126e82eebf5a837aac7e4b4faa072c3
SHA1e4b1be99118d923cd93c9e1f14ccd94fb3128a8a
SHA2568c7ba3b3baa88bcb7234edf0f74641dc2e0395a19bcb58de6331b11c529a8656
SHA512bd61c724ea9fc1b4eb23a26f51baed42cb68c06d05713459f70526edcc3eb77a968371877d0315e0b69f13fbd630b6195f72230af76c8b4004e69039c824aa0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c874fff1c92df4cbd4f8af8324b4730
SHA165586e25862cdacfd19a63518c39963e2934dc6b
SHA25673a86e2235192ed31f0a4396757effc13367781fd378cb00ecec220753db6877
SHA512c5d24edef2c0025facf8d42cda5085e43b291e7d0b1e5f36b043d926782862e77817cd199b118c7876d79f1234e2c7bd4cba9a9423ed1502e8c9d27b66246d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abed6581719cd79594b7a1199acdeb72
SHA1ad1fd018aa3f8a9384962c7ad38815d6e890d3ac
SHA256a645e249e10e872193ad6840b2438f8ca1a515f6ebb4098bef02633d5dc9209e
SHA512f92962ec28e9f25b2dc79045114468f8664359a033a4c87658b7fef9945c5fdec1786796481d65382f6d2c25a534e7de6470cfc5583cd6d6bcfacf7d26af729e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a467f0ee09445c20ce7266bcdecd7e99
SHA12f8175b949db997325cb1c3e44ddf745af8fb41c
SHA256fefe9ff2057cf8dbc49c384212319abe51076da43a39e20515fd8b7388c0e638
SHA512ed9b9caeb45d0da5b6d756e2fec9182b81fbc063878788d669f57c80067eae08e9c0d0318c24972ca394fa8bc67297c1ae319d7e4dd619f400aaf87443487767
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2ea6ea689fd349fb926fb4f2eeee9f1
SHA1dddb3c1d18eec754ce77dae392b0efb73882521c
SHA256adb3269278363df88fa939f3527558b4c9d27b5321e76c8ae60e5e5c38dcda86
SHA51255d26c2b1bd9108f78c9d8ef550c2d3b25d688e3cccff13eb58debb339625c33d8df73726d910458bb40f46cd02f87b9d039321abfb740f0aff30907e1afc695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4e4b0456d5de1d41608a83134055d6f
SHA121e27852d8678a65c5d9e666b820e344b749ec37
SHA2569071c61ded93b331705b0fee0b6ee28879e2efc7d3a71165b316c7d7bdce91c5
SHA512486c945155ea3710f69c124e0faa9a3224457fa3aa5fc137718babbcf7c23f64c8514a4d3a02249fa00363e4fc495c631325e08a91eca0bddbcb79e8d861b119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579a843a74ed044a33faab8bee06e26f4
SHA18d786382f0544bb5444d429711acc1519e94a35a
SHA2568a6fb355faa5ef7ec36d05bb477586787494c5095e9d0d598b4ed07c2cea4ccb
SHA5127918ff2af8a12f8fa8e8ceaf0c4284fbc55a50cbf4660dc35a3ce6b43013e715dab0449291e2c52026b5fa1c137592d198ab192efb8679c491dbc99a2de394e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b44fb0ae7772ec8ccca8e80f547870e7
SHA1af04936d9326298ea4324bbd1939805952ce5788
SHA25638d2f6312346824aabff7a5eafe02e31d92c687e39d2633dba0ca9e42dcb6669
SHA51253974fb1ed13fc3ddfa79af6a43c8a1f747c4950270a7f3138b1ec98fb9ae5248660a249d2a42e253009a6dd2286845b77f028d9d312c67ffb1b1997336d1f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5620208c84222fedf05d25ca5c3ffdd35
SHA19c21e153976c2acc0da82411441b723b0e7166da
SHA2560e3770136f847e3f2ec60e57a39d52acd294fff700eead09c8973593977a756b
SHA5124a647f67d143fceb69aca62823b763e667cdbd5c98793545128a2a7c23e250410eaa4d535e5e5e1d74465086fa7212e26400ceb59dcff62d4937414305bbcfb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d811d455255ee06a813c89ee185776fe
SHA14dbba5aff3e2df63ef8d18d2ae7ca69b0eb84ebe
SHA25690b6dce1c1c43dfa4a83a6059e33cb2190dcee2fce0afaa492c64c2e253cb1f7
SHA5125f34c74f9bd1226f29b20d486e7a83e0ac2ff4eab14a518529c874d2c3f6265e4d8429255b7844703966f873bb496d53341448f58480308ce7dd5426aed0a7b1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a