Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
73e9cd108207bdf770c3fb79d19f80aa_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
73e9cd108207bdf770c3fb79d19f80aa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
73e9cd108207bdf770c3fb79d19f80aa_JaffaCakes118.html
-
Size
125KB
-
MD5
73e9cd108207bdf770c3fb79d19f80aa
-
SHA1
ac0907ba6e94a5dfc984f9b465026ae6a6d13bbe
-
SHA256
465124a5b618ec58aedabc77ef69f87a10c75015e087d5ccbfffedf07f1d8979
-
SHA512
4ca302e6dba08d92eb55f5fb2d861ae48bc44f3de8284c493688af952964733cef049b529c4f27470f8ea9f1b229b3dcabe2215e8d63978431eb385b4252d919
-
SSDEEP
1536:JQKH5+w1p4NuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:Z91KuyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C578CC1-1AFF-11EF-AD96-EAF6CDD7B231} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f3bd656387280b6ee3d84f87fcf202afd04490b72dc424d01ec71e7d3572c203000000000e8000000002000020000000ce40aeca0738ddf4f40bd43b4b95d3745ba2ac6ccde1fc4eaea9505392bf458f200000002adce18eb41cf11112cc8c32b98f5962d2de94120d907cc6fa05ff789c84eb7f40000000c007abda51cd4a7fdf4eaead66cdddfb2172167516bd0086114073147a5ba5e074d076c264df48344eb36fe8d5a73064defd9c20ff785e4c02cd1c332bb18185 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b30d110cafda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422848767" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ba645e0cf166ba9f3e2cb6a98badcd85d57ccf16102e83865c1e0aed6e821748000000000e80000000020000200000006008be59e23e43087713f89001428236dd2acdac770c3463a7c7f75849d6774290000000b9ddada528e2bd9c64354270df9285905fd5fc0e9b48892d07fcebd42f9c61ba740da202221bb1e05e0df9c8e4f55ac39bb4bd8f676f75aac50cb3e6b6fa4bdbbf92b5e3de8ecb7167f41293cb3fcd33735f1aae670b5e30ce7d0c19d0de8b0525ad8fd3d9c5a3997d86368e3df1f1fbd38b2f61dbd25284a1a7690ea51bfbe834ced716a9467dd52fe5eb06f0075df040000000036c4f5fb64c8cee3dddafbe061d4a2fe217c0b1541b7808f1603bbc24c096b4e3c62bf50a8dce131e3d4263bee9d06106723e8657a80245e4758b6078279509 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1280 iexplore.exe 1280 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1280 wrote to memory of 3020 1280 iexplore.exe 28 PID 1280 wrote to memory of 3020 1280 iexplore.exe 28 PID 1280 wrote to memory of 3020 1280 iexplore.exe 28 PID 1280 wrote to memory of 3020 1280 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73e9cd108207bdf770c3fb79d19f80aa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553d1b06c2c5fa6b3dc26e91d4557f296
SHA197ae7bb7a1cad8960b2761de07cd150fff9adbfd
SHA256505f95b5c3620050c883f4127f235bcb76d5be76f233fd792f2af203205d18cb
SHA512336c037c008d4cdb3564e2b746661240a32a743a3debc023a663b88851172e3cd16097a1f5d9e4f38b7970f3b7a326394184fea5b0356a277995341c5e01aebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa3a602ea6a27aba05974a391bc4e731
SHA145f80cb82d2a15e12eea9e2f0e80c96032d8c004
SHA256e8391d48793cb96478192be282e13c0452f3990234066c96a623f5d84452362c
SHA5129a69e534332bfb3cd10b5d84366f8f81b6474533991e62016f9c8cce67993d61d094dd5580d755287fb3792ac1761696d85d787a1a233fbe3d62bd2efb23dacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b7011c17bea97678e2b4a64104fcef2
