Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
7e6e46d008bc809e9503333ddb22d5fe_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7e6e46d008bc809e9503333ddb22d5fe_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7e6e46d008bc809e9503333ddb22d5fe_JaffaCakes118.html
-
Size
68KB
-
MD5
7e6e46d008bc809e9503333ddb22d5fe
-
SHA1
9957337f18994881edb16bb5de06ab1425a83b89
-
SHA256
5d13cdab4d13bc023ed96bd2813be4da7c00b9b8523f4005d0a3e24018e55d3d
-
SHA512
866dad36c53504554bc08942f908fa8305010c74fe1ff75d6a3b012e2b9039b8b5fbac1b8668efb02acf19bc3875f9238509bc4433d82468325e85465c3ae12d
-
SSDEEP
768:JingcMiR3sI2PDDnX0g6UWyNJWBAoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JZMMJWBdTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20824d2544b1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006233f13eb7b1d7d7b57f4d2f9cce02c2db516bb90297e885b7c8814a2d2349e9000000000e8000000002000020000000b567293fe2c694dc0050c6641999bf5729fb116ccd2d5deb8013640d968d2a0890000000eaadc71e5e181313935c9aa7cd33585f601c82e8bc4c7fb714751c186a9b511ea6286ccef417016cc7bf2c01a5cfdc5779616f148ba176feaf4466c8e16043ff5b3e1fa721a60d83935b5ba54bbbe716b27c17c4d3f194ea8ce3ab9c6550e49505267d882ebf70f8400b478d39c6eea64f31d75d36de83df483bf48e55adbce025b56d10b01d8aa44b9d8c786e657e1d4000000072b0d9050c916e5914ff328c87916b0acc96bfa78ee4b1419120e8af3af929bca350d70bc867133e3e99367fb2d3715f2909b8a19618e6a985ae187a72d3414c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000052194fa8b12a9b851771a761813cddd2d5ce673e6dbdb19be2b0a1d568bc200b000000000e80000000020000200000004d16130a04e5aeee2c834051cdbff01f7513144ad37e8d23ebdf920290d597032000000036cb90ab9d4d16554f4305e44715ca7607d53e30eb988bc8b02cc50a41067cb140000000a6b39df38048d10088312fc79dd5e879fe744def6350c78be0c39e09eb856aacd7ae9c11695670c9a7b52997a11a87e5ef0f9c4e83323e05fcebd0861214c34b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5092AFA1-1D37-11EF-B97B-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423092756" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2184 2212 iexplore.exe 28 PID 2212 wrote to memory of 2184 2212 iexplore.exe 28 PID 2212 wrote to memory of 2184 2212 iexplore.exe 28 PID 2212 wrote to memory of 2184 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e6e46d008bc809e9503333ddb22d5fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5179859da39987c733a61f9aa5048541b
SHA11b3db79e91404986f6f8e2bb9e48fb0f1fb38513
SHA256cc947f667c94c26ccd7da1498912b5fc7f7a29ca08407c54a5acef17313dfd82
SHA512e51c06c132ea49dea65741aa71488ea42bd35cfeaf712db238d65cee148d703f03e3b818e6fb5a7e290d73091ee7b0a268688eb56ddf1ad3ca1ef2243cc497d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f75fcf72077beb3e92e313c5d9ff65d
SHA1343f7fd6b20ae0961c512e6d9caa6bb803add898
SHA256fa965771d0564b7d650ec26069876eded45863e7de4c7ad7b834729dc87ebe1c
SHA512feaffc026ede68085b8eb5af8900e17f80118181e843f7473376f583e8abd81717b03a1681f6f18fe2eeb29d3ed04a4fc52b11557626df001739d3a4f5f54448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5713d7ceef06cff56446968d694b3850d
SHA1306c940c5456b5913d85cc9dcb16766df173b93c
SHA256711659394e1503ef978ec0f26d6871352e6beda7763af5b12e5789f587820e12
SHA5129ceba2e1f148567a339f9390cfe2780c558b99d5ff68fa49dfec3f5ccc1303f2b8da31199b505a5d8216f012af223bc5bd9f9d8c64dfe09fe48b69f68e22f9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f81f36aa482bcfbcaa2c069f1b42a6d
SHA18b6091f3a4015d69fd0a6c3695a5dfa5631158c5
SHA256156dd2e9c8ef47681504811010fac8387214fdc33c8b652d097c09f69d69ee90
SHA5125a71fbc31103e2a32846f21c5577a5a74a1fd1aec6acd6ca60e9b45dbed6a566bfa7af4e505324637b279d970594268b5d614100328438230deb8db2795f2f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5261a8e113211ff50b1c667b1848955b0
SHA15f106440559f1774376e16c170845df6ad090571
SHA256d98330fe390ac66b8c8798c7cdcf44ff6464662c2caf64d5407ec7fe2935880c
SHA512051045a7688cdd71ec7fc91db4c45beb27bcef80b2bbca53ee13291bf63e1348cd86c873a58c14ad7258809d0496350078084f0aea3da3e04689cb4b4d7e1918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5109279631f727f461f06bac4863c615d
