Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
8667615028857f5ed41091b1853531af_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8667615028857f5ed41091b1853531af_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8667615028857f5ed41091b1853531af_JaffaCakes118.html
-
Size
220KB
-
MD5
8667615028857f5ed41091b1853531af
-
SHA1
2d7f3492e8abeb77a55af49abc31b013783c82e5
-
SHA256
c7766274668697e6d121ccc07dbb675bef61f058c1b8691bfd67fdb23b9152af
-
SHA512
77ae75e16acab58e140325455b8cc64848f1ce862a1e455e47e9c2cd4e5c3599a6f6a747eec33b965102bcd950f151c3211d8f2c71f3e1d09345c5e5476db8b1
-
SSDEEP
3072:SiyUMui6kVORyfkMY+BES09JXAnyrZalI+YQ:SipS9sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A2368B1-1F29-11EF-8706-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423306609" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2252 2172 iexplore.exe 28 PID 2172 wrote to memory of 2252 2172 iexplore.exe 28 PID 2172 wrote to memory of 2252 2172 iexplore.exe 28 PID 2172 wrote to memory of 2252 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8667615028857f5ed41091b1853531af_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50abd30f4329ab07f5c39518ab3f2f4b9
SHA1083643ef8c0478c7d9d775d4f4ba42f12cafa2d0
SHA256578d2ad89758152b62fd9982825e2a5dd52de21207553187f3daa3a6b2f30317
SHA512041571092274ad31d4cf3123b6c459ab926e9d949fe0f4572d61c979283b2e248bbe1ea115df83cca47f430e8e1f95a8d81130e6cd158c9fd942db60f6859cb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0eafe18dfdc5d7c48726a5956adb59
SHA1749c19c120bc2a603b6ce15e4dd036eafec3a000
SHA256b272baadd3c809fc4770277510f83816ca9233ec6daaf51e1d37533ec410f4df
SHA512462dd82824b692afccf2beb3ee9e7bd60b891b06b93d5c3f0a765a5901e9c3fe4c5915715c2c8e6ef61283b70fdfbe3a6da3ba29dac1262fdd98d4482b526bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a223984f000486050a2e6a61108ce646
SHA1358195e14230676ef2423660dbbb926093e3d3a7
SHA2561470ded58bfec56bf6ee077f15da5d4c3e730ba6bb1151aa7c2f3b01627ac458
SHA512078681dcad1177b91f5c65166b5ee6c4c83f8339d90a9fcd64002e1bab35204827316d7fdfbd928f5799e8ded0d47e4635072c088a27e8237960dfc59997a91d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc6100c60a49af0c5f8b6993fe5bf969
SHA1add2c5f08fb8750e15d5d7c97dd9bd5b7ff6f4d9
SHA256d72d3fbcc089a4ef9161931ae147d3b3223628b89437c1cec783655a288c68bf
SHA5127c5ddda042c82f4fc7ffe63298289b2094180b81e431d54113d8a7b1ac96383f5928bb8d1bd40502900f244e4a66d4fe1ec7b52055ac98d6b4854737b112b5c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8e34799a2ef235c266911e4eff0ca25
SHA1c8a01bbfbcb1da0c48f3de6c02c8d72d803f4ba5
SHA256b696c0c6653581bea5e1009eb52c72e6fbc5f789387968a71a3188ed2ec1619b
SHA512a4b404c08011b953ebdd41bcb28e17014f5cc6e07b72c04d7c0cb48567c18599f850e63924af0d31003dfa4295c7d96467d849f32d7eb2123820c1a19454461e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a8a6adac25736638691c3404d953ce5
SHA164cfe8dc46d151176b69783f3821984a6ccf7b4a
SHA256070bd739eaadf558bd955a2ce30fb4c579de76f89ad388fa4e7a1986f8bb70ad
SHA5126288353ef9cd2cfb8f39894fd576af257c635959750b2defae42e42df251bae69d17f5e13a3b441f5abe06bcb7ac2ca854a9ec63e1116537e525010560d4a4bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1369367eab2b063e4e3dadd77d9e286
SHA1512fc65d11ab292642a11d7c5fef07fc2956e84c
SHA2567ea734ae1170cc86bfd6e8330235baaf48dfb9b15f607a4f8757d82d84a83607
SHA51270ba58dc49d5242a43887ba4e7184a31dbd92b15f99a6f58e4dbd1290f498b3572c78338d806f3e9bf5aeb8f770ca2b834ff9a3677d0395c2433527b4e7c5f06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f906c41b8f55338c489b90d44867abc
SHA1d925953799d3bf6b81158331869feaf911cdec50
SHA256af4465380c820d60b17ceb7149de6d91be73d4dd4a25d2ea3c817f81d32156e8
SHA512c9a7029fcdd874c0575ed6fa1c7ea0bf7197fa0add178a3fdca2376c94de486510013294002259704428d315b9e0f8d8fcfc846968c9fb1f46bac96720bfccf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52520031eb2cdbfd4a426976e501e5a49
SHA1484487263704ed60abc6c9f79f668a636235ea19