SHA1674c1725ae6a697e878d88cd9eec4f71fe98ff10
SHA256c12993ef6a2b2aab0cade8a153d4070875bc3301f6d6b6b1f2eec7c1ff3d93d4
SHA51278130e023afadf907fe593408e26054b2d2310a6af8a3b1101b46a3644a88887a7edb4af954999d1ed8bdc018e9a10dc4a09a5e2ea4272f7f7b136092829361f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558766d50e5468f0f68232811b5bafb39
SHA1095549f303fa3c264e9d02eab0d5a52844baca52
SHA25650dd84e3cbe0722b51198370d82ef6ba85a374d8c9af704718191f5666850806
SHA512bef45398d49455876912b65c3fd38ff62a33dbf3236035ca82cd0b627e10d5c05ed69a51bbbea1738c589663b707ba18cc32a002f4d21e202dc05fc2dd77baa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53987ff9da30248a5923ef3271ae1a4d4
SHA12b277f27eba774ca128d0be3d0ebcba4ca4addc0
SHA256136a8b260791ee56c58d6f60cede420f702c4aea8a2cd167fe9162167614be43
SHA5127d6e02d55f2915e162e00d10203b5123a14b189168bda1904fad658c10419a3347d25d6579ad9f2c5d34eb2fd3e4cb7f39e41094e3dcbd2a86cba2923de1c389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1133310936d5a2db51ca4905832d38d
SHA1d25f708e406892b21488bffbd928e63302cdfeb0
SHA25635c07ba8e59823deb343618160b1faca94851d19ad9589f7e44a2d28a6feb62f
SHA51251d32805200fc940d59e19923414fb82170d9b5894d00fb21480aef5d0787422fc48c14ed7c2cb76e2be3304a7ef428be1e9c1390719c4f75c5c72df35b48d4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5779f7356d8b4d54292c0e1519788a4f3
SHA16b134f71b40ade76dff1b3ca622ac67893cc10bd
SHA256154a981e3d6795bc5208578d8cef7ad759273cc716c73c6909f01634c1fb6d28
SHA512b32156654dec138a23d88ade9c5c6b92b8b86b2d6ae7c27bfcaa8a06223b2b60381d1976bcf018c2ccb041b911bc585870bd45052dc2f500e9771551a3a8e0be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc3972b83309e6dfd4dc10967796f565
SHA11015408c802e49394be4344238edf3ba5f1d68fd
SHA2569b1ff51efa23e368abf3fb1136ebe363714bd0aa4a2c40531c5550b5c869846a
SHA51235c6b7e86ff453285f37c8234fcefb6563e7878b161968f4a0730b780a48fbe7bb5b67e794fa0792068ca4ec842254489e72fb80d59c02ce0b73f17d401b365b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519eb38f238df2af0ad23ba6f79afc64d
SHA1ad0371df147c2902fe50b33d9b3affca30d2c797
SHA2561caac3aa4101b5736e42fecae09fa2cef9574694de7932346583cc6bd633d676
SHA512d6dcb5a1b25212e1dbb4e34cf149f792aee914f106dd2e51387a4c7486a4a0e241fcf71b17dd6a9d29dc8bf9395623a696c0d7d6a902d558320ba5bf58746602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528b09ba04ba37d0d1726745d4c8a6619
SHA1e7804e4afc41c033fa4c608f4fb13005307d4527
SHA256e9c70f8738c5f77daa02f30143cb7cabb983e717df2c2d9a319b49034e98c6e2
SHA512f81f3f0943e0ab26e7644123c7567ed7208eed36781192d26199681bdfdbeb4471510ba63a039d10a98eac712073831dc9500bb8b4985798bdddcb6d0d3d0f8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559636ddfa797e67a8d7993d1e1b42b5f
SHA1229097bda2caf73ca09198e6dfe4570b7ab11c72
SHA2567ce0a2d69cea2140b48f3e6f68e3dd78d0992f030d29f5eb47b5a51291fc9d30
SHA512d98ee149ec6f0408caa8ec60d12c255a998a77ef3a8250bc063207516e64f2964c760ee3c7f18b3b077f94477ac90cebc8cc5af1744401689ece0760f36045ba
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a