Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
79990ca1a6ba282e8167c6ef3e0f4769_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
79990ca1a6ba282e8167c6ef3e0f4769_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
79990ca1a6ba282e8167c6ef3e0f4769_JaffaCakes118.html
-
Size
19KB
-
MD5
79990ca1a6ba282e8167c6ef3e0f4769
-
SHA1
7f766394564000ffdef54f1935d906b8a9f28bce
-
SHA256
08b2163fa8ac6c2577c7369e04f52685c919bd98067bc9fd8fb030de97fab2ed
-
SHA512
863e023707c2bfafa3bc3d569abe97a2ee236c96cd6f28255f1f11252d2e181cd4075d9480b53bfe7c00f04952f3aad567b47fdb8e48a484dbf30b13782eb167
-
SSDEEP
384:zi9KhgESVVBD8c+Q3RniLRd5zemLEXucfIk9xhe3rzVc9G3F:ziOSVgcR3FWQmFOIk9e3nqG3F
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b5651ffc27f1f4c84dc9be6e0d785ae9863e2a159df56877e86f146885fca25e000000000e8000000002000020000000e2d0e2b494b186c13939c69db608fc676db57ef6b3b594431d565872939107d090000000d35a967ef8b28aba05098c172c0b5b280fb07cdc539202bb03b00662940bb099c43072d687ea747bc29d87a7b5ff1265d2e27b084e0faaa0e196550372b0fab7963605c1bdf0d002de079612538691410d5b2737ccf598699fc4286f360d6d54dd091a7a89c06f30c7509e9f4cef34dbd3001cfa0c0829e000908cafa6dccd2a9752569e53086f40fc36d3eeefa20c9440000000be385141dc8e7360518f87468908a9e879fdefc2c000efb8c2d6408a39739e2b319b8ea08c57a14582ebda5570fabb314a6fb0588cc67d01598c90235b7b7cac iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422986143" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0461ced4bb0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1640C6A1-1C3F-11EF-89B4-66A5A0AB388F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000084e40ba37446b4dc771a78c416f0c823df6b00dd0d5723c34cac063fbafb9a8c000000000e8000000002000020000000c5beeea0ea268a9d37b7461558e85ccce9aaca9f7454cb36b4275f59ea2795e02000000074d20e93b0e3c55d81b0a68403509fb5fce45d9f484253f8c27accdf70842e69400000009155408027e7f20de122f2ee9e67fdef73465ca764c1ed1668efd76070bf09ceecaea1c285f11a18649fd445542667d8e13c5e6b9e38e45db3a1b6a0f1a171cc iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2184 2956 iexplore.exe 28 PID 2956 wrote to memory of 2184 2956 iexplore.exe 28 PID 2956 wrote to memory of 2184 2956 iexplore.exe 28 PID 2956 wrote to memory of 2184 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79990ca1a6ba282e8167c6ef3e0f4769_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a5a0e32be0133873b82018274da4f2b
SHA16f01a50e1594c47d1a981abc5bf2387eea6e6992
SHA256ac1856dfd9150170a16a817fcc917066b93df4799f59e8b50b78af87ada39d0b
SHA512dead047fe65d46dbbc2d4d210d77f90839416f5ec0b990a9816ba0f41909cec45fdade1789934530e1fd3651b21f19c7211c436597070ab775c7006d239ec7fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519b511f030838edbff2ca20f8eae8ef8
SHA144df8ffd1969c3edee961daf41a455b5cadaa68b
SHA2562a00274385719c48ae91c1ccf2e5ff23afc1766d7f65dffa1449178edf013bdc
SHA5122e1e0580ec00b25db86ab0641426c175aa9da36de6de664217b77a030fbabb345b2036dba6c407628a9f9fdd7c1f88d5510a430a04d8881a969051f0145f4c47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5683ab9742382c41666738b567cd55810
SHA1a79744cfaeeab309ff3e6bb05e430385fc2d5f26
SHA2562a453e4bf005033e162d024d044f226baaa934de968e26929b6bc7bf7a269fa5
SHA5128476a87f9fe1df4b53f06c6d1d4fa20fd3e26af07b912433471217c95fa8ac95a75e32919df466f87cc335feb5439ce393fe83b9cf806dcc9003e253bc7b401e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faa8388c760a73c91950af7dbb0b208e
