Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
8826f82f88010596e2c90a7d121cc718_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8826f82f88010596e2c90a7d121cc718_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8826f82f88010596e2c90a7d121cc718_JaffaCakes118.html
-
Size
799KB
-
MD5
8826f82f88010596e2c90a7d121cc718
-
SHA1
9f56d377487110b76c20dc24d0c8af5c71285bb8
-
SHA256
dee0c1286636b45994244717937d99daf9172ce489897d6e6b4dd43ce49a0b72
-
SHA512
8649ef6a433c812b1a95faf14b5f8222618215ce4d5359d341e8f3b3fe1f16243d249df45730dca4c7e5b39a356bfecc68c8670bf763587947421a2a12445f96
-
SSDEEP
6144:A2ZeD4Zvb50YD4YNw9H5smB9H5sm8hYDc1OxDUxf91o2Av61JTWJ6AJYWA69JoWw:u9H5smB9H5smk
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423346952" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fefc2689ecc41eac4ec4be0bdb2598a5560a828d7ab7fc4f77c771d2b16645e2000000000e8000000002000020000000b3353aad826282d707d20c371f725729d425d80709b600f1951c97f1284cef4c2000000007807705d5987db0cb5b3336f61ecff7ae7377e3e03095a8b2bb0fdc3b9ccace40000000a83ad1e084b1e50a06029a19d4cbd90402af0b57e523fbd3552f784434b6697953c66b59ecb2c236f953e11028a2fbe959254768ea70866f85958ff26c46ecc3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c7df0394b3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000aa7a97f02a2331f83916df67259e554be146dbebf73e50ed596824a585f03479000000000e8000000002000020000000b27ca98e9a97d65cc21ae29130dd3d28b80a8715a0efe7c6b33be2a482b6f39790000000c550cbc9c4d573cae3d44a72cbd566fd4448bf6c92a135e8a1b0f49f2cf3793b5b4720a88e5b0a325c49c4f811e250b0f6e6e76b4a5ca1e78181b9aa73e476677f9309b96d526060a57b07dc193859b36ab0fe6f100391330d0f0d408581edafb58d389c9a3d6751428e53bd00d32d7f35724a60579a050a63b19938fc29b522be52ce11e2191248d8e9a7a750293e9e400000009d7201fcc6095dce209018af07f6f09fe6e54e2eb8c7bb53c1351c7d3959177ea9c8f2b00af9be4f7db29ac177aab19dca7ce3ac3c0c466f4b689d505b4059c6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26C7E031-1F87-11EF-BF51-4E559C6B32B6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2984 iexplore.exe 2984 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2916 2984 iexplore.exe 28 PID 2984 wrote to memory of 2916 2984 iexplore.exe 28 PID 2984 wrote to memory of 2916 2984 iexplore.exe 28 PID 2984 wrote to memory of 2916 2984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8826f82f88010596e2c90a7d121cc718_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
503B
MD54b4ce40df12bd81cc19cf264bccf0cb7
SHA1c7dbb908c881d1ce046e48f08c5f1033aac5f274
SHA256c676cfef8a3234eb51a49ab8c3bd2fb483965403993d82a7f91835d9493f9fd7
SHA512896ad10b29ee14d9eecca6acb4fa7aaecf75cdc979f069289099fb67e6e31e3b619a14ebb0efe4d19962090721eb6d9261e1fd4f154d19d5c872287a9811088a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5977855be3886e63dde9f41bd4d0cdc52
SHA180f5a7519c31b55d58adc9055f69c5e0160b0343
SHA256ca1b2c4036279578a9c7556fbc9505bd037df354fc96c939f33ca179b489336c
SHA51245406495ae84195c4c863273610ef04f89b2ff8ef98a1aaf9321f25d5e27860dff84836aa8377c370bf02cc5767fe8411651b4837e5cacff85c46e5c17bca89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb7c5f4ee03a02df095407a0f3a55b5c
SHA118bc5caaede641137e0bf5f2b43401419a7c9043
SHA256b7877dfdb896d8c6487bc596d30f5b6e83026320ea1346a450af9f29c47a73c0
SHA5123bbfa489cec6c0d87af5434bee9a445eaae641ed82eecb5c8d65669354e18b31af3cd47e51b862d28f4d3954f8260fddb014c7a48c363952f1947245b75ddc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55abed89324f97fadbfa43902078c615a
SHA165856b08b94347a9c05bca1280d9e987b5f79ecd
SHA2562d64e8fa32ffe2c73a13036717d30128e1a11bedfa60c62c1bd04574ee1ee4c9
SHA512c7d114b7b68c038ecb2f498ef4b9d6ac0a68905f6be7a7880fb25eec735630fb567a79ae6d2a7a0b5b21ba1cb364b0af90051f9e6be599c222029f0f08ee3bd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e999132b16e5e56cc88114d1d7306f7
SHA1e634f146298a3e576628834df33d001ce87ff96d
SHA256e514434b726c0373d7f6fa14ab24da9ecedb8817f4e360f00346559298464a7d
