Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
7a5ddca6fc2a10894b77d6c7954659b1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7a5ddca6fc2a10894b77d6c7954659b1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7a5ddca6fc2a10894b77d6c7954659b1_JaffaCakes118.html
-
Size
234KB
-
MD5
7a5ddca6fc2a10894b77d6c7954659b1
-
SHA1
be0f45ded5458432a661a335da6443880ed6c164
-
SHA256
662af82dcead084742f04b0ef107608ed755fa0ae88aa5c7a9be908c478fa609
-
SHA512
9a0e2396a48a8267d737568458751ae2b18abc3e26da3d5a3c91d8654c688497467306729a3067fd1e3d6113c6811230a5dabfc62a5d690fc762e99cdd4876c1
-
SSDEEP
3072:SLVyfkMY+BES09JXAnyrZalI+YgxIM6jiBnes3kqee66jp:SUsMYod+X3oI+YgxvBnT3kqee1p
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE82C101-1C64-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000aaaa070dee71276b975c9444c29b006f5fe66a229842e2e79d987a182f869050000000000e80000000020000200000004013b2adea0dd9efcc97469ed7a0125f7173a030e36169ed5075204532c45aba90000000287b06118bb66aa38efaeb8852810977447f46cf61db0222e52a1f39efe07a8eeb1510e44817941ccda35732c30d4f497c1714f257a2dffc5e8136203c1de983cf62d326c88bc5d43702ceaf49af704eccd6d289719231a96529757112565dbff3485805a42ea90c5b58d2397b7dc4f5fb52c8a9419b7a8e9c5d0f6c191c516a86f45be078e6a3fc7edeead16204be924000000034ed9eee64bb47fbf712bb13df79e333fad008668c293822364164f799f78839a97a2cd53213e7d3ea503aba439feaaac6fb42fa5189d3d9764393c52b3bcb35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90de2e1372b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423002441" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d3b9868e98bc7757037b9471f7963c7c6e087d87678ec27e04ab97cfa0d7287e000000000e8000000002000020000000e4acd2e0005dc3946a065229001e196027faa56f845e5b532839c354ceee17e920000000d3037175a6b034f9247a64257590890d7589e1c1794cf64528b11f20c9c01209400000008c04ff5bc9f3adcf20d4cd2d25bdf4a769986e388aadbc9ee9b40d2629019d828a91da24cd60825307b60aa0c73cf86afddc844504ce4a67bce3c8bd4a6e3c22 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28 PID 3056 wrote to memory of 2168 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a5ddca6fc2a10894b77d6c7954659b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599f694e55c52a58155c0ab4e258c0caf
SHA1b046180c51c128fa1240c93171d15c99e3769edb
SHA2569a16c34acab36a1ad001b47275e082e79ef9c8515afa9f4888aaf81c2cccc71b
SHA512499a9c37985cad7cbd6bde3feaaedb9ae5d0ef9e4a67bbec550dc9acca8c5712dfd5bdf703b19b53ff9bbe43e0afa53fb662217cd255076e39baea91dad79f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5706a2d3023e5260a0a24b1165f1baae6
SHA1cd90f9b32175d5c066764b6d4ee75232ac3e674c
SHA2568b817d4e5ec33b43365feaddcf48beebfe6276dcee840879867739507afd70a5
SHA51212cd3f1d741f9b33a84ab10cdae010ebbd0fb8ac9121ce79d366b11719732afb589067c6309087413bbefa36e6804ebd880d2110135654fbd9d0d41d2eee4d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52db7ae3b7b47611fed56a922ad38bd0f
SHA16d25aa3212e8332035f60887e2aecd099e66f2d5
SHA256aa2323c65f117b5986b11709f2a829b0b979a4c87aff942e4c09a4b6e38fce31
SHA512a858bacb0b94e83f4e8b22d1d18c0ec20d57bb15c911663babee03b91ed8e7aa2507092929725935b2eb8aea7b49564b0fa3e793dd52861bc4e4e2ed875fc45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5129b47626cc1d6a89b649bb342806158
SHA18d32b08500576e9375d3ab67d2f682fc33699052
SHA256e650e5cb58a39d47eba421947d9d09ad6ae1b66866c6d1335d7d738fe028aa57
SHA512c9926150ea23682626b793d1974bbe5f920fdf160937ba1967745dd68989dabf91f2def7ed83a6415747f75a9245322337011205be88b8719a299afeb09853d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef80286ba5c9114bf6b7f9c12f401ad9
SHA15f4b9aefa75671c9b1cbca17590bede9fb305d2e
