Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
79b74d10b25794bd98c1834c08650e44_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
79b74d10b25794bd98c1834c08650e44_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
79b74d10b25794bd98c1834c08650e44_JaffaCakes118.html
-
Size
806B
-
MD5
79b74d10b25794bd98c1834c08650e44
-
SHA1
e7b3f7d0bb93d88944479a04721cda0fdae16c23
-
SHA256
443f468c17a9f6fe455a095c092956aad69eacf9fd3a8642a5a8d1044ce22035
-
SHA512
a18a2d0c06c9daa88374f26964d41c4249beca1297fb999d9ee01aefc1d71502028172435e624c92c7e38bd079c2673ab3a6c44b16b4b121d28a95f4af960571
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F01CB5F1-1C44-11EF-8745-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7825a94ede8a34494e60ed217dd7cf5000000000200000000001066000000010000200000007f2c7c3f9e26fd2af05b4a28a034012b87418edf05b4545963e825968102f2d2000000000e8000000002000020000000a856840f46d958a99bd9e10ef910c0d241ae64738246e759a28b70ebe5af7311200000008fae1e5a14029859a6b3f70ae365f64bef9bb55d859c9c8b62bd86445eac164740000000fcee8bea62773c1a45a2737ea2bef1d05f9743a5dc74043ad7390eb26c861179d076ffb5a984507800040ad64d536147357ca61ae29a038884581d7a195b611d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b792c451b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422988656" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7825a94ede8a34494e60ed217dd7cf5000000000200000000001066000000010000200000008d1abf49d52489f85541d743716c813f7d8bd8157c543bce16a9cdf92f9422dc000000000e8000000002000020000000c5a3537deab26da49a40131c5b47a44b35f08295cebe0c2f8bd8618213d8608790000000f83049c816ad1dd7d4e25456539a58280eff36e51b506abf249d36c8d9808316067080bbf16d3a3b247546fd072e9a0d5c6e6c94791f018e21a9b8cefcd1641a4f3587f8e679c1d2414be4f93887b0c818877169f88dda3086953cad11f8f1055fcada479734e4d42db9b9702c8924a93b1d053a74560bf1da8f7c4c5996edd3d59f8a558da0bf0700721d38c3f2fd8a40000000b7b38289fc2aff7ddcd6d8db6d17dc5844edb2525f87320e1a516f7274b20d392677142e55a23b41bc903481cb30153bf299609eb97ed74ebaa754bfa097d706 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2216 2156 iexplore.exe 28 PID 2156 wrote to memory of 2216 2156 iexplore.exe 28 PID 2156 wrote to memory of 2216 2156 iexplore.exe 28 PID 2156 wrote to memory of 2216 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79b74d10b25794bd98c1834c08650e44_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed262371220d772074c01b7b96d90ebc
SHA1ceba79ac63152b9563171eadb05665cb06edc24c
SHA2563d0723ec396b215427640a476e691b652024625ae4dee482c10033f4536f575e
SHA5121d6ed20b9799e61aa331284e777c7050dc3085b4ccac09d7fd6cf7695987a095252cc203004450c6320d0c8c9c52d1a35f49481bb7ea789b6e0c7b7ee0bb0a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e3edd51129481321288195c53f0afe1
SHA1a0d1f0935d1b569524bf851eb17d9d52223a0535
SHA2566b6deeddd20f5befc727165d3594183884feb4a63a4d598932581607b0f75596