SHA1122f820383b4a1149296bdfb86a38d19ffc9511f
SHA2569848ae598332c631c87f1a4e271e2cba1020569336d338f7bfa913e1498f7490
SHA512aad24ef6853e6bc16455c10d5d802c16970c404aad057d758adb5df7dc2b58727826e11c93cf4edd00c366314d18bdbf7883254a5d6409ab97b5aa77221ca3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e3c6c72c4ebd757dc7a798b2168d665
SHA19febb2ac1ebf000458b6e3afdfdd4e324629dc9f
SHA25648a79f4bebd342945dddbca65028b61fc19712b34f83ee71fd52ec37cf2e3379
SHA5127294a6fcdcd7cfa48aabb2d212d79f2a45f7db4d4ad1ea1a25b4b6baa23ee1765d58eda4ca8d7b95f2c0586cc6ee44f7964dafa216727df1423b6c64b27bd1c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534cd54b58f6da94f877e726ecedde178
SHA1fc6bc31e78fbd908445af2c31b0c3cc2f661c6c4
SHA2567c06863de5103b77805551be31da91d67b0b3d57b5971ec6899752a9bd0d809f
SHA5121aa6ec73f5fa9af028c542ec8b6e7787a185e29e71b423cd6680d967c2844732af49fc88d57d427706c98a9a44aac275f84fe0ff45a2cda3f30752e6c1c639bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5def0bb0559c59e6c6e920a46f55260ca
SHA18ce04f1169319997b8c279f59fda38ffe2d1a0ed
SHA256d7644770cef0be244388105900dfae29007acfd9a5b35b12d2adec575e742dbb
SHA512e74e474f8204a80a0e30e6abb90368600e5d77adbcc74fd22e1b160015c226b3d562cc0659865b72773655f93b3f87788f1421752c2b9a698d1727f580c52da5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546af144a3365bc52cd9401835e0be966
SHA145c72210142c0c4d868e5a73befe45f42fb69a88
SHA2561a12b71105ab8e19ddc6db653daa7b6718a21e721b5927d0d86be73e8581c80a
SHA5128f9729935ac40b1719c93ac10feb98b9fc4c367176cfd3a5c1b86f1f9e56c40032e39939d633a62c811f98deeeed8bb6b838205bd4ac201655d06298dc5cbf4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595966fdfd0bc15749bb8ff50d08cf6da
SHA11b9d69003b376d6325c2ec219e9d7e23334debb9
SHA25632a6d2dd74f9512f6c0c5f9b26381de8e9ff67c276e4207eb1e17f647670d550
SHA512267a9efbe114a78daea28289e36817ba27adf8e1ae4fc5e38b32c95eab4d2ce9c41d2618f39ba4880290e77b2dab2b3410cb1d332e45c9f40441ed7e6e63efd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5bc980f8d5080a6b00a22f3a4622c31
SHA14911b5f189089870af4ddf494ae43fdd678e88bf
SHA256e8a210b1cf02fa876e287532214b038dcd4982306d45f9715dbb03215d290a45
SHA5124e0e64527aa0bb7c48a31ec402c19b2bae3d5e59addfdb761c2d3f91820cac8e4c43e72c2ec3e43f74f0c3adeb6e89734f7bf0d9b96448f7940ab9b6767dbf9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55144e75b4ba6a474c19513737a3e00a1
SHA16a527fb6d2acc4c767590daad45100df6014e0b4
SHA256a11b1721fc031ff73aa1b212204db85f3b7caf0dd42d9f4f07e42814aa19e077
SHA512bd3769cda68419002959a5c133d90385fa06e1f3f6c8dbd2fbcaeeacef331db78e9f33f24e19a5c1ce84dd7572787f5c5593e8e049aa90c1e6c23680cf276a13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5611f84818291c244820493d9e632f967
SHA1947f5e03700990cd65a4defe93a75d982a1893a9
SHA25620e1ab03262cea5a49d0f4cf68d94628c8c103e5bbbc4c4f5a1e2a97cc928af6
SHA5127d28ab62b67527857d21ae5fc92e6b9cbb2c75f6c958a8e13a15fd20ce9971e7583e9d6c4a7f48b8a3618d656d6eeb9408b311d601e447d5ac911c7f89d1af7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5528861e7a5bdc75967fde2089f6a2a18
SHA1e5804ce2ab2c842cecf8259354e4bf1b16b4e07d
SHA256bc9ef3b5242ff831e38e64dfa8fb19e24174d681c0ee4ffa5db2613e3d3c72b8
SHA512b91d3f0d7dcb44d4e01beb95cb9ca5bc5cf610c3f09b6bb198af272e7e67509c666d57758a95bce00540e409cb95f6722339ec35043fe2de2597400f3786e419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58305d3cddfd9050419b78a8e8eedbc10
SHA1bcd881c69681faeb9e599c0b3392172eab26f4bd
SHA256ff6e4e623859b46463bb7f93a184b810987c365a397b3c309f19fee148acec60
SHA512589905b78aaca2cbab6a80ca3bac478bdb1d9c18be68a0edb16503e4356107508111b20ca67e670602a6a1de2b148a900eecb3218337f60b537cb5348fe2301a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5299d30b89f5ebcc52f7b15552e2990d4
SHA1a3dd96983d92ecef5a5cdc69840a374b77b62113
SHA256bef08f15fc648f51b060f8795317ef32a1bde1b7a1a2f687fc2ded2d5836d8da
SHA51218da489a051d0874568fff2f1ef57bf2f15aa6284bb22f0038e43a39f74bd116b176f408f706f06d7bb2975d94a4b4549327aad59b97a0a0d4ab2868fbbbbe44
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b