Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
79f9090ac734c4102d7f03de7cfb2186_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
79f9090ac734c4102d7f03de7cfb2186_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
79f9090ac734c4102d7f03de7cfb2186_JaffaCakes118.html
-
Size
15KB
-
MD5
79f9090ac734c4102d7f03de7cfb2186
-
SHA1
792e14390ccda29eac9b9a841643747f21d56a26
-
SHA256
11eebfd891a294780b07d56d733b87e0dc9938e6ee5264cf01c81ffcd23281ea
-
SHA512
bf4db65ad48a1e6b584b5d123aaeff50230da93cecf65ccc6d1ea0adf83ac2c31e5aa742d9a0a8c864b4daf69fec16e72116d9ded8e5b9be9c6c5fd01a043910
-
SSDEEP
384:HmX6Bl2ihokt9Szold/jIBXDRWPBMUwdwV2/p6I7Tvn3/oWRB5:Uuz6kt9SElVjIUCT//p6OoWRB5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e8c61d2cb1d76cc001e120325b4358f7120ccb07bce6d44facc27db20d213447000000000e80000000020000200000004fd7e54ea53f6aa331aa6c20280f52291868d2589be7176a19e54ca4d6c4cb612000000003a20291acd6f4af008584c515b1c5ab2db0085fc6504202fca830a53b97d8aa40000000980e1b82dfb4f783438d3bf47d9f1f4d06dfc572150c11579a8286d08eed38aab695650321800dfa503e73bec7201d795bc2c00c838b9e9edc76a46fbdd2817b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f5073937e55233e7e8727b98fc73a984bbc7ed5441bc94780dad3b9496f8b00a000000000e80000000020000200000001144c9a16cc05d86bcba44649430e4c7d11fa102104c002c7a53c421334beac490000000a07bebc25bc9d432e17c26da4fda5c015312779c7797f406562d4a2eb541f3c2acbecda554d522731fb4cc9ff2317f93b9cf2f1aae965565763eef21b3e3b32db84c90cf33994fa25f4fe3e4d07255e472e78692af92667f0a055dcb71b9e7a7207c26527516ec02b680ed0dcd4c9dafcf84a7b6ba7cb58ea5d48e170d9ca4424c61d86a3c2d19e1b665832d439ee3bd400000004a9943a5e71e18fc3a07982fda9985f1040688a5182a9ad69405fd672646791b49b953ccb951db4870d7021b56adfc694d5073132a621a8d84df4c4c36be6647 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422993941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ECE7831-1C51-11EF-BF51-4E559C6B32B6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005c46315eb0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2992 iexplore.exe 2992 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2916 2992 iexplore.exe 28 PID 2992 wrote to memory of 2916 2992 iexplore.exe 28 PID 2992 wrote to memory of 2916 2992 iexplore.exe 28 PID 2992 wrote to memory of 2916 2992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79f9090ac734c4102d7f03de7cfb2186_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c0bae1ed40d59da7f0fa53447973bd4
SHA1dc0e5621f08ad5fb5ce6722013acc3a71e21b366
SHA256c3ce0b6ba7023fde378a82682174f2a6aae720219fc2426d94c0e02d5ee49caf
SHA51234d99fd4bd1bdff4a5c2d8c078c0a92bf888b9b46b669eee19d2ce4f4a1ace0002cf3da1f580c87a51a679dde0e1c0823813cc0dbc76364e0f299e686000a5fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f992f2d300f35ab8ee76e6aa1040f48c
SHA1cd41698677049e2ca09a1f5e49c2d753c6586f36
SHA256abe6b201a5beea941fe0e3766614f46bbeb8ee60853fbf1bd19cfeb4ef3fe065
SHA512f2a344ad0ddd68a9fdafbc4fd3fc7bea8503b14e8f8c095e97a49b0a830a9392937919a8e873799c589635f0adc3d83b30482b93a6372097412143bc74fb4eee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f17a5145a4d3d5db874f91536c0807c0
SHA17bc7a8691f4fb37ef320b309bd3c583b75da12da
SHA25673df67fb488e3f151565dd7abe1bb20bbc1f4519ea9e382ecd353f8180b394fa
SHA51204d02cf3f5f7642d80568e743db66bb2f970b9e6db9f8e1aa1e4b6046c0e402c9110e3d2f917cab52aee8563668815af15987a47b643074f1aed39d1a86bc48d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572feb7d4e77086bfc3d1335d7fa02f0a
SHA1f1a6a0eb7615351baea3b1ddd069ed834a9e5f58
SHA256d8537b36603913793839df24a5782df21ee115df043382f109e7968785abd256
