Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
754cd0230a647c45ca876c80d9790613_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
754cd0230a647c45ca876c80d9790613_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
754cd0230a647c45ca876c80d9790613_JaffaCakes118.html
-
Size
463KB
-
MD5
754cd0230a647c45ca876c80d9790613
-
SHA1
ba89090f04afef012995afa90ef83b8d1c0d8677
-
SHA256
1fe84274092f27b0e5bce7693a6507636d5bf44a41d830e9620f4e181e5329e7
-
SHA512
5baf8126acfdd8f1cffa27166fc6215127abfff5d99657c7d5843418f2dc76c89d46e05f3b804daf24786218ca2c48ba57df2d874e7aa5674b7ef67ca7930904
-
SSDEEP
6144:SBsMYod+X3oI+YxsMYod+X3oI+Y4sMYod+X3oI+YLsMYod+X3oI+YQ:s5d+X3/5d+X3U5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{617141C1-1B51-11EF-BBEC-C662D38FA52F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ce023a5eafda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005303733edc3510f9f7367731f9c3ef7cd3bb3e93528b29ad9035394d09982070000000000e80000000020000200000002d25c12f4d317ed022398cf93100d2f276e9fb15729df30229ebcd47717369fa2000000064ed658fa5333e13125b74b2d17c4058d5b0292fa92c79fd8e2fa842d7f842244000000087c6d3e24a130fc2b8c1e18c7ecf154681fdf681e5021a098f7ad3b07234cb27cf4ea9dcde5e3289f72c5f838bcca57dcec935e1638d1c7fcaef1d019b5de0c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422884048" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000324f787b3f7c295ba0f80f8912e0140940aa6f08afe96867db967a708e62cd79000000000e80000000020000200000009661af701a7e7087f71c9b4741873e60895e64ea8fdae8fdeb1a7aee99df53f590000000966a305caf90898bf6b46837b3399a26ad268e51b14d778303921030f1006420f9cac782db05bd51fbdefb98be58384f86976df0a48ac9553e0546a8f6b2dd6e11a4e6e9bf0cf3c2680a9e461275eee608315ceef7a85ce80627e5d42ffbf3720e2e687bb9a047c9f252fbc3aade917e6b38fc6689202dfb56d79717e5e062d28ecd4f1a4f9048aa4eb48fefec1ac163400000001bf721406733512991f1bf7d1827ba6a51a56da9c83efd1f5608cbdc6ec737adeef04ac708d2f7321dfc36ff651943df5c01eee84a6a51a9102fd305064b434b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2148 2460 iexplore.exe 28 PID 2460 wrote to memory of 2148 2460 iexplore.exe 28 PID 2460 wrote to memory of 2148 2460 iexplore.exe 28 PID 2460 wrote to memory of 2148 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\754cd0230a647c45ca876c80d9790613_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d5f26007ceb06c9349b885b33e1e847
SHA1c359be8bd370db96c88c4938f08244138176688f
SHA256962f202a41e3e5742c6f3f2deb65ddd1a7f268a5c44e2c9f6d4436ca061b25b0
SHA5129c79b6be91be9bbb75219797ef0887ba309930f3d1199de8a2e673b0ea9bb7ba8d03d491aa63b9b718c022308572ab1190af3a0ca855f610c1a5c54bc28e6686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54185e7e57217ff54b47b1bfab7220cae
SHA1b2cd1ed76db753492056630f51d6cfe3286855f9
SHA25616e7d7c4b0678b5f714bc02f7a2cbe54bcbdb004ab149b3ff71db9408e4f896d
SHA5124725f9051d48b70a7e68451a496caccc776511c443e87bbe86f091b641b76183494940d19ebdde34104d9f7cbdb514d44e1057b5d0b4317e89b0f3ad976c4b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0a0f2536a8b8ce3ef692eea55efe0bb
SHA11d9240983c0083de1c97a9593fe4ac2a640428f7
SHA2569566c3ee2ed2e2db4cd7ffbf3dab6d44fc9e1907cde3b9359a0a8555e9339c72
SHA512a753f2a688499ea01237ef43b303401ec44dc1e20e1d96e6993bff454a4c25fca0b5f9c5ab3ef8f6296b4bbed72364afe88685f8d5630ea69ce818db6c369e51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538b1ae9fb2849f01af03392bc06fbdfc
