Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 06:46
Static task
static1
Behavioral task
behavioral1
Sample
7c0f04b7e75050cfd95e2c1e42ccb949_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c0f04b7e75050cfd95e2c1e42ccb949_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7c0f04b7e75050cfd95e2c1e42ccb949_JaffaCakes118.html
-
Size
19KB
-
MD5
7c0f04b7e75050cfd95e2c1e42ccb949
-
SHA1
6d9fdaf45257762831bd2dbb3e9f4768e3a97952
-
SHA256
8ddeb6984454f94fe180ce703843e333f1a38582f4061fcb3f4eccaaf23272a6
-
SHA512
9b3da126778887a998e2385b292ec26eec05995d005f0026539c5c140e617368473f2e63bfeb22416b61841078ae4c2c47e5a562cd556ee56c11789a36a3e6cd
-
SSDEEP
384:zi4KcRAa5r9DIiDVBD8cyQ3Rn/4yEmd5WScfIk9xhemozVc9NYv:zina5r9DNgcV39/OmNOIk9emWqNYv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423040668" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A4F5531-1CBE-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000086a3afd5279c97c709d8cf9ea71f0b953d3cef96fa7a26870be0ecaab0ce2f97000000000e80000000020000200000000dd3a77435c9f607e6fbff9af27e547003ddfa9b3656f5e89de8127bbc9f25529000000062cbafb6aa8e90ae5302c8cafc6b73b99a68ae560c94d62bc8f01e4b1fd8764b3b9c335b38cba64f72cff5ef130dc8826ae6bccbbceb17a68e6beca56c3710f252fca0b86fd6891316e5d4391159658c3c9def826cc9cf68fbcf90c95b023ff8a07b21d6529d5dcf709f36dc83af4f0856911ba3ce7c860104e0b1ebd13ef1e258660274c25e3110ee704dd9554f3d694000000061167a78581290827f2f5e8770ab7d8542306716f4042581ba08920a070086134f94932aacc937da926c93b2fe0a487826ec06845dd35578187041161413c658 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003fa5f7cb3e2e55d24f23a21887afa320ec5f2248772b0c351fd041ad75ce39de000000000e8000000002000020000000b53656fb26cc41c52b0414095155a48a6281bb2916d9fec624d67a01699e727c2000000063e84b60b1341cc0b7c357ab88f3f47259f187cf36a4dda51fdeb69937da314040000000b12b31e8e37358bf1219d29cc39d499386d3fcb1696f4e61606d248c93fd5437581579245d23eefdee79864de4a2f6c85cd4b9b3f98c0d65d606fc37cef0e264 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f012e9decab0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2936 2972 iexplore.exe 28 PID 2972 wrote to memory of 2936 2972 iexplore.exe 28 PID 2972 wrote to memory of 2936 2972 iexplore.exe 28 PID 2972 wrote to memory of 2936 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c0f04b7e75050cfd95e2c1e42ccb949_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cff722e6aac46b227d38181143f3902
SHA1721ba2f6a1fc2b520324721103462f6fc8a06e44
SHA256cfc4fa3f678038caf682a1f59cf1867f96fbaae5956b5e9c24becbc2b472335b
SHA512804c56430bc514958b681fdd48c848035a64245ddb887ec75b5446f5c7e72263b3af13f48f2389a130658ad95bd5948d7559ac2a460af50687c3b0ca1ef72438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c093236052ed9b99acce2dc98653e89
SHA10df8378e5b8a697ba98717f55750ef2c5e800b63
SHA25697cd4bebd75635da3e944d70427af185d0cd6f38c6345f65495bc2da005cbeac
SHA512cd8c3edd46f58c36dd802b362ea4d4bc2ee60b44ad19d503ba41310cf8a467dba2340a047a506a0650bf881f60fe965ba4378a37744abcb7793c4399ea3e8ffc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501a202e300f31cc588c2918ad52d07db
SHA19c123fec8d240b266e6cb4aa00e3f6dbefcefcc3
SHA25663b14fa156161c68b1df76c8a5a191dea7ade2881a724e15930e94076fbcc3ba
SHA5129473a0f00110e126f1d31164761a7071b087485b10f69a896d1395ed18d64c476ca42385952440013527cd4f6aa4c68810c96dc6cc3f26a77f18619c48a89ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542841150aed2f8a3fc22b8dbb307ee9d
SHA15dddf43122b95b77e77316cdde00aec199e9e9d0
SHA256eb961e6a5c8c9da8ded8f76a3414583d0b82bb128c337f6f75c74f1a111903cd
SHA51270e4748ff82af7f52a3a67fb05d716397c6fc703a94c9d8fb4c5230bf669d8bd7045d7a80f0c8400416f74b683b0c7b37053152c5cd6a511aac271d918e33646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f19d4da4a1be28c90b465c847063cdd4
SHA181b43b13fa97e35752ae76aff0ebf5912d4f2068
SHA25696ae4057726eb20134cef9255f16a7c337fc8e8abe5f642dca86ee896fd0ffa5
SHA5122820381265e79cc4e8b896094d539cbe869f410886bcfb868c599b13eca1e7dbd6abe40dac746b4ef785c4035db65d3ea7d3cc35e00b24f801652e895c31a525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592fdc457c960af2079a7f4d9d01b756c
SHA10269dcd020056d993a4098b81fb73ffccce34388
SHA2568c893f9438c0ffe5c4862effc90235e80c5772a4a0c4a66061b8efc2e5bbf5a7
