Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
7d5f22fd397871cdd82164a7ede7ad59_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7d5f22fd397871cdd82164a7ede7ad59_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7d5f22fd397871cdd82164a7ede7ad59_JaffaCakes118.html
-
Size
88KB
-
MD5
7d5f22fd397871cdd82164a7ede7ad59
-
SHA1
3dd5185e388c9c65e19a964e68cc59d211011005
-
SHA256
1e3b5bf9bf19cc10c5697b67cd2058d70e64bec03ab5188481523617cf019b17
-
SHA512
d43b2e68c084da65e55d7e95a9009767df145cffaa849d0b139d8634170cce206676a327f04ef4baed728fb215abfa4a1464d10d5be650d871d33052496ba703
-
SSDEEP
1536:CIzK+HY3GuM/aDgt0Iwy7qwLVV3lXgsJHVtua7i8mZWwU1vX9/34L4fjMLvQ28qD:CIze3GuM/atIZ7qwLVTXgs1tua7i8mZh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423070051" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000b0a593fd5d65ebb2b8b9e75aeedf43155ca6003b17e2bc682806ef519565b20000000000e8000000002000020000000f0190ef5f24866f1a60d9983c35edc56967507584a4d9f6b5ebaeeb2995c83472000000029d76f3181e06015040b3ca2f086c76aa2e3d154131cd26b550aeabef5081596400000001178213b0b5ab5803e1f97fb5d1386ae8e9c4ebaab0e29c6c2339e4521c5b5482d845eed073d06adc1b51d68e23551806e78b156d706eed134baf27e7f35e4be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000470a15ca158170e75990a302c2ff0668ecdee1868e1dc2b8ebc9622653db26a0000000000e8000000002000020000000231584591b6a78c6aa36c590fa9a7902e7e8f1a13160cc9103b5ac7f7661d8ee90000000564d804c402cbd3683fade28cefab24ed5cf405f54efbd3645f6d11b77d3fd18ef324a3eadaa5d079d70c323e27441af03b27c0be8e5ad859a891f996f1a4ebd9b1374c58183741bf3ff0ac43de22e4619713f7086619e64a0d793439e004c5175808b30d865eecd118163538665a4d37e8ed3e855bb07d8c4b577abd06daafc6b37a8e091eae14228f2198744456c70400000008028d3a9403533e721c9eb4ca1f730e5b2f4fccf340b5565a3636d3629006c247036986f8181b65dff8be506ea4a6422165c6ab20bee3be76be83a723f23030c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7182D351-1D02-11EF-917C-6A2211F10352} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a03b4d0fb1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1260 iexplore.exe 1260 iexplore.exe 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2360 1260 iexplore.exe 28 PID 1260 wrote to memory of 2360 1260 iexplore.exe 28 PID 1260 wrote to memory of 2360 1260 iexplore.exe 28 PID 1260 wrote to memory of 2360 1260 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d5f22fd397871cdd82164a7ede7ad59_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1236040f667edfb679bc079989f8157
SHA10e95609078c509e1e38a77f0f5e0fc71a7b5b14f
SHA2565e8929e04a3baafd24e4585c842acdc4f2f8d9800ba1ba8171bfed9d04ed0ace
SHA51225448b928db0534e6e594bce072aec571d6fda550f04ef3add5e32390a79992621e6827e8388482d3995580a7da1eb4292911911c8eb59e00b793eaf8a26524f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c55e1ed95e91f00e3b17ad1163076f5
SHA13f73b2dc96c1d27b5f0b5ef17094d5b64202bb78
SHA256573008ccb3fa5d9883965a099d42ba4c9bd18ccef1bb8aba245b993b015fa3d7
SHA51232739b3ba41646b879123c0100a812d2570c52e58342d966f6bff6bef5cd50c6e331c18560fb6a3c2e9e98f498ed295fcdc9ae82d8deda918cad1069008e290a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548b7e67ee7aa60b2ef6e2fe1d373b5f0
SHA101852ccdbbf6fc5c89776a029027780b0c2b9218
SHA256cd8e888169df2e4989d5e97e8ab9fae01ab732a5f0fe24ad8af1d078cb625de1
SHA512b4c07a977a2a120d1f850e996cc371ddba784d23c9e62c217bd966e4bef24c7e725029cb81f8df5ff8660158f1e67bf34db47d012a92f6c74689217213b0ed9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d49edfcf022eb2a6119bd282576e575
SHA1ee3937528c028a68f5c5e6108a7e5be0fcf2640f
SHA2563ff095410e77c02e5dcba4a13ed950b2534fc0ca91495c72811956521ff8e7da
