Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 04:20
Static task
static1
Behavioral task
behavioral1
Sample
83027810e4ad1462d6ce339a2ddbbd47_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
83027810e4ad1462d6ce339a2ddbbd47_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
83027810e4ad1462d6ce339a2ddbbd47_JaffaCakes118.html
-
Size
140KB
-
MD5
83027810e4ad1462d6ce339a2ddbbd47
-
SHA1
48c732454329c07aadb21da4512f6b6cefcfad8a
-
SHA256
8d23609e5a9ace78d3ee5cc8133043c1775848f2a9d3f3e12a30a2770b21784f
-
SHA512
d797cdf5faec1b278f0907f44b00d9e30a57c27919c16e93068791af4f7a9d96133bd4ecf9aa2b865cfea38c0b72b1600b601085bcc7ad6914e2bf37c0033c55
-
SSDEEP
1536:SS19KIYeeI/rcS50lV7yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SS1ES6yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3AA8E21-1E3B-11EF-A9A6-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423204672" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d957f748b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000eee04f3acfa74133efc0a0e1bfdd79db18483aca33c46c6769514136661a6470000000000e8000000002000020000000d39605be24f3561878d1b2b8781de5472cfd6c791000dc88a826956706b5416990000000a378845884ed0a2a685048b92e7132513889646d99228cbb0f5dc0bddf16580b5c434a444dfa57c2f85e7a418e93b46cc4276799ef0d0dcc943c7b66f3a2c75155bfa3f8dd90c8ac37fc50e49a86b5208078f8ce43ed14a7cea02250d489cf04c70fb641d342485d38a2e0e8db0f85629e7835bb657b3aba4e0d5b576a9678def023fbd1b2fa9ed1435a193b672147ed400000000072e4c1a8ad30da869d2e61379fc54a0a90437df1578d7e66105bc2cdff9ed3dad1ae8b5198be12e2274408bd658f1198ba3dd20017e6029b2e1dfc5b16bf50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cd5ec5360d379d1bbede1722db61f431d47a82c9dfe2ab5300933b3ef627aa4d000000000e800000000200002000000041bf1553ea60a5ef5a862a92a782169fc363d804b5f35c00008bdccf1f9765db200000001febc9c01a54190e31e8f2f931dd1cd8a23b2560ca165bec0212c2c581dc14b4400000004c37a1a274b3dde1cabb5ee6414ab6feb5496b92c46cc6bddea5c5b8648fd053a16bf685c1160e86372112afc56f9244ee2590c588be16bb7d8b0577b5ef800d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2072 1736 iexplore.exe 28 PID 1736 wrote to memory of 2072 1736 iexplore.exe 28 PID 1736 wrote to memory of 2072 1736 iexplore.exe 28 PID 1736 wrote to memory of 2072 1736 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83027810e4ad1462d6ce339a2ddbbd47_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562c3d94789cf4427f87112e1da17ef80
SHA1e83a76a1dd710badb572c6574ae14881539ed159
SHA25650336d47ad85dbe308fbdb87922da0061f4af4e428a35305a7aa1f633adea54b
SHA512202f402bf160c559f30f3532531729d72c6f80c831f6efa22b42962393011c8145bef0bfdbc628193bb5440e53de002743f5145944842d796fc1857395dc251f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea198d2cb00f765680d066eb0a80a75b
SHA14e12caaf2e05ae4da796ba674e256b2289a8b4fe
SHA25600843b497af1b709a060719bc76268e82df08719d04c8b7d39afc8c65a63b595
SHA51218a2c9e9584b71637d662b6b89912f249679e3aee616d01b6629db635517bd2090bfc660769bdc99e1a19213489492b838478fdcd1af3625014fbdddcce06284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a04b7d7342fdea68f8b813d8dc749fb
SHA1db384506b91359a2c4fada491e28ce56381211f4
SHA256f481076ee07a646fc48d512a163b3adde4d802171db13749839b64475e47ac12
SHA51243e25720cb9973680925f1a766ff4d7c15b86f77629e7270cacce4db0a1a10ad977466ef653ed60f4eeffb803b5bf9a5508887f093efb2e3d49756b3b4c226d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593030d3a9269e2af0607acff4114bce1
SHA1d4421d2210164c5228e2098d09e118955b8089da
SHA256264cae6f6bab203c80f86145fba8cf0e5bcd07e1356f915494c8fada213c1e4e
SHA512f35b98e8b4443f252f7fe917422da95ca258de4fe7369698a028dd986e4e3d55a0df0bad635f26a0905c8de471baafb5449014d828c010db01b3c8f6ba80cf83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572652e1ba1ad2202eb48b92cfd9c488e
SHA1c83b35d51d06117aebcc0234c10ab8bb4fc04b81
SHA256b19fe9cd4535faa96ce1e17b5985c4b1c84fe9d6a6d85a203ac6c4430698f81d
