Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
69f2717131e0f1ce76709083a9f25208_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
69f2717131e0f1ce76709083a9f25208_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
69f2717131e0f1ce76709083a9f25208_JaffaCakes118.html
-
Size
27KB
-
MD5
69f2717131e0f1ce76709083a9f25208
-
SHA1
530fc740122f4158eb4bfe8cba5637397b6ac911
-
SHA256
bb669b8a764752ec135eb1f21d71803767e8275ffbf04b1385ee916b3eb13bc9
-
SHA512
f1161b1bbf2dde2a1bbecca8da839701cc4898cadbf2dcdffe3f64cfa418e45ab54b603d8fab01cd6033b041b679504244079650bdcd07c8bf2d7ad6629bb6f6
-
SSDEEP
192:uwHsb5noanQjxn5Q/DnQieyNn8nQOkEnt1tnQTbndnQ9e8qm6uBKEQl7MBSqnYnI:5Q/4lCkKvSoTW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0746a81d5acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f2a9e15750f577e5ae68e278d97e8e252b2793f1702986075d45d950a196a907000000000e8000000002000020000000ebf683ba94145bf9c90554ae090dd0ac102cff09c2f7f6d15b6c234b8d31ea20200000009b138d5fb7eef30cc39addf1f037ff523f2a201db3bb5aaafbec5bd9c8b99c3c40000000075defc2f54b12e5b0c1d81c7e2b064a06c9b23c54a546bff533cbe111193c5bfd76d27fcf7ea3e603168d8af71ad6c07072623f687f8e6f48b59a55d7cec824 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACC8F681-18C8-11EF-9BF3-52E878ACFAD8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ea2c02f3dcc76e3c2b7b45574df158f11f96d0a5a1ff24f009cab16a88b700f4000000000e80000000020000200000009ff4156b98d76ff138f914139ad08fea6e71fdef4cd1f300c605676aa088c69990000000ffdcc374c39bc624ec1a07b54ffd134720ea6186c8de780ffbdc341ab5de6b49922e2168e5c8433a695a4ee9901b00864b219bce13f033ad18b1f8893ea0a707c9d885c02cbb260e71286674dab05e42bed5b474d2f74eb60d22a772674559d45f2dd08d43d376701bd47290b35da02668c12c948227d3901ec747936f90d2118ef8051acf259d61fe5f01d0781bc0be4000000095ce43026cd50989a1bdc74eb05ccb11d1105e51db56b6306f6ad1cd175479241718d2b064cc6403724cfac432ab02a48bf6a0ea1d29a67a768a26dc6c5933cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422605431" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2120 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2120 1700 iexplore.exe 28 PID 1700 wrote to memory of 2120 1700 iexplore.exe 28 PID 1700 wrote to memory of 2120 1700 iexplore.exe 28 PID 1700 wrote to memory of 2120 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69f2717131e0f1ce76709083a9f25208_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550fee3a7237faa2d04f73e3aadbc2d6d
SHA1243170f6dadd90468f5ecb1ebd7e3271c9207bda
SHA2569b0cdc902d8604d5d7404ecfea24b22268f2fce5cd602066b466b0721a5bdfd1
SHA51271f7e14fb920fed4decd65c01c714e57c51f48abd1701e9d7eadcd949fb11a4d4c4dfa09f1b71a1f687322c2a9b6305e45c2ea84e873f3a0b8e06eefd1e7694c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543fb5699fea90942e4b412f3b0f9ade4
SHA1709e2838b9992460b81e3ca8b5db4c13b9ecaa83
SHA2567476fb510c00153a2aad11d3a4ac486837c09dbd064f9255618d963eb6c258c3
SHA51294af1d56689548e6515fd291c42c84e0e668274af14fb2002ff984603d2a9211746807327e021843b66b881f725eb357cf7d54e3f7d8ca040cd3995666a1ad0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5488ae6837a1611ed49479e493a634579
SHA10237058da6ff5b77dd0595ea5358262192af7d9c
SHA256ece93e34d84163dec3acb49d2629295fddc35a2b8eadeb4e46182390bfb8eedc
SHA512e911b70b6d1bc9809011f3df0168ea42e463bd3cddbb6a70cdf78f6022120c5e71075baa5c1548b92344de06ad74e4e3cebbc8ea63bed7c6e749f01611542efb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f29d026352b9633dca144b306e6ad1d
SHA1b653feb03f837479f2e020aefb14c1ba47671c52
SHA2565caa8f0a1efa2633454503e83eb97556d510455c3a9d546fa10258252c473f36
SHA512e4e2fc92ee4a99afe6d86838bcb1702971be7632803d9e12ca12a467f26219bc2d4034b7950bca87437e94831571aa2ea84c9d102e5700fab12abf3fa7b640c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577998177e6c539ece976ace9ad13a5d5
SHA1e3f234aab126b7409e78b1ce83f2a2701b931a6e
SHA256dd141692885ee91e0d7f5b39e81638dd408f1e453f420a99dc5ac5cc8eb1a9c0
