Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 17:28
Static task
static1
Behavioral task
behavioral1
Sample
87c2ba8f36de73565733254074532cc5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
87c2ba8f36de73565733254074532cc5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
87c2ba8f36de73565733254074532cc5_JaffaCakes118.html
-
Size
4KB
-
MD5
87c2ba8f36de73565733254074532cc5
-
SHA1
ee74407b8ff9dc7eeb1bee123da920dfb0ac09f7
-
SHA256
9a531ac6c63b5b3389ac41ec0d59088d35b6f8e0224d3a060f39de234c6cf3b9
-
SHA512
12666b11e2d21d0a4c10a84d2ba6dee4e03ac16692f571c36dcec2d5e75fadcbac1c322903a32fa852d724e42c7b4556509909390469739b4f2ce969138f39b7
-
SSDEEP
96:dd+pOXJEjGCcsWCk2+Fdfd3tnCuKk22aYQhf:epO5EjGCMFdfdtnCuK7Oif
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085925f5f401d0d47b039d2790baea0a500000000020000000000106600000001000020000000948920c9ce103b4b2fd5f84d45808ad606f875e71949b7271e4011cc1247c056000000000e8000000002000020000000728be2f480d744d39f58e9caa9dfd8aa0350f6f8643fdf1a16791ce134518f54200000001f846e0ae808f7b736ad63ecdc4bffd89e34ac9e620dd3520c9458aedc47b4c340000000bf179847015b896086cfde7115ab8629cc33dfeb8a82dbf8c2ea5b2bcbf4ff624de1721a4b899e2b68e887170840ec989872a71b756abce51171430838fd4f94 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085925f5f401d0d47b039d2790baea0a5000000000200000000001066000000010000200000005ad8ff1d25064a5781e17332d47bae99959587f99140789d6dad4033552048aa000000000e8000000002000020000000c8b7a45249cd3959e77a39e57a8c2a305cf282e4dbb9c2991b52d2e919b6a28590000000b042b0f6f172744732e63f023e28104d2d99483d274190d946a9c2ece90cfbc7964a480172a79b84b5838895f97d2f524f9dad34581901cb51edbf29a4b7e8399b76cf0f492684aaccb47e983b0c4870eb8343e673df67559169c52ab20518f984f03cf6aabd10b818048104719085233290813a61c1fd08692f7cdb87d31ba0500ddbc1bacb9ce5f450f30f22e06cd94000000072c2cababdb988eb0125f9510281e7dcd78e0329b006620c5eaf77d4e3f1ea16e585d49160759f6e5612e06e9e1e4c8ef377c79a2e2968e5846f3015cc4b31f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303b9afe7fb3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423338363" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29C79321-1F73-11EF-B85E-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1580 1948 iexplore.exe 28 PID 1948 wrote to memory of 1580 1948 iexplore.exe 28 PID 1948 wrote to memory of 1580 1948 iexplore.exe 28 PID 1948 wrote to memory of 1580 1948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87c2ba8f36de73565733254074532cc5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4b6145b7e6a0dbb210d8b3f2279cf04
SHA101e47c39bf407c699c121b275177f85ad9f8349c
SHA25603c3235a81da4a7af7a6841f019537fd9ff107bbe9c996c4d899f75cef527182
SHA51294dfeba29c047eddaef7d444b76f383eae52526abb608effde091388a829614cac929cb64d2424a909754c4a33e8af48280b5d3d60270efdf2645244fb37f08d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5374601f83f21c385ecbaff66bb5456c0
SHA18ea8da3a79c8aa5e7ff23a6d81258b6ced69a9dd
SHA256f9601ae35833af8348c0bdb7166af7e561e1240e52d05da0d1fabe0320535b5d
SHA512983aa8a907b36e57fa709007794e13a3ef5dac7d1d6f6954e07a472bfc0f3be84afc5e36f66d3828078e6169a7f353d1ecaa448ec7dfe47980dc44bf0e68464e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5522c7ba122d44324745737f73fbf9b25
SHA136a53d80cd84262767ec0367f10179156db8a934
SHA25628e583c5241d02dee872f85b664447731cc9125de8bd3d8a814425f812789b1a
SHA5126d2e73f513d8cca5c4bbdd4f4b57530c0298fd852913d487bf4d98bfc46fa74d372be94efbc9601c84397b0cdde677589609cf5bd986594893b9a813c77a62a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565405d03c294c0bac8c114ef10dd41fd
SHA175e0f348d93dfc542dd10ca81b3031db3b81247b
SHA2561387be09a8f4753ed5a9f7924c4c480195bb89037dc2a420727110a4286fcb2c
SHA512ddec8be29f2ad898c9284e07eb55bed3e4c47151aecad3fea4066a6157b4b8badc6a01495d2ee42621e5b4bde6211a8c598e6f9d7e869dd5f01061c75cff57fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532d50a48aaa737abc5f6adf6ffed17aa
SHA1bd647484f61af43ae914f4b6f6a3301dba6a5567
SHA25659f0974fc3c7088c871b7d7cabb19141ff22a4cf8680da7328e57a20d20dd0f2