SHA512e5ea6f51fdf693a0133fcfb8d6df09c4ecfdb627b1410144247a4c0e9edb5355fc760fc517235deaf57c08a501de3a8de2df25a885c7cf8ad6638675875465b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553adda5047511d02bc65c50e2e22f9d7
SHA115359938237234bd115a23ed08871e4a6a440118
SHA256887340476081dd697b17930b88ab3940bb177492f0b5e3635bd5f9984a480e4b
SHA51269632ce867ef777cddb2235c32e6abb71b9966f9aa3ee23aad9fcb289fe777c5d4bb4e64594931cb14c87d90c28a98b4b26513b5f162f5eed08d8d5b6d78a567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e6fde926d6c23f9512809b66b077a84
SHA1a04b69e4eb2b6c0dbed5bab7deb11ad814ec0ff9
SHA256291b96e1dc53da67993dd84b4785e051b37c2230820ac3bf5becb739c73bc380
SHA5128cb53e2e694e5317ea9d446debadae9e777c38a641343a0fe7ef44267c461137a112c56962a3b2f5ca40f0e1a52e20fa655c446843d42a346874e18a78fccb8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5049f9b9337f6629689dcd882ac93627a
SHA16e995587304463acf9f6b038a272662d2fcc5149
SHA2566b2c0b5c7cdcc6e65359c053c989e1f157ca3cac067a05623cc7591e77d9d724
SHA512d1fca3a70902a44cfc162c5b639d714b1b20229bb20a54f08db7adc61d075e9e6d52dcc18537d590c59817e31d0a5f838e696e4d7157043ee124839fb329d908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572b87f5e992a1884dd396143ff7bd041
SHA1997e4d7ddaa5a32577e881b5ad9e5b0271841a74
SHA256c27a5824c176bb311c28299cb4d93320ed7c8a73f5453ec880dc5b84de8b43dc
SHA5122e8146245812c9c6dbb5c0deb5933682009eb3599f49d04dd3a743407acdabfe24c9ef49da69881c4fdf56360ba1b8ace82aaed99ecab33f25bb8417996e74bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504e26db8df56e9a237edc89ccbdfd7f1
SHA19a8a4e2998bf0227b41d5d5b995b9df7cd9286e9
SHA256c5ad30ab1e99ec7d926a50399dbf9f588c10bccd6595017afdb1490c738273c9
SHA512591556b12bbff304ae115521fdaa5c7363395ae5e54f8507be6cc5aa35848178723d7f17840954718cca30dfa93706940d3cc77123e7d0afddf4d7318f3fc4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0641668cc63aa54bb2c7ef629e98daa
SHA12e76d8292032b09f53f41fe428ee8e39b35323dd
SHA2561490be7d34599ff00278ceed6c06d7430deebbcd7e5dbcb13c1737d2ad473d19
SHA5128cc4eb2580cfd56eb0dffc1867a613b8a3f019822e6cf6ee7810ab5e245759e1843dc9277b3443b0d4f85df572953a403e9a2a3e21918ccb4d0c45a5a33fa88e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5166f38e38f08db6dd99913a5093c9ae7
SHA1d27f4782442e94acba905aac49ae433c3aa24c5c
SHA2562cf43f5dbd72c22bad797424a8a12050efc772b04f16d87edd2aa5cb7e797b99
SHA51208f1d0d8390cec7f1c17dec9634cd8fccc40349e091c62490e502a17286ee3cb93a44f10faf9af8ea64dab370a948a2f2c4dd329dcc5d276dba5cb41c9ff9ee1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\LG4XKM9M9OM[1].css
Filesize22KB
MD550ffe5c9b54f43a59bfb0f68058792ba
SHA12e4e82ae14a419f52635a181011b8abfa4d6a769
SHA256fd366cf44114212b1f606fb2da79d323332298bbeda4e161eabc39af6424f6cc
SHA512692ce4d8587041ae433e054e3f97b234e83e21c7474c7695e0829888ee7de98412a6152b1af0b7deac5ac636613cd1e4eccbe67b17c83ea7df5251d2ff7e8be5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\cb=gapi[2].js
Filesize64KB
MD563e5a0b45632b3dde3694ffcaf0e3f7a
SHA1923736d0cdc308331d5cfaa0ea159bfedc83d53f
SHA256889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db
SHA5125b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\plusone[1].js
Filesize54KB
MD5fb86282646c76d835cd2e6c49b8625f7
SHA1d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0
SHA256638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109
SHA51207dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\3604799710-postmessagerelay[1].js
Filesize11KB
MD540aaadf2a7451d276b940cddefb2d0ed
SHA1b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA2564b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA5126f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\rpc_shindig_random[1].js
Filesize14KB
MD523a7ab8d8ba33d255e61be9fc36b1d16
SHA1042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a