SHA5128182ecb1381f1083355133b6eeed656976e617d6ac4a860bda2e3c0b74a8c5dc7ffe88cc01e614eea62903d436f9db4dd66d0580b971efac96a4d8b5bc36d930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524bf1091111317dc86deed617f04781f
SHA1e4b2460aaaedc149535460d29f9e7f53631c345f
SHA256124215d73c7e89c28970f15b39d888cc017680b7c5b212f3175347e0543da2e1
SHA512fa77cc75be3c5ded814d5b862488f4f76433062f111849f2813a29e6dbef32360252eef9b60d305e6b950dea32ee6ae64c7a2202969612a24179724922b7a2bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fe9b3a8db61acc71499173ef2f771e2
SHA129b6496087190330bc5fab7a1840090bd15ff961
SHA256627b7145b79d85671500b796afb51f9230337c4c47e6fccf419a32977b7c4b88
SHA5126b982fedb3ba93842ab67114831c41541da102e15e0a606071e25e8d5d5bc0c0d73e22f7438f257531c61d1a0cb1cb890ac74dca6942e891759a4a9ea48f2905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539d9b2ecc2c1deec5ad76762281e7817
SHA12be7bd205dd10e99a0d53b9c0b1a1cd2e9523594
SHA25667403ff61645e112cd5b1729afa4e8c2ca7e0b6e2557611f08c18606b292c495
SHA5126192b9adff89e5cdf34c9865e852214afc37a22ee8fa9172c11ca00c8776c1a03cbe1fe2c92c1f60636f17984ad2215291be97a7a51e58b223ce04e2938c9ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ef26d6cbbaf4c787f44358047b5065e
SHA16df8e1148e3dced80b41a1afc5696ee1e9d1d48f
SHA256979229d499ef71685673a24efca36706506a013cf226c0bec1faf22962d23aab
SHA5129ae021aba828f1c2addaf7067937cf2b59643eaf2fbb3c04f3e8980cf2a674b8a90076de8c3d6dfd389d382c44796ce8e6b8713adf3f69f31fa796db23bb0d30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f77b1c8dd37cbc22f28d30320f9a56fb
SHA1f067394983fc31d64e4d0aa99ef42ce15b0644c5
SHA2567e43cc9dd743eac161cbfbcd6dd1fcc4aa8d4635d92ab8d8e5e17b426b309303
SHA512c292393ef1caabd0eae2e54dc83f68c864d664b15dafd0b7d1ec11a14916123b8ee6eaba017911f30300f1bd82c5946b10a35f1217171582e9bcba489d5a4735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532400978da92b30528bf9a0108d73c94
SHA1d56810945be0c4fc2f47226474970e6a77bd1c30
SHA256ebc5ef012d67df13342d7ce09097c2e130b57e97765f17eb7d9266163a571bb7
SHA5124fba025f1060d562a5817e46661ee7dd2dbfcbeb268d6e4a34268c4db40f11a61ffbb01c5568d2b98281329ef6ca241a273e77f9001e43ed35d2296658986026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a7679428ce3d6ef0e52fb4aa1a69bf1
SHA1590f968385904ae024e406c4c2b70cb01acf5b6e
SHA256e1e954b105fb9fbb58ca2332065d41bc9af8cdea94fe00d83a771882b47f6fc7
SHA51201c4462f198390987b05e4c759d8f083659e3525ed86a161666ed188008bd545450341ff3337d3b3288fbd92b12cf2f9cb912af5cafbac0ca411f1cf663b6a2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564805043f4588a258b743bf93c04010f
SHA1ac2841a62328c60558bf8252413689f36e1b5e93
SHA256e27009419e83432f535ec483d9ae9df955f239c3dd946ab3492d4062296069ba
SHA5129a46d6e8d48ecd95057724c4bb96b93c3185e27671b4d1c3839557759be8ff34fe547b0ca2ebef1d135bbcc0e107e9e69e9638d76f159c7627692ca10e08d02c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50afec2a5ce93d4dde89f2dfead5b1d3d
SHA1132d40f4031341e1d1d1af19ce78eaa84990b4e2
SHA256fafbcdc963947252d3f8f4aea94339a8a2a684e9f705888296e76cf3cd502ed9
SHA51249ce14366aefb6a370d9e8ef730f5a5d462906fc3329a57d5f47c76feb2d5b2d27d5d9dddaddc9bbe5be9d6a437ec40d9a253022739cd5cfd40ad72819c1d1e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50686bda5b81dcc6ad2df3d3538ebd6a4
SHA14e4376c81c1c9460018086072189c718baec142d
SHA256e424e07d76616a4b172b15dd1b00c5270aa2452d6b9558f98ec0f0a0ce9ab67a
SHA5124fff8ce6e82e59fbfd134b122731c1892e7f90331ecbc344c1ad7822804104d58bc30102ceb6d17531999c0d841b2c725beb0841864f81e6ecedf71d171f6b9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55291377259aa41950df02f4765e66d8d
SHA1d8ecb9e858de82da4c1a67b0a8653c0d10dafaeb
SHA2560e66526271124db984a3fab34ee7e1043da4c65f8034211c5efb5a6cbdbe4dc6
SHA512668829637c7a679082ba8452b11b7cf7a66b4e93b114d36b0e97a6563c99103f8abae8749541ccb24225200872304c52f3959332a2337a276262c6c27f807a14
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b