SHA13d4cb57d9b5dd89b78b722e20bb2c2d6b1d62380
SHA25664f264942c06707938e0285660932f3d961972c6089f4a2d1371c077f5f86469
SHA51224d3fe5498c1a61232836143d3863bc54c088da344a531cc9046f4f8126bb1ebe617ff0ecf65477729603d78c5948b2fef4f5151819cc097e2de37847fa9fa7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5372a0097340caa41cc9243512ad1e7b6
SHA1dbb58077e6cd294d4eb8cbaf434534dbf1c087f5
SHA256e8c81262a031b4558a5f7faa88466784a3c4f4d86a8c9073335fbb645eeb4244
SHA5127e2d7d5b607ebbab6fb2d3eaa50c08388a396f11028a7be9a1042d641d95df3d04a33ae808d7ca5ff7204af910d3923c71fcef78e22021f705462aa24ad2530c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f56d8f7e51212015c5367ce1f800b69
SHA1eb0c8cf477e9117ad28c6ae44c8c45e140fe631e
SHA256dc43586a0a6c3e472abf993331240d282f7629a2ae81116effacc35b693849c3
SHA512ae27a3ca45d30eb9880d02b3bdc642a2394c33fcdd3042a410e963235494186d4892348b9e3c1d2014c57850db6112e8a1722777c2d712f72a1b5149e1eb8b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbc802fd416a30697189970f42798582
SHA194e2f0876c714635f087e4cc4b6188850f6ec7a7
SHA2564f5c3fd49083d474c312f3684fa69eb0318d266b38d1c65ee3dbd341022b0a0b
SHA512c63cdb46754fccf69f6404e59a2b620a75e85cbe7e56b5f6df163dd8875ba565af00cef8df1e9cbfd94f82ee517a0ab9357bd9e43ea8f6653950d503bfb16b80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a4736096e0d04a7522f4e12c656a233
SHA152a84cb05d65712655046c63415d6f1ca9a1b030
SHA256efea75c14a8d59f28ec068b96c8db327a6e6d453ecae9c4d9f5bba8958aa2610
SHA5128c85b6d2e6b02f6348a20213d9ce0ab59715c54acde8506882dd1da5f6603e0eb0289b026ba6b1edb9fadc2ee789778a001d9c7af014b6c914c8fd3358852a1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b53d67ac292987008100f75f07cffbd5
SHA10e5af8d1a07b3c3044895739231281928de68954
SHA256111f0bc4fa8fb4f72a6ed372c46779c18f49ccd9666becacb194b9fb348bf958
SHA512e6435d989207f5dd9209b0925441a2f998b2b0005e6031190df8fedb6559b665ec15d89edd3379f61addb8df33c6ff8739de9f70bdc5b4fb7c0476b94e2197d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518d2365ffb05bd9ac1cd99bd020324bc
SHA14884578e7eab8d9a471c319177690082a23d5347
SHA2562dc4b7ed60b4717982aa3e2f4983db636e1b59fa874a738e61065a2cb11c93f3
SHA5123f582ca5c3742f6601da48453804c149b11fdd47e6cfda23dca4a5bbc1eecc5bdaad2769b91a15ab5b633d0c18e5959597ca69416e6562e0db4d6f32b1a41a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2f87670cc0bf4706e8651b70e1f3937
SHA1a7c62e7d3c010dfab8618d0e6db6f91fa4d08377
SHA256945049e37fbf382ae64f8044c68fe19eaf98a19c6ac06393e73dcaeb05ce69ff
SHA5122db77e965710006a539dc950945b4385d68ca482976aa0d118979d13a29fdc875bb2482f5ddda92f6dd872bb784c17f2837a0281e9481f28c3726c6a4934e20b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1ef2e70539d7e0b597177b4b87c5d12
SHA1c6950dbe969379df527fcede9dc2129c1d5225c3
SHA256359d9e3551c0bc61352c128f9c75e3c06d0b7e22610173e21ebdbaf983293706
SHA51250d36ae84c2ffe8e2426c9b538465ef6ac077591392328ff5e4f4e01ca5f60fc5beb65075d3321ff8328f517c0b47a9360ea092064e6bc4a922b83cf41aa5c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cc923d0bbfba8800982504e7d321539
SHA1acc8ed095e97ecaa16cbd667985e9e518f420500
SHA25684910e80a6fbfcfc23e5934b8f942cd20c17b9745e9eae2c1f151aa0a39eb5ee
SHA5127e4c40a1383c3d68741c1291126b18f17acf416fb8ea2b989394c7765f780d76228d5240a44112e708961db9a459d3e929df597b65ebde687f5a06e6bbd1964a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a