SHA51267fb4df2370bfc8c7f8c3c01510b560e39c80d3fa119e2474c18c4c2b6d7448bd27f063b1402dc4ee05132253ac6947c27f6e0ae012e26b5fa30734d48376064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573550fc97a14eb360aa11ab8489122c6
SHA1f4977aaf4d325f768c5de0ddfed2f649c4e54006
SHA2560fea4dd0252c22619f99db81e385687274b2fffaa93e3fbde784a62550418419
SHA51238760c69f40555e5ef930f2f75e30f91591d3e700f337ac7e0da7bb58b8a4f5d9203b14dbcc62185d98fc890f1d444e4f4bd7ae5d0313313a154eaf55c81c374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5098e7ecee4bab14ebc57e2f4dd243977
SHA16624a17a4afb5ecb45db5e246d846989f9189b16
SHA256ffa5397882823cb99bf47ac7403802a0688eaab210c8befcf0986a0335057084
SHA512e28d45bed9da8f2808f5ee23b740b7632c5aee7e8eec999e0d0513f0011a0639a74d0af99e0fe076bd6cc70a0f094b356fbdc2a66094a6b364e3538745d2edd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558ce7635be334deccba05e9fe8b0c433
SHA17a2e2627b298628b633eaa8a0b990ae6f46b9bc9
SHA2565eba05332b1ba36747faddd6dc3416b738038add41aaca485100544034d06e12
SHA51298ed334adb5894da2621c9060ba498db29952187840a1db323a65171a7bae4c38d4443ee627fe8aedf8110d3da952127c9a3030043f95f3d9fb4af08b6ee1ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555d67d2461928c89d1d82d5e15593513
SHA1cc9117abc1a65da12f91e97ebf2659ffb81741e4
SHA256928151f5d261740710ee475b1426666a4801cfc34fbe54636d782090356fa7b8
SHA512bd2f3981f648b84546b04434bb53a7e179a575b574c302caa1bcc51062f6a8f89cad6cb4458c7127971f401353b00aa5e576167a9329fdd032d96d788b0b57d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fda971dfeb102c51bd5ed5488db0076
SHA1b96d7eebfa71555f0acbf239e2db8a0e165e8f2a
SHA2568c96befbcc0d7f21d14ac87b3e62cb36490fd1b728c019fa1d80a7e124138654
SHA5121df87893c21ecf92e7eaa74aa7007333f5ee2e3e7a7bc0f373ad70b44c30d3c143fa23f0feb5832974580e759020a4a845d7816e879ee5941c2f57cfae9d9b4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58576f3663f6c2719fa29652667d8ead4
SHA1a85e3e137dc38263b470e08b5256862bb1a033d5
SHA256c565dff19f147b79e47262355f0516df85e7a868c7eb3860963d19a16b1e206f
SHA512ffae20088bf268ad7091c12232ee535da2334a0985c479254e1fc27011ce7e5410f50b88c866486c5508ad748244ced36b0ce6cb3887ef718e2c866da0e3372d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2faea926b02dcb0b88d91e3b84ddc93
SHA1122fb08703017885d3cdd3a551d1aa8bc53b3333
SHA25667082455ed1e3479f5b314e77574c22aaa769f87a60467979c9ef3092833f9fc
SHA51264673e2a3d7e231001cb427c2c85d08e9bd9973534813f608d26a1fb3b74159fb770c33ecf30d524809b529ac26b0ff2edf39c7f5742bd3d3bb138d1d77ed801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f07ca0dd7e7555edc2d62fe5a6a818d3
SHA19b94d3a86ab78845558a9504f5f8851810cb5ce7
SHA2564dab43712c185f86b158b1b86be6e1f26994751bfaa614acc480988f2657481c
SHA512d6ab75ad97a35a617592a678dadb42099f0fc98b8622f5ca8537c1dc45325c34023a8450b09a59f23b5a5b617291c7ec1805f7eb71b17d49bf51d7f236fb44e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529af25add02de4dd78caef64e682c5f3
SHA18d59740d10a6bf03cc91798df5518ca20b748979
SHA2568f004d04a224532ee9278985f1e8b2e1a62dff6ae70969a2f8183d369051346a
SHA5121b20cda813948def457cbf2b47104517ec47e5f74b66d6e51df9a0d0d966ae43b699287bbb23f266471aae7ee8bf50dc9a5f2872caf33423a08a806d9bc74c28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5554dd36176b262ddd47e9957fe882d7a
SHA15d228ced44345d5099560f9f3926b51cad88331d
SHA2560e98364eddfa98aa2b22d24c9cc7a573405bdd43e6beba9a3441e707b84e38a3
SHA512ebf345e0e787914f2d2216dc4d8996f1561b1cf0e3979320fdc6efffb2f49925bfed150727b2ede579bca949b7e36e83afc3d4dcaa0183bd01493ee0522cb54e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caa799fa1baf2827bc3b015626029d72
SHA19ef518ed332c241c6373c14271eaf46c099f1c77
SHA2569793cd0151c5b9d17e4681556c0aab688ebcea7c31636e6690e1761aac4762dc
SHA51209a04d5937044ce0c7f1e2b4f4cd81f2ac3b38d4be66d98f9d08ddd88e6d668a237c2e4d6b31f07e305056040abb021eee9a9d11ded8fe18ebc9cd9c04a529ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547e8a4981ba23d770ef34d0b1d9454ad
SHA1ad7976681cdaad47b78e7bfe2e55de0faafb4387
SHA256ca0cfc3b387b96325ccdec896d7601c413760bd28fbda6b2a6b9c5c40740120b
SHA512fb7f49a3ce8374f132d5f364ed3f9d715781980609522f6359013d8583b6fdaf915ae20b895cf903b9059b69ffe351db814768d07fcb7d4804567be2dc0b171d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b