SHA141db18c78edf58ae12a70e8c42d30ca0c1756db2
SHA25631dd0389e3dbb0ee5b7aeb5175f7f0d7d028c6eef2bffdc9b14463e7e47ecd4e
SHA512b55f4d6bf985d89ca26ef0548c8a85b4772d01ee251e98d5461efd9c44d404ca9f6779650a7c5cb7e1ac39dd7069cc3cb09e94ac134750f0cd5ed4b583dba59d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537817d5dcae214dfc76c5befa6885ba9
SHA1653fb1eb9fcfd8536c12d9c3d93977e6f7213e6e
SHA2569455de4b7ad11fb51155c094f31d32afbf175941e3b8275b8006a1bbb5815868
SHA512f9aa3ebf9dd98c64c5c35efc508a983c76584e84dcc1049d490dace58a212a7abe9dabe6e88823d9296b384ffaf0f87e22ca3e8dd774e3eecad41a522e98cd93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0dfe4588af499ae2e98b9a11c55fcdd
SHA12ace557000adcc44bbc2f0954fa9b1ea8488fd06
SHA25624408f62920535000928328ac934c0399454bc081d13a6a2a330c524d30c47a2
SHA512fb809fea98e4f5abb483325ffda5b9eeefbbfac99b5df497fcb2d38b2bb5036f6ba9075588937f26c0af89dd934c578be4bacfc005d242d26748d3f74cad3739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b74f2bedd9e900dccc92aefff17d99a5
SHA1818d2ea2f3feaec69a74769a63a54a4927a5edc9
SHA2563d18831407302da73ba63ed89d2900173e9575f5ebcf7b93b2011d947556c945
SHA51258379547302887ba541c2a9694420ce9fa816dc879840e46e7acb86a4e2c99b71f41d542f0e980254686561de93d71a24604d1f20bc1ee66b92e06ddc8796ccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506612b27545611a24a7042bbabf176f3
SHA1a3a30c7bde60247162edc5caab153166b09e8632
SHA256eca03f0aee3f18918b528fccbc235bab5e833a500f24752ff5053ff3d8769e66
SHA5129bdde9766f4d9a26c3c5ee1ae17737888a1110bb1d4ee6b069463418f8a6318fa5e84d6fb7b58c43e3bac68277322117c48121aaac336def79fa765a199b3c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5758402f58c213be832312dbbce7d5ccd
SHA168613dd3f805edde5ad8f3fcd3ceb056d43cf1be
SHA2569a6792666e187289e5cf84dc800ded4e5e513b76b31aea158efe619f156745f4
SHA512751d8555141ce49a5c293922ce4844dad61e1454215340afb015bc3b14a7896a7495a0d511d70627026a9f6b76e867608e30701c87adbbbdbf2224fac28a1684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ea800c32994057b50067b38e1060248
SHA19df280d13a6701fdcb4449af68a4eb3ad461c34b
SHA256c38a558609de905bfb7622c5a9b8dd276cea8bd491226de4c36c4a9cebc1a811
SHA51297d502a54b93ff90ad3e0013da7792db26ee17df06d2387527887e8f9c604d144621380d2260a0809dd5119f4cb471a9c30f7228a7b5beed52fd087c748eda92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b64ff8b43ef7e2a7dfc0e1081e39958
SHA1f58725e8aaa5d3f35b64585f52a2b2f47c6413f3
SHA25613f85fa2eebdf2ce527307f835c82c19e0df47d801caade16fd0e6760c0d3b0f
SHA51264df1fdc7e97787dbc9bf572aaeb3cba1a2740ffb4db2c0a697b92afa7d18ccdb0ad2e56c5fc47424707e77d532e1dc7709310efd1686ecf600571e83481c8f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596cb8a67caa5efea739475ee84bd03b8
SHA1881aa5d43a2920c6dd6b17ecc91edfd78765d6c7
SHA256b5d270543503de35fe06688e69fe6013bc53c15c5e15664cdb52ee3a201ba5d8
SHA512a7c0d6adc6f8b69b9312833cb798395fe98a3d7ad8e0ecac69d9c1bde54b7473ab8521f39064fc0c44a934e7dd7f737b01bfabb2205345e71ff00ad01d32929a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594aef3161cac8e5ccff9c095fc59743e
SHA1771e48ce45f443e29d2fe2acd5257ac0f9a9a23e
SHA256911e62d664ef44c153049afe7651e9aab4f45eb4b70c741cc78bc8d649867a11
SHA512584222957eef89f06dea50feb614063bb486c33047fae34d679840b24511ecab6b956dec1731d277a575c5e5e2accda3cba89d660dd6e54833d9ae6b433942fd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a