SHA512ddc5312cffdaaaa5304c1ea6a669504166422e62ac761886212f6acb816d13b2edf99f09a2ddb496c7eae130befad498f337f73755bd7417e350712060f3700f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbde0bb98141734aa1b4f5b225e3003a
SHA1bbcce2caa16f2f793aac4e37dbe58ab6966bbb4e
SHA256ea05bd7331a99a2cb97cd9141c3adfc6686779c4c71072463f78f230a57cd63b
SHA5120437b5002d952d70d24e2c483719475759d5afd56de6fc3b65e7d9273e16cf14b955d34fa596ed4072ee232660168922078a887e55b8e857f34f8af72ec99447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544654a8819af702057e7e28e43e5fe80
SHA1384c0783758ec6d646e7afa373ebf27d3dd624ee
SHA25658ce86dcba2b0c62240a053af1fd6ebafba2cd4516e485dcbce5321913b45c17
SHA512ddb61dfb083a21f06ea428dd21e7f191382dfe698babac38ccd00492f589ec8738777039c82c9d4e175333939fc3ba235c304777884de6dc41286b81c443e3b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9c345b514264bb0fc16dea71f7a4e76
SHA1cb9dea2d9763fc5fef6086a2ef441979216f1e9a
SHA25693477dc080df1ff5a54e93bc4a4559f921632a24c5c0aff4846453c4094756d8
SHA5126e881c0734cc81cbfe9854c3186ced0c6747c1779eec77a7f4a2a2279e8b9e31a8033c26055b632c31a45dccc19223c18bc46d0115a94f676fe2e68facad32d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4a92fd8ea0422d7c19734fc694b03f4
SHA1fea8368dbe9e8bb6a22c64769c512ff7b3f907c5
SHA256ef26d7961492da41c98afe262ac5df3f0b919ff8b53cf7a952a13a99c1149d00
SHA5126f9715ca7d46e7b2d706c4db256f369c5714bc816ec2f99a353dba69ff68881ce50803621b17ff38eb4af382f4c91a3aeebbb7edce04901db8771bf62a0ca180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d41657c6c7c7e8b3f4944378681f7d0
SHA1c1dbac7ee286a83c2e219356abd5327b4efee461
SHA25640be7406b34bfcdbd08011557f6abfd00a5fbcf050ef28b2690c6707c23f4020
SHA512ffa2a324388743a104f5de5a0249650b6861cd1e5e1757153666e9a9ae90673c4d334dbd91b5bbf3669666e2c7a05fa319850f737196dd567be1362176bd4aec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1f577fcb4dbe55de62045b89fed050e
SHA1a87f3c2d431931682f7aa0a9be2880a1a2b6b5c1
SHA25676ab5df66b9ce0d82f5c1f5e727254b0d7804fbe19dfa472a79ad54318acb4a2
SHA51205933363567e69fc29a1b2be51518d904e26281642e597290fe662775f48a282af741e3a0fa0eba1a3260646a7eb7248cb662290e6175d0cd70baaaa76d9e5ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5459a62b149e40af8a1599041b0f69d7e
SHA1b32e0bbfb2ef85d142bbb7f0cbf5208c8116e631
SHA25610d104c6bb2963baea291e7bd96a53e970239de29aed8f1b9999ae9ae7f6991a
SHA5129f4b1ed77f547c6898ae4905e0623220de20bb4464e4e8409bb5ba8334d3e026ed5479b773a6418fac62fca412f4c8a744df97cce345d39c9f5c6f9df957a060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acfa764c1058949b844cf8f684444e4e
SHA1cca8eae5dd7380b5515f01e3db648171464da30a
SHA25681fbc8072402f5a5aa4524f12089b912a5c20bb7a78ae88a281ebed921ec0665
SHA5126bad34c67c7981cb663ae84dddf1f3e59f1bbf966b9242a5bed931f2a48da0669bc5a8b849b23fad210b6b7837edcbf977bc194a1df9ae49dddf77a3748dda68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55238f0941ba9d0521a977336c22a1f65
SHA1a4c69619a01946759bee8d9c328dfdf62e3c2eb2
