Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
7fb533bed8d28d7a21fbf5079189ff23_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7fb533bed8d28d7a21fbf5079189ff23_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7fb533bed8d28d7a21fbf5079189ff23_JaffaCakes118.html
-
Size
213KB
-
MD5
7fb533bed8d28d7a21fbf5079189ff23
-
SHA1
997d8ce00f301ce85e3770e245d4d44f90769bac
-
SHA256
9921d0c31ba322a54ad2c9e71af939ff8ff6cacb676870f0f9844aca943877d1
-
SHA512
289fbe11f24bd809e282f197741caf48df2c98906a696571043ab6a514871563380bd76e6302ea97f24d8b57939689b1d4a660825f951ae9eaea2b4108c4c807
-
SSDEEP
3072:S1UVO7DDlDCyyfkMY+BES09JXAnyrZalI+YQ:S1583sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423123953" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2AB85D1-1D7F-11EF-A1FB-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2744 iexplore.exe 2744 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2264 2744 iexplore.exe 28 PID 2744 wrote to memory of 2264 2744 iexplore.exe 28 PID 2744 wrote to memory of 2264 2744 iexplore.exe 28 PID 2744 wrote to memory of 2264 2744 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7fb533bed8d28d7a21fbf5079189ff23_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d8d99873a90cd2aec3dba50236c1b6
SHA1546ea894098d29d527c3f34ab544d7585211e49d
SHA25630feb8b60082eed25a877df12cee237dd26b24f0d4e50c7eac454e3d94f35977
SHA51279e95c1d5cdf4f8dc93b680f6c85f0fe86edba85df02eaba12110c6e1724381d449136a1dc085a63368b71f32d9c4879251d02e4ac138bd6c78d454716e67e1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5624a3e59d7549f55c902fc83af51766f
SHA1800f58093929f0f122dc69bb8871958c6cb69daa
SHA256ece3d4e8a11da22e5109b2a8ffede9aa993e8a46b55395d6ec5e008330d22194
SHA5121c4b995203e186a7e1a69f4b359a265c8fe2bc219d63947eb55e635899e1bb623581a572fbe9d470a487e6647341b5a56dd08aaad5635af4d0ee0a4b62c3d28c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52158dfc71230093cb80db95412910158
SHA1301841367d2f6d07754cca39ee895293fa0cf027
SHA256ed9edeff88ce89d7af9dad1f99eb9cd9d9ee486bf4bc9d1f8606bc499411fc09
SHA5124a664faa1bcdddeb9c94fa8cda459c86ce911893c6a9e981e0374cf16d161d91a81744a9181a478d2b6feda7d5bf8d2984c84bccc7e368648b22f5800cb0b62a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fac70a368cef2fb9fa0057413212d6e
SHA14f825ebe12ade73dad0ad7b60501f45f1e7ceed8
SHA2569720b01bfcf94a42478c0bf841a14c28c9b9d42cfd78c519d854841f7c8e43c1
SHA51287bcfb7684e9524b289379ab01db35b9dcf1589535ea6013a2cf96abd6cab4ec7825539576a3da10d393d187f7cbe1dc26d0eca3de4deefc081dc6e8d967bb7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596ee77ae9806a90c10b5cf6d85d3030b
SHA1a46a03db7e79d5d6ca02d41d0a3594c114f9cc6b
SHA25647b28cd8a4e8f221102210d19df8766db82dd9e6b522eec4252923d4a2e80b05
SHA512386420eb5785c09ff96d2cca66b041e4bcbef574d8dd8edf960adb716392a9821315670611bc891562325bae0dcf26a99b5cc8481c5eedfb1243ea721bba52ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592f2a6e50899f309a0aff7a7b0a858e2
SHA1ca5827d6c31c233e33825b37129561e071d5a6f9
SHA25638fde07761493cd33a70925f03ae2a057d0e7e6908cbe4a9cf4e09a063f43ce0
SHA5125193200e435cca0b9645e9fd35a90883206d51c1978e9f49b9277f899abe07863cfca303f7230c49c81d128e3bf239d6ceb087175e0bf88f8e3bd1c1392474e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567e10ecff0afb889fe128894ad128fb
SHA1f4e0ce83a6b166525550668c94becf6577e638fb
SHA256c552776039b8ee009f10f88499626c29bc9c32b35eecebd83af3573513d2d0fe
SHA512a04a5ea16ab9cac8016a4cf4885897f77cde57295edce1c18cba2210edcd9f9c57f71fe5e30632b2fd239856d4faf2353b820a5cf239592a4dfa0c1c325515d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c75804a4eef7fe403d82fa444a16be7
SHA13c774f6a4c032128f988bf5de24557a05dd2bb51
SHA256f2876e32a2b9163158abba4f9ec0e753058cd4def88d1810609a55829161150b