SHA5122c229185b0ae1a7dda0bbb0a7c7ec16a6d9444ff3985b532cb5f8a495bbd440b7bc44da7b093a395ccd662350079ecde7e37cb12c3702085ab57960c0330c246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b975daa5bd1f0ccd0bbda16d5b59bee
SHA19c5601d200aff633e12a915f12c7d19961323149
SHA256039178952979f3beff35a9b0718ee8afe9d102e4dd2ceeb89452220b99aabed1
SHA51267da33876f3b54e260aaf950587f44c2a55e4f79978177d0a7aaec5acad692875ca3b2971f6b86735043304d9654fe601fb1383d4e32967a91f2d6cbe0f59552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5306d38a270ba0654b5a390104f5c6c79
SHA13e1aad4a65760a20b02e46ba4c31f3659ef54f09
SHA2561122afa63b188b6c24998fc6ff32c221fb5bd675bccf72c90786ac5a29c8ba4d
SHA512092bf3fd1e54ef7b93ba957275a1d880390074aaef9a0f53cabf6fafb49ed6b7855e0c7c0d608c7592034a26218f2042756ace5a1cb46a72416d6286c721a616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589e24788ccc6e1fe4f063c5e93db4f3c
SHA1a50df2f4ba0fe4ba6d4b04a82f62d2aca87fca97
SHA256a50733805b82e99fd1f345fbd7c1da02d6ff9deb889af279b22cf74bc5f847cb
SHA51279885b931ce1e053844d11a8babcfe0ad353f2cab10b76ad8b28882dc26f22071c555a98e47d1491dc680d0026b2e6f964ced894f36b09c73f3e4baa8136fbb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5177861faa12d7f816fefc8dda6d1b69b
SHA19b272651c518c9306e31174eb7e94708cdfab537
SHA256d0bb26d21e8dbaf08b8ae57e6b355d19491d9364f20eddbf1604890c04b62f60
SHA512542db4862af18a61383463c97f36480b50051f03874e618cc1f36757709058dcaa2e2fbd75a4d79ed613f59cd427f3a1e08e3a0a59a79dbf970bf35a99210025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54566651aa6d49e2a5a401fd0e85016bd
SHA1591d5f38fdb9069c0eb218dc8ae0d11754e04a6f
SHA256d78a0a6a3b0bcfe0793d395f74908576bf54cd1d13e07e4297f5680960588d47
SHA512588fc2f5e6be566d510fcb2cddf704e0d4c0db1b98ff653337aed33ddb029ddc5dffb309d8cb69efa3b71cc0db458c149cc3929221db211e86bd3b5bcbdcf222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d866d2b017497d195765c454faf9cf3f
SHA154376ce5ecff7763764487ce647d32086e089584
SHA256a38d8aaa5ca2912a27b6b94085b628fc1a3c2e2c26b91c34d30f916d35972a04
SHA5127206b5deaac79344fdccd70edc183bfbed32a65da0c4c836c744b32e6472642589b8089bf2df655d02d0880e5fd4a0e0286edfa1e325491297b925c53fd4eba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a644a60d7260193763f86666c1405dd
SHA13aba8d18714201fedb885a9f3eeb57cddee1d104
SHA25666df24ea63e6601091c183dd46ef8a63909f5b4fefca0af69429513784e4a30a
SHA5128446f1477ab2d5c5c706747ac85794004edd9bb9372e995ede736c03c063ca0d47523f79f1a71e1d74298ff3200f6f8417bc284de8b3485bb2c81a823cbc2a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56387a62b8a1868d0c3bb8a056bed8828
SHA191fd39c7fd7c420bb1a7c28b13a9dfcb66a16e65
SHA25638a834a3c92e8bfc5a99d81ec73cea1b17bbef2c503bc964ffde287b5353e1e1
SHA512474cf821790fb183416c1be33e1b640140ea01c4cd0e0f962a5beb2ccdd8cb66fb7624d4ea759b12eca81ceaa4795c5ac4ce0a19a90164b907bba457f02af2d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e6958ee592b07530b433f970a5bea0e
SHA1ba623c47992c2f9b44dc6f26941fe7d5b6216660
SHA2564aff3847a3828b9a42d050527906493788cf27524b562ad0f0bf26745ee625e5
SHA512918a4ea16f136f093201f4a906b389e38ae8784f026c8cc3be61a476691686ef0134ca3791c08dc4ae7862635ff74395050880cc57a16ebd1a50a91673ec62ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5875ca14ba48fdee50170dcbde7d549
SHA1a808deba22d1b20cb2db6aadccafc550d8af1207
SHA2568849fb8aeb1d1d649fee8ff823e4f5713c0406ff512172620b041c582228e97d
SHA512ebe6f9d0c55b0d3ca140792c77c02f76e5d2710007f4a6ad706807e6f5793f90de7eeec54780315a01946fc6ba37beb516189384ea2fdd4863b7089d03d8f7c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a94b188e92f299a54e360643bf46805
SHA196d38e413c4dcf0f7dc0c6e56dc1d181b1262a96
SHA2561830ffc9de9d1215276bbe1b1a0416dea0f7ad128d0bf28a8194a65312490523
SHA512aa4a62f6629a42c6fa9dbd2450439f98e9075844e3d87c121866cc594136e1ce6bd15e68878f8ae34611b7875a5a4e6854b54cf08b885f90c27dbe13d24b4a3b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a