SHA25616ed2ebfca95e03ca2eed5e01ee327fa2e6b3ed91c2fa6607051c86b6450e210
SHA5127bcd1fbe0dddeac1a0d55d1ef60bbc39abc5b41a05cf0d7f6013bcd13c321734b4efa6840555a14dd7162a1ea231a21d81d3c7b25b217e41337fd516ce2f8b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56aae9a588e8849c505b28221de38a427
SHA1831df7c223c6e52e1fa04a06d74256d6317dcf37
SHA2568be49e940288ed2aabeac1c0fa0c08b32a1a0ce6eed24bfa8ca42f311b50f4aa
SHA512ef414ea9650d41be01cad16d466b600b401c3ab952c901872835fb56c39c802d4dab5db673bf7e6c1f49c5d4d0504245886b5ca69a70a4b3735ba64b0faab100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f7fbcc24a9982ec6240eb9d0f5a3b7f
SHA10a58d8e091af8d0e7364b22b662a7a4a909d8a96
SHA256361e9ddb6e20c4ee624d8587a61cd95f136b27c60bb7575fc5e4c74a7a4a4189
SHA512412b6051f73949eb595fe06d8bc76a9622d154555d5f82260f143c792e7e95aa7b4d436acc313464bbab8f2aa73bf66720197aa7fc321e2f7ec4edcce6ff15fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5442b14b287ff2d0032bb9989ea445b28
SHA1193e512d12bb8c2bbd8220a4d42f80609c429705
SHA256f383fc9bc6bd4949c30360d773763c82d8ceb78056aab725e6efe759cea7059e
SHA512e93bdb77e23a8526bb8ccf816cd7c53589b994d739caa2bfe2938e15d4e8c6ab20aaa424d5dfdf68312ba45e0378c66d0a865f00c44bf057abf8b4cdc3fb286b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5b5ad9c845a1880a95d6eafac86a465
SHA1836f3fd47b1e6f5bfd3a706500a5f6ee828bfd76
SHA25651c73dc366ddfe9301e8d3e73ea7badc0800869cee91c86c2b221514bde06283
SHA5121c34cfd7eb4dd3b7a812a75d1b9eba438f303cdb20390192880a273701ae4970b2d9fab39c03ef896d39a1ce3cbe17c3f9c42d24e3a67bd6c09e48624fa3bc3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9201166794d3ca2e1478f4de6a59a97
SHA1e02158a716a992edb62e2e848263a82cb40f23e1
SHA256f10a19a8bbbffda1f8d077580c9fc294a90488a9aa5ddcaf44215ebdca665f6b
SHA51228539a6e194d041c02f1d089b54875dbdd6236968c704e543e2b3877bc2127d332f14a9754a54a57e50a95516aa0539f815c70888eb3e26638f6eb982858d317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bcaba334b2e9793d4a2e60c841269c5
SHA1538cbbfabd68ed2e0ed3519d6f1eb1660040512b
SHA2565931f1dcc4d9489db9f2e3079303480c331169117f93f93c7356824a2db1fba6
SHA512c69034664671d98bcb58afdd4be4b3e2e736f18845ad41899cf272f3e5037cafa4b4da4776429a98e907075019762a5910be58b1ab874b149ca7573ca57fe0b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7751ff2e1fd6fbf5b8b4233c78fad87
SHA19ef67c7589cdd6ad232158b6a041dd096d5f31a4
SHA2560c468e99f3cbc777e0efeff4dd25f605bacbd02ff45323c675d610d6ad2ec975
SHA5122887a00cefcb394256d31ebab7bf54c3859b504984b1ccf0bf5a73aedfcd145ecda74ab37baea56079a5135a3c6084111adf53f7a1910b6c0aafb007db7f6ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567fddf6388834e65963709c6f760231
SHA1364cf0aaed59f6ee263fb5bbfa39bb57812fb5f8
SHA256b46a4e49e2e51d05a6157167d1eb569e65d54d52ff717bff0a1ce4848176e116
SHA512f127f34219dfd27ce5184c284dc6e409edf4ae415eea84d34f98cd16d3f71c5b40dd69f87337fb929672566ab2bf457c25721f268b0501b319c28c82b6b77708
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a05bdaef0482a3b5fa9bb20c9cfe23c
SHA11f696b631e64a7fe5242e27c8609ba34dba29d9a
SHA2567047c38044cc49512ad066a729014dd4c035eb4221d2ebe554e9790b45046fb9
SHA5125f64881d07b06c3ee87eb23e1b144278bec8eb362a18545a7499069a2401be1e0361c2d4b799c2933adacfa967022ac0f45a31093fd5017e2a114fcf4cadcb52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5080240a9ae8d700e9fd71fd0e467713b
SHA1d3a8fa699772cd644790e70a4d325b791113915b
SHA256703506235b4465fa6c132884cb5d2651072198306e7c19dfac02d4d94460dd18
SHA512d75d26a2b947ce6f2db53314727cde9caeae5b482a050edb6a31292548a43dab86bc30010279bc9dc52e6d2d194e4eaab7ed782620bb371b0e4467d2c0b43533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552e04d64ce06bb5c496f3d7901ca4946
SHA13160d4d3ba6bf859dd5bff7eed604e4c57d85494
SHA256da549142272b7187c1d8df5458d94bfbe5b879a3c0310de265d3d7c514d0eba0
SHA5121721f2f1f930f3869e7e3d24f63058b3fd35e8ccf82831954eddc9c4fcf6995bf87e579c63de6ed50be58cff0086dc179f29040062e747b5fc3a9ed2e72b81a2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b