SHA512bcf46abe057ea74427e4d749dda000af6bf6db0b4372494a5738d0c94a99f5b1b790a5ba1c589085cadf47041d40a9c11377fe8066d858142a58becf55f3be9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6d9dcde538c778717c62fe854c20734
SHA187dbeb7948058330fdfcedb759642f2498c7a9c0
SHA25660ad55e9c845319dcca12cd9899741094bf340fb4ebf41d412cbe809996b4fb1
SHA512769633fcf69c9d09de0e4d5b3bdffc07424bd534a26582b1799a9d9d1a7bf141211ee9e70dab0c8b60372246da1e6c7f335fc862da4da42adee20910d997d486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edf201e29283613a0b5a323c9e4e9f8e
SHA1e04202e5b7b4257d1ce642bbc30e025d4f53f622
SHA256bd1c87c006991be5cd38572bbc84eb59d3069582dc04daa9f686ab76557e7e90
SHA5124c39e5568a998834cbc3814741d903240ac6553a5563485737f7c982e9f77d96523b1a0c558e946c26fae597c1a725ff6f067c289a0616a09f20555901417a36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513beba7efb90fa351edf36f726fce6cc
SHA1b847e7f5feb4eedc7735cd7ec3a692005cd45e30
SHA2566beaed0d95f29b6809a70041a73ac10a40944b302dae11627ce94a79f69116eb
SHA51214c82c9262794ae1f802bb8b3b5a4aa04424a8b6b95e589794741a381a81bd3b9989bc0772628a19994098068f90d54434e9056e7bfab3fae4be3048194a179d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5783bc8d3d2a54ae7730af6efe3c864d7
SHA18b12677873f501d900d5b0a158ba1fa411472f35
SHA2569398d56e46883ee3297d8e19f1c9c690b1112a619f6ad4d377e48e86ca99e503
SHA5122c5b9b926aaadeba2bef6d4065693ce547b64351d09a8a6ea8e7c651b71bd9cba406768e1760e2c33668402b30db6828e2ab78baafd4f650f288071bc44b1dbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d61b1a33a4e17cd4ed817e6c77156b7d
SHA174e26a82a06a60bb6d32e9e4f5ca307f7a373e67
SHA256bb60ebeac7a65d70c0fc30e0fbac399b6c84c097c887645eb1d9bb6dd42992d7
SHA512a2295506d158e61c21fba9170b4b1cdeb6a77819e4cd4e074ccc790cfc007b347247779a8534597d76492a28649ac2bc6b7b525be6a32989dcc9899ae5854c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a39ae2644140e8eddae89bc29528c9b
SHA17570de06f969386517b5beac44110e53898a97d3
SHA2568ee8c353a2221d5dddfc924aa5abc02d496d902c3e34f14567a6722e73f81868
SHA5129208602104ec2870cfb2794d86a358216569126fd8391239bf5ee6b06be336b7c140e6597575f02d3d45e877215a48ab76f772764ab303900893c13778414510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b830ef7fa383bddc360c9002d85d242c
SHA102b97ca9a4e7bf86d656b83a628a5a05e7fcb82c
SHA256dc5af7507a514e2ed1e1d70f96c5f2b96147d86d2c5a44a026de20226bcc4bb7
SHA51269ea95131d233a246110f59253b70320563353d77f33727dbf10f853d0b95763771d60970aa25a7988f8d87dfece985cb1c6e1459ef61dc1129658d363069cb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d09df743be8994cc7203e7060b364916
SHA170caffc7529e4e4519b4a23fbbb39ac3cf5a3dc8
SHA25613f9a4f4a29a2d2d6fd53b19bac60e53936daa479f241e40a5fba32260874eef
SHA512f933004d9fe665980098aa06787da3a602696cf1e76147d32bb772a68ee941f373f6264162f30c343a89febb5755b5fef268f94911ce49cbb1435bc3f8209865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542393483e864abf98e71282f8e24d9aa
SHA18a7d2bacfaed22aa5ccc01c7609b687078ccfc50
SHA256bbc89eede0009704e12a1ca24e13da9f8478fd45bba7e3b2b12d756efde45997
SHA512fa9b2e8c1ea24d904eb903b02ac979916dcae6fe9afee7eeebe51d7a4753e0ed019233f6cebe06b63cd8a3714ad56b8c106d8797067a63661fda48cf35e7019a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565aeba3aaa7c868dedd07657f87de245
SHA1084165438de5011911e5fbeaa160f367b9b4bad6
SHA256c50917724732f93faafa31daa7d3352cab646e685cf5b0e44e4901532242b58a
SHA512412144b437f0c6b197a29974fa118f4c2c6fa2d79eec9b05e87d29223d4bd29df26a3ca7632beee0ca1ddac3a2ec69c6b0e652e2a2aa081c50f6a95a2e1fde72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ac6144b85d49237f2c18d971d010806
SHA1706e0f444bc54d665376626d8a838d44758e79b3
SHA256e7cd9f6ccbe2b870e0124ed30b0aa9cc5a213523aadee09f483318354c603a22
SHA512e8733e7a6093635c1035a9df00dbec5ff944bb17591e26aa6545383179610468945475736ce4ac7244e2ed92c7712adc22a77e5ba73ef6c72a7e9996704b5d77
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b