SHA51258c25e33ed848b6d8bc4949e92b7cd6b0b048cb13d5879588651923ce6d3d75cd4053656e537d8f42a175cae082000f11c9e0c56dbc2b2005259f277f2953acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b461ba2c50c579d30a53789e0353856b
SHA176b397885b0ae9f50b96bc080359bd89913a5087
SHA256a9861199762340698675927162f75829e5e3990227b18ff2afbaa77aff9f9d85
SHA51277b21a8605722379486348f020db51896fb5139557709aaa3ac63510a8476dfb01ace31131cc7be4485b4b221c623fee309b2247df784b99e38eac916ce4d321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54af6bb8a6c18808d2cf23d31f2539182
SHA161d30f3d78dd39f8c7619ed040b79e5463945ae3
SHA256e1fe909dcf4310a1479d33b76b1b6fa151706a2987354e06e62947b29eab13cd
SHA5129419bae2bb8b83116c5726fd837fe8a080ab8eeae9652ca54f98da0cd9b92441e6b6461bd94d16b2133e7095dcd10f18010b90409fb7ea9c493b84a2d84f7632
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d73f3aef6590a2d04e099aecc4ef13f
SHA1d82d1205dd4255e05e55d8dca006e556bf3bd825
SHA25633140a7969d503aead7d6d41c0fcf2480cb7fe223af954b5e2f5cfd698cf2dbc
SHA5129a2280580e17fb1f6d6b8b896e91b319c9bfa53dce1ef73419e80510822ab28c551d94c54be9c75a75f8827b28621d04bf37a152f8437b1956fcac05129b2db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5263858be13f63804067b7b74601f207e
SHA1d1ebbbfc74303d247aec026b0497cf8775a710de
SHA25632258c93d4b899e6c3d99383bb0587a02a4ba4676e16514a727a70abff15eaaa
SHA51203179b0d980fcb402e5b72f1d002b3d6701e121e7637149021b02f1cbb5df5483e36a92992d04c62920ec148db8404a3d2827479c9e2a952449ac7e276ab69a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e0a8ebed1b1109b09a8c515f9ed0df8
SHA173ee1a592d2ad91dc80a47adb686a2e8b233f085
SHA2566ca793f38ee247eb1ceb6115754253296adca270b098e7f23ab1448ff181587b
SHA51243212a4078f1312a5642a0bfd13e085a6eb9e2b2aca6f2cf00eaa874d9e96636452a04522aed50aaf03b813949004f1bc788a47ef74d997616cd5790dfad270c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c49132b418bee9429dab1c003358915
SHA10cb921da2f132a46f9aa5a466fc00767d1d45593
SHA256cc23560005e9a042c9c41ea1510b12c585ac894c0eb29705c35afdbbd9adf73b
SHA51229b6e1917890efa90606ef875894dcb659b1f0f2a47f802fceaab82fa11f2fbfb98a646ef55489f32612256aff3ddedcbfb6ba1997e53920b3dedd4d6ea5a11b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5715c0dabc5dc134e8f43e77ac87e097c
SHA10a477131d72a03637ab2a392d48f10bdfdb9f45d
SHA256f226097261e12e68530b0a6d7ca62a7b4c6b5e6c3dd5f65a20ee4429b93d1bc8
SHA5127767333a8539d4ff1ab1c77fb848dfb114867f58b4c7327c9cd1c5036335e95c03ad45d6cbec16303b13d01f14a678f7c29c911d9e7cbd35769307a69db7a55c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d1a793a07dcad3c331a80b92079d90b
SHA171588146af517293b9e4c0b317f49ce40c1f5fe1
SHA2569bd9a3ac9034ac03b934d0ba1d3ac84937c96cb4db32e395d642ef4bacc0d839
SHA5120fe138d8f2f181e060701a35d9518e8a205b1bbbe8979aaa9e56bbc0e8e7363342d52626db6df209268ab19ca364efc4ebe0e85f2b2a13ef54c5944859a80b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b85be8453f6f1fa08f8dc4eac800706
SHA111a27f78ae20bfa932fb2c87e2d67630488a90ea
SHA256890247f25b9ccd1fa0dbfd0ef0b08220d76c835f7abce34ef099a4b623019db2
SHA51202064c6c771bc94281a59b40a2b933bb1db5733d419fe328b8d70999a4ddf74a86d39998d112cfe04b6fd7a29831f3ff36b1ef1247dbcea6927bab977b2c02a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c0d91e008b746b7bf71e6d3358e3c84
SHA101d74ac871ed375ea951ffc608ed3798a4b3173f
SHA256fa8ff9d08a57c4c5dafbbb1ab86f41cf2d946b7890a3a7fd68619c1d233de635
SHA512e664129acd5d1468230311302514d65f721feeef09c2f6995ddb5812c7010a4ac597c70e1a7c9f458553b583503611664d4ee9b6e6162c765db608787fbeb5b6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a