SHA512df61e1b22ec2cd9b139b1f362ead21f426163db38607b7f0daa92dd743384f758287fafe61a29aaa0b7dc73f480984118a7f085a8632985f2463ba2291fd6c7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff1368df2f893c8ca6293430cf81bb87
SHA1b9a16f5319d922dbb724cfa7093de8fe8fd7503f
SHA2564a752d095ef17a030edf675a92923dd5132ac211a3ba21f5699b19261f503709
SHA512082b50e251b87b13bff2181f077548503e88b35beb002ec858834cfeff7816c5a046aac7c8c0a6a1dc9eeaaf500ffb6f724dfb4ff2706bb747d6f4c3bef382eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553679b84e28197f6a0cf47e5aba81a9d
SHA1e5b0c62c87bb2d4b1ddd5b586faa019e892ac5ee
SHA2566c26233732bd1ae1bb7a3cee9ea1c68eb97da335e9d9f2683834f4937fcdb0d1
SHA51202a770d82d8fbee2a0f47762262472d550b6bebffb1e5a55405a7418887acd67cae41b303dfbd62b65f5226fe74461dd218756524eed696b41ddbc1af596eacb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e59fd4bcdf182837dda5fa673e8e4fd2
SHA1501062a4598b51a5821cf78caf3fc07ce8ceffe6
SHA256844cb529a543d2ef78df10f58122ecb3d5e40142672681a26442c893833990f6
SHA512389d625b5d009079a8a48bcf212e67d37253daf20e633a22638adc94d5668c06c677751efdd07300c36d2a6c3050dec8192ab1c660900e46f08372087e149524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebd3e6f91a55601b95bf07c1726d36b9
SHA17bf30b78f47088851d624d5b64dd5eb36346658d
SHA256dc4b0a89ee3d84e81419034b59b1f61ea63c2fef1801bc6facd74248a6c24c9a
SHA512ee0c040058f6e15eed193c3097ac972ff846db322dcd3490d760cba8dd08b747a01d785a909b32d14daf21eab96db47915a365fdf8a68a31eecfaa120bbb8fab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5041b03fb6dc03c4e4357a9f2a65f5617
SHA16edcd6112225bd8648432df8cfa8d01df8bb8c7a
SHA256b83f158c1624217aaea0ea5f326df4f2a62b18a315c0be46f8db710c9dd8f979
SHA51280b0488e0a9c66431b28db3dd6bf7b73d7f4a16af4cb682d0ab42f5b35e1241c57ec3eb3ee95f4d4707fe06fd2b10555b0e6cd49ade2117aed82a1c4ac45df2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feec5e6ed0f9a78b21672fbc9766a2c3
SHA1dba6028b7df11057c4bc9ee70bb12ac32b5c4ded
SHA256f30f24b8219ee0a3bca7ad3e8c3c6d227536c60e17183195a0bfadc1a4d78312
SHA512c2bc30be2e82f305751f54ef0c98678bcd99e47ce3ab71bd324d3f66e304aa7825020861c5ea6467a8e165e18b94ef416108a90100879e6d607e2434e8726fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560fa87afc37927ecd458a5b63aa71b20
SHA1d405daa5f66cc0f7d560dc56625c8461f2ce934c
SHA2567df928a72dcd34920dd12831b93c44c89a17b75e797d1f03acae39a3774246dc
SHA512a389ae903a232cc5ddf1a3fc14aaa87872280ced680dc1aa381a080fe4c15d7758a0eacccd0cae070ef4ef9a814f496cb46aa9d316759c294face39f99cfaecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a4cc5cbf99c0088b7d726208290ed68
SHA17e16641283b9ad93eb8f7606054d6beed70a1aeb
SHA256557b070898e5da03a5a4ed47917a91586a723cbc643092c2311adf2421482b7c
SHA512d3adc441e7e29c8e271cf1796715b60a9730946ed372fbee50e8148bf10fb7a5d898bf789b23a24ada09afce62c0e7d0175a15433c3f5ac2e148f36e5203aedd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e179fa1e3a4f099c982ab74574fc57c
SHA12fa2e10072ec22c1121d246efb8d228f74a8a070
SHA256f895bf37243c5ec5379a9644191250a13ed9f3a1b9416f3a3fac838a8559ecb5
SHA512213c44dbf0f1187e00fc3011780dc174c14e700e504ab46c486d7cd53946ca13bf0e38c93f2259fb20c3cfc99a911f07ad4c072a2c2987bff032ef4fe95b0903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D14725B7CB4A8319798114454598073C
Filesize548B
MD572baff46568151001bfc3b04ec52d370
SHA13bf8781085bc0c93ec8d2db7b172b8c5412c7514
SHA2564d1aaa7a922ec0ee06063a0ad9b2c843f9d486704a8d0d1237e1d98bdaaaa485
SHA512a084a4a80382cf0aff916777bb22f891712bdfa8a26800b2cb44059224d181b636fffb023c187a26c2aef60126ff915d884c23c5294ec21a6f36d10609d8ff0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D14725B7CB4A8319798114454598073C
Filesize548B
MD5816e506c0569ae71c1d4129ab6b63635
SHA17a084275af907d6e8b6790f2f9f3435c9a3f11a2
SHA2563968b974fcc1dcd88e7c27eee656e4be24cce797a45fd513add2b799dba2a1f3
SHA5121d42b4716710cf17e6bbfb212d748c10bf732ad01858a669465e6f9d45ab6742f7708202f1d0ba18f3c0a2391665bb8d4587960c82c73d82195c8a8650eaf22a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\jquery.treeview[2].htm
Filesize162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b