Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
7712688c7e2fd794b0af213688a5428a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7712688c7e2fd794b0af213688a5428a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7712688c7e2fd794b0af213688a5428a_JaffaCakes118.html
-
Size
460KB
-
MD5
7712688c7e2fd794b0af213688a5428a
-
SHA1
d7e91015c7d2bedfb9f762ae748175f100597990
-
SHA256
fe5fd467e73a9ffdb1bf9abf6ffd30198a5248750af819f34f9e69857c687c5c
-
SHA512
1c896184c26bbc9bbd638a2fb34ffcb0619d2cf66cf9685f51c6ef6fb44b7744ce282b2b2565c7fc79ed6a4661ad93f97cabcd3522e9a47993455943023f34fd
-
SSDEEP
6144:STsMYod+X3oI+YtJQSsMYod+X3oI+YnsMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X3Xz5d+X3N5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000079f04eb077f78546a76a96c2204d9af600000000020000000000106600000001000020000000741bc16e7691a8c4402ecfeb73e5864608b94952f86f352a24057469a3086b2e000000000e8000000002000020000000b3bb4532f30d5bf53f5305c3852b30a75a4ea8e31ff995ada48c3ba2370fec6220000000114520c39790c5805c86c64ab9dd272ca83e42f57bd5c99e3e78e569b1cf05ec40000000fbcb94b850d1257dc05372b7ba79784eef1cf21cef87410aff71fd1bcfc999919e00fb1a35d9e41d655d0878b457496885555c722f898ed0d5242396a6294d20 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422925816" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000079f04eb077f78546a76a96c2204d9af60000000002000000000010660000000100002000000023943fe34110b2b709de5665347d4b53438024e8346c84ad6809e58779abc92e000000000e8000000002000020000000a2a933027f61eb83a1d9913ed8716ec346e245012a7c60a1a93b82d0959ec19a9000000057a1afb51462bc69e08ebb2e5e349be8a51e7dc8e340e92f531ec12e51417bfd55234fc2befe459175abfa63e2b7825a1f6674fadb92d1371c1a68ab02d741e7e4c3e9b0b2a7a45f38391be85d9d13faa8cc81aa6b391699fd80b033db3d95daac7c729ca9f8db84303a750dcd5c6c17f20137d23f12ec2d9acb215ea21cfca8d5b6c6a175e1a078e09036f0df38ea7b400000008974932ad471de3d4f09ae05acc950ac884ccfeecf71b199e4e644ee64289abca1e37c2a4e9997a6cd65230c0b272c6e0463b6669ba7bbbcc2248077fc42d82e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A08349B1-1BB2-11EF-972F-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506b1179bfafda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2364 2384 iexplore.exe 28 PID 2384 wrote to memory of 2364 2384 iexplore.exe 28 PID 2384 wrote to memory of 2364 2384 iexplore.exe 28 PID 2384 wrote to memory of 2364 2384 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7712688c7e2fd794b0af213688a5428a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572dfc01eaf67e12fdc71969199669490
SHA144c2aa955b5308e485ab3fa504413ddd67d53091
SHA2560e09eba3311accf9cd039a0ad0fa0633a21188cebee3e13799d7edf98b172d71
SHA512348576f93aff33bae9b51957906b2fca3ed8e23bb4dca32773063cbf75831ae9eb2b92acada9c44022ab55655e962758c4720fb6e7046bac088a859856f2f9c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509b02ca6fd27d14c689d407a1582f3b1
SHA1e274c92f417f476e1643df437c4e2c7d32f0f0f8
SHA2569c4b2dfc494bbe22802ca18ba2a57ca01180b855e95b2bbe7104d97e9d5cf58c
SHA5122f614ec139c12b99c37f45092f72ee382dce1215ec7c118b6382b7af0ac93ec099acd25cafe543654d1b84e9a654c0207059ce2f3ea66b7ee1ab0ca7a6f796b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551d703eea822c5d32c448dc267d369bb
SHA19c76996c5e0b534d7941ec46300feeb56baa597f
SHA256b41206765d1f82465f0a1b0d0808e179e953eeea270e4a79723a16ee0d997ccd
SHA512c218275c2c68dfee8aa9d5957069a96a3cd4d4248704bc7960046c8d5ac838042f2ab8254bab321495f999a0e4b3174a9e34c9a92ae40cf8dbf84c693a9611d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564db5ddcf8f38f88e3cc414f10ebaefa
SHA13086075a4e20b3302eb794021e7a89e1334bb9eb
SHA25613fee84015a4a995aa84baa292d689241b6aad584aa870d8447baeba504adff7
SHA512d71019a596a048341d2b36e133c726efeb8d98007162e10cc6b157346341e122a3a25c26465fe58e11a0508fc15705b547a934f893a97a244c3d0d3c22a67ae2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a70857278fd441373e84554abc463504
SHA1a2f8d8172f77be440f3deccac4c73f3de727e822
SHA2567f0610563592a6af172c4d11ac3f93bb8f88856e3d7536cac454544b9ccdf6da
SHA5126c7a4aadc65ca96f6450de98f6137609caa9c5e01ec210509f95dc544057114782bed03739a67e9c9a1ed5bbdd4c78e9c00e203fed89b41adbd31892ce4f6297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591d09082cf37cafd4d0d434777da16f4
SHA14c72235fee724aef7b082b341b3eec895349611d
