Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
8404293a307335114cf80f4fd46cbb6c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8404293a307335114cf80f4fd46cbb6c_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8404293a307335114cf80f4fd46cbb6c_JaffaCakes118.html
-
Size
39KB
-
MD5
8404293a307335114cf80f4fd46cbb6c
-
SHA1
c87895c7a31d4dbc2492ad139bae4d4c43c27b9b
-
SHA256
15b77ea895f8c8c60dbe29502b0a1a21aa8d4301fd3d2cc2d809f717d6c64df8
-
SHA512
cae18b48f9813232154e908149a4ca935a70690794a9aaa76aed3058016d3c8264816fde0fbb6f41b2ea23ef79692db7c890c84607d188d7d8d2990d4ae90570
-
SSDEEP
768:SET1h8vzC8C7C1C9CKCNCmugbBAaeAe2F7wqee0G6ZEnf1ynH9H7CUnFebM:SET1h8vzd4AO9wHugeAe2F7wqee0DZEc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ca01b85cfc67d22578f45b5dbcab095b6bcec93723f58b964618acf991f77cae000000000e800000000200002000000081bf179ef66d75f47e09422dc0e7bb0eb3e51661c16c6fe89ae9d8942de535b82000000060bb19f48e8a8a06e61ad057bde175d2472fdd6448f44ef8dd39f6a63e84f30d400000001f2437d371a486d457f53e723b36b694ba67db51a3670aa79f7eeeca8a5d13a2d668a2b0c57f98b1a71d4d6b53627b7d74ce83722213b025290072a8a414d30d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23DEDDF1-1E75-11EF-BA8B-4EB079F7C2BA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005c6e50987b4ce69d17f811929276e77359dbed224d9db0325afe07c0d0609fc9000000000e80000000020000200000009c71a8b11b04cbcf6eed376638a993b91f94a6b35fc6730b82b67f4f9be6236290000000a5238f3f1c48cbae88013c56c05c070d064c2abd52081b5e3d21d21b7e54c4c21bd08706b7e94a03e9cbce7a5c7c4495b072b7dbc14809d9fb2940291df432041f8682c38497f360e48f5afcc100315d4f91b085c4d25c580328b8cdb9428f4a07424385f1e81c782eb0fabe492d8ed4ff1a9ec4eead79b43130b657d289a83201304799f1eb2efa6c761ff2b3fd621b400000006d24632a32ff8a39109bd25cd4c144dc61a19ebccbf00c823f9eeb44a1958754a5ae5173639782fe8d9c16ac5ba4ad2e6a513bc799ba1ff62988466755ef9ba7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a9d5fb81b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423229260" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 1780 IEXPLORE.EXE 1780 IEXPLORE.EXE 1780 IEXPLORE.EXE 1780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1780 2236 iexplore.exe 28 PID 2236 wrote to memory of 1780 2236 iexplore.exe 28 PID 2236 wrote to memory of 1780 2236 iexplore.exe 28 PID 2236 wrote to memory of 1780 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8404293a307335114cf80f4fd46cbb6c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5914d49603fef8347aa37cd6c02340044
SHA10c65c2815e80889dcfb0815c8a9d138b2b27ebc3
SHA2565ceb0f69479b17e9c3b836a020207fb6764b0e2c516d87aecda8827ce5efd03a
SHA512462a2371c4e700efb5fbc4476c8d2c455209fcd0d95e224382089a5cdf19c81a559ad69fb94c330637126029378946e0a179259155236c26d2c9fb70902dc590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff9d0ad0b30a15595f5b1afb159a5e14
SHA192fc7c47f87395b160d9877e2da0c2c8944fdd7b
SHA256125490c8f661605b9726ac2a25fa0ce5e671ccde69202f6370d32c1ade72cff5
SHA51236cf15174858f4df8446fc404f52d43826fd19e553c7e1db969ff6ae47c2c9709972e24735daec0d5d05d856c23769a875db2f26fb34b5f2d6732f1ba3b43641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4292dcf5423262c25472a7cdc969960
SHA10f7721b57fa9ea206b041931f10e4eb8845b23ae
SHA25621d667aef56a4578444f06f7fdb8c77f5762c6714fca5ba24677a46f26824e17
SHA5120a7c367a7ce6fd4e0a3fe07d8662996636c2efec9d100dd9f5ddce59c4aead829f2908aa7875bedb1d72471f9a95e738aaa4879e83b06e8b19e4e3a99a1112dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b23a18fe5fa7080c81ee156f2a992648
SHA1680d951e9548b1a47e1f613bf1ebe3e8011fa277
SHA256de9deabd5b23aa6ea4900f7f5d9cbcea2b82f3f52d065ee4d6edbab163884118
SHA51233c2a36ad1b123f35def676e36c61bcaf0575a94467d89aff6649666b818170fb36938a4ebc87c60827b8820af7ee5a71b31f15af88e0d65f01d8552a7132c86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520a5b16bb05f601c8e8ad2fe8370287d
SHA116d67a2347fc368605a8b91f9d7b14e68f919b2a
SHA256d740651359c37bc4179f649f27c5a23632be97f723d4bf8b468274e5caedc17c