SHA256927e6bc9ec255a725a6ad0df3e4f342e537903494750adfea25d9156778979df
SHA512bf885e1e881bae28047be00fa202c0a7d3e1a58b6fcc960ec79ef99e628968d5925fb170a7f755a5869449b6480dd5cbdaa98fd136211e5002c087d4056ae486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50327ce6fb66c93bd7d76a73f7ee1be26
SHA1c9a02c6609fb49b406949ddc2e14af47ae680ea8
SHA2566e15a9f67be4bdd83c85b5d14480b930d5b969d4990917831d823c92730f1be5
SHA512e340ec66dc9c6bba07bb4692672da581722bc23232481cd1fdbb113899c9e890135a853842f335b2f83badde2d3dcb0e0fe8c0c1e47f9fcdd43c1d1cdbd81754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b764b63b6eeb72a5c0f9e3692350b790
SHA13eddfeb94dea8459cfb5b2898d8725811c593002
SHA256a5044ed7c4b964971673e7f909932353a696cada2ab26edd437ab71a8ac1ecdc
SHA5123ebed7ff6174d5c26f07634e248d333777f459c65dcf291be73051d609a22a88d7425b73d8b1a16579b6214b63a09b50381a0fe4bcf9d4a7e135e764c5df037b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520180fcf30d82699dc683e344a1f9798
SHA1e0108429d16ffc0c9d7c4687cca8b48c0273353b
SHA25641a2d31fc145a25fb8f10da00014228d470198041d2299eb656d9e1430a9a257
SHA5125fb651f3b39365bf9be214e5d6804ef7072e6179c4a62308cedb2f63025dd7eb12c3bcc3a4d329a581f7158561c5cd365fb03c03fec6f782482c9b2983915aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cda3e53df1ac92a92aa4df6d769dfc3f
SHA1980df4315ef5bd7ff6c668c6d37d0d64566680fc
SHA25679ed408983d430fea84b4d400c7caf3414771f43f1fa084818d34a01bcc21d55
SHA512f2a10a85202fe98b30c03ebeec919ea3d1e6f5ef0bdccfc51821ec440dda55155421bbeb11ae65be91636bbaaf076a9d512a708fdc41bb31c2258851f2a08243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536cda4ef2040ff502c4a361f7f721b08
SHA1f344ad230e9799d003cb7d63e15e4104bfdbda37
SHA2564397079c159288221e5f9f4394ee9e65477ff13bb9ff4eb46ce38d72825c87e5
SHA512db7ae56a7138ec6313d7982e2913ea2e335d2b559c33f350461efd018ace12300ff377cbdbc4a39cc8043d33318586f31077a76126a42717941a9ec9a7bcb44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4f262910f8d2d08330aec97a15d48e3
SHA1f05dac3b42e8fce47ac227d6adfb541263325276
SHA25698db90a3c8eb118846045314b2c1e1969662ed188c3a63e7b4ad22e68120c85a
SHA512c14f1b8de7b9172cbfe558a5311e797d2abaebd1c7f4f6773602eb67d1659f6cb3011cf38d1e814c00f269405d90155980f47fed1986522ed58378ae96e6dea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c19bbab6f77c528613f592781b132b64
SHA1d64a52534ee38730b59557868c7e8d2be8f25bde
SHA256e7ac5eeebf5c6d2f924b4ae68307dcf121f97505ef281e3d6e73bbf63933019e
SHA5122519cb7c85bce5b0d64833eeb2eef9ef5178a38bc4d78114fa4dc47e57b0c290e9802990c8ba7dce82db2e8c84912320817f87bbab1fdf43d955e2d689c8fbb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528212c4556aa6852125a92e9f564c4cc
SHA10b991ef33d4e135a38acd1db75001aaa15b7535f
SHA2564c60e8046759b9f98dc0515f3a4de4205571f6aa96ef9f1397379c6b13b3034f
SHA512307a987ef7fd87379b6472c249064aafa801e66f3440e5610084b71fbe0ff58f75c19d2f8396307746c9a79a464b2172947e446d3dac43e50933a8a62334a7c1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a