SHA512b1dbac11d71f7da952c85b918cfa592865ccf3130006b63d2e9c1e30e545aab3a0447beb9ae23067cae6f12b1eb9efc85b4f7c29e72c17f622474bc365e00d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545df81f576852de23ae7b9796d444322
SHA1cdcba5d01aff59741871769c827666c00671657d
SHA256f24bf84fe17b870957af260249cfb375f7f1edc2aa655e3e3ec06f2625ce64b2
SHA51263e0ab957e875fad3bedc3e28c44ea873c8ca40fe046570ef2e0961b6852aa585be19cba22548eb27d5d90772ae59bb7144a5354f8b683c80e5a9d50e5c04dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5279f5f8d9d6b9526f8027ec5a70e3d2b
SHA1f56a2dea47f88234ebdd3a61d80a35053fe3dc87
SHA25694443e958285ea74c36ea3662d4846a28b1c748ca622a73c9ac1c76d3365dd21
SHA5129d8bb3adad706f1549fd67aecebd101e2ed9079b701abadd1c182344fcf5178db143627356e58641b3b5f83dc58c5345737514c49bbec51ba2345f126f5130f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d27ffd187cad49d3848d079c11d2c17
SHA1d12418d91a4aef2ff79c64411c981cd25a836b61
SHA2560e96a74539e45a9dfe5f0eefda55191662e38f675cd214d822f88b4eb9989345
SHA512d738b0176fbf34517293365e776c8f6b8294027f90d9b5bda9d259ff56ceacdc8dbb1d2a76b9b28d7deb19c9acac2a3eb4599150c43ba6a27d10b725087521ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cde937ef959bc19d6d994f1491863fdd
SHA160ef647863457d054cc9ed19038a355eee1a27a9
SHA256c079d16387df33a1bf25a59aa3a401ffb2966204b8eef166e499e82c4fef58f3
SHA512419b51f22a452a3d2373f142ffe01424353d023edcfe8cb831310e5c1192ad8cf09cc6d27ff205f405a29114bc81955e015b0244a4ffce578c54bec5bd311338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0e50135374eb5d45ad200caac881511
SHA19152a795c45ae29d2be0e68388abd51ddc5a3041
SHA2567d8ba5f433e40bf440f995a923fc4e590393ad21c7cb43b4f7d1118bc28949c9
SHA512d6c230ed71aceaa75e7095aca4f0f3de41b7a57810c6f25b0a8aadd77629dcf3bba714b341b4d3f37c75d4c9fbb821216dea97fa349881851b7454fcf5b48597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ea6f41b4a95aeae5fc6a9d61b3275e3
SHA1de4a0f10cf1b4a0bb28f92d6b7115be3c296efad
SHA256d590c1bc3ac77fc0c483bd6c5af1ec0a1b01c5f24f806d1b419b97b0a4c90f37
SHA512be6b710f24a5aad20ea6e9f0badc276b2ecf70ddf5af93a736d0d47f2757f54d11be288ad010c80c9da51ec1346cdaf4eed975b18e2996c00c1eb3d488dce66a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b31961c66027eb17dfdc8a01be221ab2
SHA1fd799e5d3a6da3c96bcc555aa7c8eff66cc1e04b
SHA2567ebbd75129d5db66b3838cd3ee1ef503ec35687bdaa4080971b77f2f0af492da
SHA5129ae2608257382229574eef07428014f1288a66b931b07bdf51154093dc0950ea9dafe24f0f126fe2c6614085600c32d9fd7aeff10f91ff6ad39e93d2ef9c15e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550aff84978f9240a5cf4708d3ae6915c
SHA127f2aa720df227279e724d27e5f013bc9290dabe
SHA2560c97eb14d29ea0b71133f81ec57895c844d7dd7b0544316c30c84e778074b013
SHA5121b6aa2ecad5ba6de5dd4e07d18bec794397829bdc1d99ca58f12167a4b793cfb5bd8338757f38677776749ef0149a842d440a2a13581b36ec936fcb2bc6d1b82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b39cd7d23f1d1abecdf359381f32d75
SHA145ee231a59cc6f0a81b183fa8e34bfdf99c9bf11
SHA2566fa061c623d6cf880b99c74af29e3feda8faa84cb5c4c1e050f5159149df2f60
SHA5127c2f7f3930925751c1b9116e2107f86b3728b60311eacc6be252fbe7cb5b953c0a253e5f888d182cae84ef335e38a87a2fe49484176a22c8fa608f55014a2d90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55998b4797e6522fd9d90bda9c9fed984
SHA1a72fcf704715f99ea8f217bf893afa4e1dda0575
SHA2568701f4c01e826ad1907de8a61b1e76d7b50156d32bdad80164a98f6e07be5ce0
SHA5120973dc64463385a0750bb9e86e25a90712be09767017a900921f0a91a087bfd4f48952a7b9239e1b4409a59c8ff15cc7d88723ddd40449bbfc46a2e7c11ffbee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50929b2bb31081a1c1280c1d356244761
SHA17183aef65b5ac02bf0a9f270f08f41018024cab7
SHA256a7c93ee7f416241ea5f1b3e3eade70f6eeca5300317b1b0aababcd6d44ae8865
SHA5120b314d886a54c6e93daf34cd0f75469f108297b24a25dacb848ae05412a521ca302e0ca355ee05c0a28236ebf287a714e45b3683d41349b16b192b544ac6ba40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569865d8198c16a1541530c25c2aaa207
SHA1277a0d739a18e59c6c2c5a3c287ba8bbdf80dc07
SHA256682589d4352cd450cec23aca8d886c6a490609e74e2120f3a532394d6a6c9c95
SHA51275dc6bc332edebfe2641c9c93f36e0679497ed593a9932f0b20e3751283b885c09c1f577bd33b10878f5ae180245f2641549826d1759c5fa2f485d4f3eb04347
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a