SHA25665a91fc3f701d0b04c39a3d5e987fc29fb03da0659a9302ad6c44a33c2d02ea5
SHA5127de8c456f0268481cbd36f357712923d7948a2699eb0cc9eb8364f5be32c61778901a495e56714f0ad2f5499cb7ca20d8cc197158129f39d3d65d2adf22d4102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee3c66b1f54e8b4a5e26898d984164df
SHA15b815c5d7c8e2e2fc0f89c22126c80b3fe12947e
SHA2561c621b92713c6cff60f18be8dce6c69702ae87e1f986c8661eb67d0aa6021866
SHA5125045a1e195ca440d5740534f4f1e6d3cfd27f5076b05bf184373d05e7b12c610f7e8449117efb3bf913787ac4c2438cfd2d7fa29cfb3c214bd79da455e85b276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a89d6d9d3ddeb88f81fb565e4a5bc570
SHA1adaff9b9d9b9c3f997074762778ce406bcf8831b
SHA2560166333890dcd62ed26faf89327b411df799db78b755c8ac796b7c9476bea902
SHA5126910b65b4951966eb9dd714d0e8bc96cb3e039290c3166c68feca070546e72965c7f386a5ce30b379b6948dabc397ffe91aed5bb8d76b0da83cf89452c9973db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef604212225b83514184382e719141f9
SHA1f0388af80179838730f8e9ff9697e694acfa00dd
SHA25622d6c98b68f23201ba3461707998012438c523df1533b86db342ddecbefaf392
SHA5125063c1f5685838c4bb40c6f86b78d41aa21930a38e04b3f2c6b56706150b0b43baf3b17231f18a3ae2e12f584ea8272b56035a2d2f41f3d4bee072e4044e3998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e58b229ac53dcc43227fd39825075202
SHA1bed25ab68afd28ba740a67e33bf80aa0e463c7de
SHA256a051728ad94f6c78ab49365d4fa37c96dd9b7cd76f4bf648b67dcc1371834b15
SHA51235dae4fbbf982614215147661a0b98937a20eaa1a5285d4e32145070f4fc39b7b0aca756e822b923f8e2f73dc6ce9550e842ff1dfadf98b080affa3de47fc2eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaba1a7f048aa7adcb64e68938f10412
SHA1d73475bd3bb4b9c61438764e7d80e1abf60fdebe
SHA25654f1b8be690bed695f3c8c1615839e483d4257848db171ab894178fa24cadc28
SHA512fc2e4ca2e2b3044face65e542e528c3c5a8526532bf744a071270b02cf9ef179a6c1f73255b7c3d1ae54da9a47ead24893130206df20570ca14a54663887a6dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e726b4a6715d0e79fd6157ea747c00e
SHA1de3a90ab794546fe1a0546de8c78ded1a5ae07c0
SHA2564daa70127917cb619112b36f8351fa64ef21e4bc1624ea42a9ad66ba351338e3
SHA51260191b14b5cda35f9be83ffb90e53bf1f9354185e0bcbf94c7f34fc48668a58a80bdc08cd5b6f6d3fbb046dffe97d075c20649449d5ad69e1f69036df5c6cd0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562b8a88701065cbc0d339fd6d57e834d
SHA17edf021074ed1eb592261801e2be9270d336205b
SHA25612af318d8f5070e294641dedcda9baf1c53b5cbbf75df1bd84123a7d4bf1b2f0
SHA512466db75b3abdcb284f29e120948a027ce9a77b2e2aa3504e48d1f9af8205737acc9bb20255481d08a5564ffbc24d9ea7f5f80ba2b3a7f8cdf69a010dd3d9984f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b494f088efd1d043becf5125322a00
SHA1a4871cfcdfaf70c3b6eddc85d7a3ce15e96c5a66
SHA2564d56f71f02445841a447a942c0285d6edf8f63679187cfb7a6b6b3e4824d9291
SHA512fbc5d59cfdce0a0cd890748f13a20e47f41537308bfdf6fc110472e83cd3eb58761f9c9646f8aba4fb96ff2e319f456bcdd6f46843883d90487debec66599d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1219a4e3e615b86008e44cf163d3078
SHA1bf6631ac06f013ebb0667c4ddef429c95b9e4311
SHA25665e95d0404cd52d862d23fe191662697aaf692397b2af47d731957d23127db04
SHA512186b97817789e5dd50c67b42e91ce7106df5a626c86925042703429265385b5446b94011a0c3e779e6b1518faed36d70ca1d496630509867cc92b1cc68c9b5eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0cbfdb4dfa64643060acdefea01e28e
SHA18e2169cc111ac1a41d8835030b8b0378fa293158
SHA256c9a53ccd774debe9daab3ea4b49443be3d20ca3c5b5527e8390636a2b19e5ba6
SHA5123f1c23d981f590a0f24b3a36aa25dc02fe45b9b9211a91b09827080f7716fc0bc360a6c8b4d466876745ea6dc17cc87cc7df32eb852ec9f8e1fecda94423acb7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a