SHA2566ac5d8299974ca3bb1f8798e2a1ee0741e1195fcf4b0cb0466f5e4110efbf09c
SHA512f4dc0738a60241491c1a9d377220e1c0bf2cda57e94f5ef5c4a656ea9b5eac0c1c4e5a46f68f190af7c82a1bd920b5779659579beb5d2a98fa140e941314382d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564623131d00745524c351e58b56baeaa
SHA16dcbc67f45638256743a8ff09cafe795c655624f
SHA256b046cf320b2ce4bdd7588326102a55a32b09d5c9f3506aed4b364c396230e12d
SHA512d14bd0a6f75e32768a50f9165ba0480c9d899cf816626eea94489fa7b9666ace7485f35b85ceef6a8c4c930e8550df8c9471b31dbfea3a88c1a19f9fcc9dd4d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570ca3040c5eeeef35ec3f621ca8544b3
SHA1981ecb024ce2c40d57c311dd13c1464d79a9046b
SHA25656ef05d19d72d5daa21494d41f0730b4040a3d0cb4c1dfa56638d689dbb70a87
SHA5126ac95dd91404369c522f65b60e62cf902643b885d8613c9ed73ec238e8a6a0dd9b259e10f43340248fc40afe6a3cd20b19b3e0dd061a1419d9af721b338cf12f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1b19ef784a4a03e06673b9f888bcdc1
SHA1093dc088e20b9bedcc07d65c960f39849cf75a85
SHA25624d9bf0b82a091336e636f64b1722db7f9716e215b53d8066d3b486075df3594
SHA512b5539299d269846813aaca1b06ff834519c0dc5f74f16374501506bf332b4fff6e2a9dc96fb2f93b00350a62d7279f1a63a9ad6b941ffb72c82e65ae644231c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568b24fc29f1ec336a293f8480060d5a1
SHA1e7ceadf22a4a9a664d07e674eacb1e81699b503d
SHA2565b6d63ed66dcd42fa3db0294be49046852c453031d276ed84e4616a7582bd864
SHA5122e3168fa179aa46b8a5e7a70a03e169d0e5ef3739bc27b028f14b1681ba5085cb96676e4366822d6d749e362093ec590392c7d6cd9dc55093e1c4620790c0f23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae59ddf0ab6eae6f5ae6d37903e5c230
SHA1bf86aeaf3dd3393f4c34df28c511fdd68758db64
SHA2567a168b3fbbf578959c27b2ef80f2a65ba4a85b5a2b57c530d446a43a3f89d72d
SHA51222f2d2e3c2a66376d53f0f34acbb38ce940f00a13f64f6b7584f908bd8e7d47b4d5a0dc59f829e960f79fba8fb439198ad05c591e7ab24e9bb7a8f64c78b6170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6acd56952ca2d4476458195c40db38f
SHA1c46e53965e463aba6bc482bc52884e54d6271d3a
SHA256a2b218610e9fdadde83c009c8d5730a733a9ad18293bf8f67e7c9728f4201630
SHA512077c7e858aa16938110c92138d13639dd97c8806bc4e1709842fd88c39efbdb11da67ab396e3f93e14be95d7f9d72b193e8e35836d5b4426ce00d34d37314e38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a43bfe58c2707abdfa9b9f1a9e2255bf
SHA1423bdaa281344e2b1f31e1b9c60a26debbee19e5
SHA2563d994d9b0f8a7d7eca1a22448256966ba4f1ef02986dea8c58c8fed88acb39c6
SHA5120a738bb37f11e011734c1b0f5e670127cb2418dd7adb18780fe8c45bfc12f761e661283392de73a64095513cb2ed23252f6bc9e8f46f336adaf1beb0b56098a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5256bea702f0bd25363e6a079c72977f3
SHA1b8721d48d96e77092d79868cc69756e4a1b0cd93
SHA2561738535f3cedc6f923f02ab0ac0816937e482181a2757a2b059f56f077d3e20e
SHA512eada0cd8a6b03a590bf0b0683d380d822ba35888a1f054aff1bfe6d103c6ef5de3e7f998624d45505bcf7c60f04a362dc280bf948f36c60b32933a5bf6d4102e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536210262574171cedb122ffdf91650a9
SHA1a4a3b4598a6bc48aed11de549c0978bf5bb62c05
SHA256dcf460a7566347e4340f8085473ac4fb77be7776c237f5f5d66c27fb06553ed9
SHA512c1dd7d7083ff96870908412f683ab1ff854c6a0c3e6d6d8279cb0007fb563b47d10eda541b67000ccc76c1fdd1cacc34fa60015a9e43656a3aa223ab0cc1d06f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5c6f69b59f5fb82a25eb5d07a29455c
SHA15d0772df22b312ac84655b7dfa465f950e134e91
SHA25633ae83aff08d139ca9f99d87509cab297bec73fdd09d5cd65328432ef4269a27
SHA512d7065818272d963e316b9302e1e21e9372c1f036956bc7412f215caa05577acc35551ad30d1d8b84a41880da45d093eadd9a1cccc9584ee7e9d55bed13206856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c8cefd52626962e82dba27c639ac36b
SHA192401536b9319dfdc0496a6713095e18e444fd31
SHA25654895ba8e1cce9a132d9398a568524888cf7656b9c887ddb3d120b6c8b83b857
SHA5128b95b4eb2fa837219e47fa74a01aee98a81ef17a9bf6e4608dc604b8d46bcaac151757c5f101d157073a40c752904eae8e3b51bd50ea0ea571e49adc696befae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586fbbee07f6aa53099bff002c2dead7b
SHA14944fa7b0265b2c0e5e04e865e8fd266b6c7c8c9
SHA2564778f8f64e908945160f6d468bdf907f391b00a396d57a2d646802e40458fccb
SHA512949a4950e486d5419d9eca899d30593abf9e56ffbe27f93a7f30edd5dedf2db2c6a9be95de665dabc3279da082e6cc5f5874f7547293b987708db9318ecd4069
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a