SHA512058c07c51cf65aa738f327da8a1db046f87ed4f395e09abb2da8be5e743c6e07c879295a05bba54ca42f9258bf391268a6367550f5136a8c4daac45831d435d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546c9fc9395272a17566cf8e2b4de29f8
SHA1731224cbfdf63e725e3bef6ae1f2b10ddf42ec8d
SHA256397866ab886bce97868f749aa719b9532fbe9d682c963ace25b2151313110160
SHA51223e917bc687b0dc308a5ee2e54d4953e4e4fbd5d620b86cb9cd141d6f0d0cec3e5fa63a674af1158d8123fc35660611e8588283dc2bf3159db3e674de749fa29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f4ac30ced464a83ae6a7f7533ff0900
SHA1e1ae2c853ee029727419b6a7450b8a8384cec04a
SHA2565722a4fcfacccfb0e961cab233e12ead3b7019ad6ae82d7098c1b6bd6b6dcbb5
SHA51206ecca1741ee6884c555910c1bc29c396423f2d74858b73b9af06479e2e2b79e63ef0187eeed0f812e1aecde81632b8fe54412dbdb476b61bc3717bc251fbbb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5358ea3b3bff35d204404b31d0479d901
SHA1c668b6dc5ecaf171459831e1db28a7e9715297b2
SHA256bf91521bdadf41ee17b8eb00d83def6b686f94fe1d983ce86c3c101c87682500
SHA5121ad6dafcfe6f9020839bf2377ee6d537f3cac65bd8184fd18abde96331d69731775446182bc7b2e1daaccfca527d6a23bcd30519737acb6767af629b550b21d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da95d535773161f50133b6b71cb0bafc
SHA12505ff82305d11f89090afc57b11c4f5ae430917
SHA25690764686db5945e6b0ba1af0896fc3d96c832e0d54a5d800cb9b08fb2eb3ba1c
SHA512ddccfb4d3fe7eef6642216c5b62174901880c07fe2a2da18cb05ab29193af23a46062ef6b3c980d08df1db2c504a4bbe45bb59ff26b6ae9a49d071c5f617540e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b880da5c9fb9ed8aa8013060f318a8dd
SHA11c598bba959faac2a673adfb7950ddf201a12f66
SHA25652d9470fcf954ae8f605afc6ecbdab80d4f38d3183e5a756c12d0251866fc843
SHA5126f58bc79b7963e549306bd7fb423862a1cdc6cfaf1c6db951447d07b19c03f206853f12acd6f4211e4cd45c3806e0188fe0a3176832e093a53c372d2e42b96db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2d38359a6683c327f2fde2ad80067c4
SHA10fbd0317f118fd62d48fd8926b7e9c2c65cdd27a
SHA256560a9a684681ecd9c13f35631f9f3238b603261686bd63c00285eb32530c6507
SHA512fd031fac901a8b69066d79d023a41eb6e6ad40167ed671dc23324a3af0954e657623391a067ea0ed6c1686cd69813b1f88ce02c5b5f88e6689c9217f78624363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcb46f1e7816392291283d1bb2b9e498
SHA1ac7e4fb067608e66c83e8f08d9f57586fc6fb4b5
SHA256e8f4d1e6c3d3d2d0dd06ef7dcf34fa4e609838ce390fbb0e2625e65755d6d72b
SHA512e0d67c504a504ced9b300a025e17d0dc27b5204112b5cbe2b02261cb3163ec90ce5f125c9721e8c64ff0a01fd4f7208a195629210d35d16d0eb4a255b0226ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54293c4511b1a78e78b3735861dfd62ad
SHA14114e8452cb050377273a705ed6db4651ed37010
SHA2568bd226d215c5ead7701de2debf36422679652c07e7057be8ea2c45b6b614388a
SHA51270b3c19f98e683a12db1898656355fb08573b1c5dd3b32836c15e8fea57dc8f7976375625ff4a25bd33f301706296cfa34a94e394867312d8b638a50ab090e0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54157aee40ce485ff4ec3b1fd63074a9b
SHA17da7a9706bd98c406660365b5bc444dd1f52ec81
SHA2560622e5727c9256f783cebc01336b0822c29d3dfda767788e570b6667c506e005
SHA512e122d9e642c6e3eed47ccfd21554b4f3b5f6300ca7de0e6d25d19bd53dcbd51f12ae385e7c659d56d7b5a5577c5e90efe581899317ef8747ec54494762937b48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5909b2e08609ce856b612c637b9c066b9
SHA1ec06810eab8586c876af8c19cdea6be54754f069
SHA2560045b5d3b0facbafc2c0298de594a555d214e15b0ee72924cc75c07424fb23d9
SHA512733a422c0e0cdaa49b011baaaa1c87879fc9aa7f42b6d13cedea152c22604d6ac39a779a2aeb45855cce501225cf88cb5d7ee954b90ecef034d90f8eafdef999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5330dbd8e90fedc3013a41bac383c40
SHA1ef0843ec47acb50a80aaa155b46c4a5b73a7720d
SHA2569051990d2037ac710b6e3240688beb81aa3c3e33896b3a819cb0e272a7de809a
SHA5129d8b2a2e9f5473143ae80de74387552805f4baed5cf5f41c4aca82c9eb383eb2c39f1928c3be09c71ff323d9d33180eeb2be0b5732167671b60964ab8b861a58
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b