Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
8b6e6d4ae11f3cd01cb4face0069e204_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8b6e6d4ae11f3cd01cb4face0069e204_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8b6e6d4ae11f3cd01cb4face0069e204_JaffaCakes118.html
-
Size
460KB
-
MD5
8b6e6d4ae11f3cd01cb4face0069e204
-
SHA1
3f8cada471e2248347299ae9d30081e310decb2f
-
SHA256
f7b9748b5223f03f49fb769e1c96dcda5fe005b4b9ac33100e908fdb67b49d79
-
SHA512
0e3b580e0a512e7eca05e8b243b9b9ca2ca18d3d63e344282a2aa1e921c6dffbd8e7e478e02de823d2b99e360985b6c08bf4c735775228c69a447e04d30bb3e1
-
SSDEEP
6144:SaTNsMYod+X3oI+YNTpsMYod+X3oI+YbsMYod+X3oI+YLsMYod+X3oI+YQ:hZ5d+X3315d+X395d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0055f06555b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423430012" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000079d1785b261132870cbb5d912c31587ae5e74c22aaf3f99617d17af37e0fb8a0000000000e8000000002000020000000ff9b281e18156b40c21901f59f188bab0cb13777392f71976bd61df01d13a23b90000000c8a468ef117cb129ae48dbc9d398d190c9c83495cc8a3e5dac3d2937e38267b388cd47f7d57fde5bd8a7d5bc05655c26a70063d0120467c087abaee48a245f9f1571532d9d069a9dea1811c6dc0db2f86a1f42e16be52eb1242966d3d67d24c154e017d0df40ce03516af43e37c77fca0d43f508b7af913872d575d56a01d1c467d6608de0fbe71032e70cae608c6c1c40000000cfd42059fe60262de1589033bfbcb35b7abca82668d3cc0e36ee8f2f814bc0ee72bffd374653d9de73fc66b38d1142b7d31cb8f8497965e3a1498639f9e45229 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D5C9DB1-2048-11EF-B0DE-E64BF8A7A69F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009e23aba5ac82e98deca10e67c13002ce72c47561985f44d1d9b4329a20524154000000000e8000000002000020000000b37c641ac8077dc924b9a6fc9fd4e2efec8f04094b97650db80b2a2403cbd4ef20000000981253a7400cb1bb537c870efe811c12480e9170f8735a7c975af0b2f7d898c740000000dc331454966dc81c17a6b2dcb57efb343c4c20a61a1156f60f444cb527878696c73f9735a226c2ca025de9a96c0942c2da28d1b48590c0ddf78b4c9b566593da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1780 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1780 iexplore.exe 1780 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2748 1780 iexplore.exe 28 PID 1780 wrote to memory of 2748 1780 iexplore.exe 28 PID 1780 wrote to memory of 2748 1780 iexplore.exe 28 PID 1780 wrote to memory of 2748 1780 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b6e6d4ae11f3cd01cb4face0069e204_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cda5c60feb96f5ead416f0fdd9021e8
SHA1302cdacf64d36ae2a9d0b6eb02b99f225816eda1
SHA256019bd14f93bf42d3863e1278e91e12a00b177da548d82be51ef94ec6a6484259
SHA512a0a0cec4df409c42cb6af2f70184bd19551636d204c8fbadf798dcab147203be3870c841f6d3873fb7e48fb6185c34da25cb913efcf3bd02749a38e87bd73966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d54a131e159f584c9db1b042820b7cb4
SHA115949bdacf8ac792703ca60827e8ca1c7a3c5ffe
SHA25650fb66eb569811a3bf475bb75fc4d9f6d1e0a8d2d9bdf730e867608bf1e95f20
SHA51288bae7edd068711ad2477206189598a3eee707fd98bc51dd43f0c56d9a6fb954770d9a56dff92a76254ba6f6791d20e2c1ce181233fca25696e87a3d57c0e93b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5055c4553ca3558e1c1c4e2c69c50da52
SHA19b56ecbb72afb110626a43366bb308f73205b08e
SHA2563529fb8f670551c82ed9468098e2739b5b941c2e0b6eae15143e03ef684bc06c
SHA5126de60868d6097fc5a5331a548e7d5c2e3274bd65a89d56bfec7e5d83ad82581031416cc074801ad728de819e32cd4ad93dda6779cd0b1c311b4ceb5602618cf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5401dc0efe0c85cf944b4385186ab5b4d
SHA116dee8ff915ca828cf1d8b67d02fe03679519be3
SHA256e5d4d1994387651303a80c07aacf851c00843aa02df97c89b5a8be818e333785
SHA512221062beb83eeff4e02f46e062571a162ca71198751bdf4a39ff583bc8082770960517f52b6d65401baa3144572cebf7b2064d0056308f3677049a6d790a0a85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579ffa75320fedd821421b21bf074ca0c
SHA170c397d65d9554e40e249c0bf6b8a80d5de27dfe
SHA25607867a0d84eee8c93b0b25b656d24739838d86934a338f70c83e89212e2fc89d
SHA512a5539404e72b5aba1bd1e04eaba259c255edcd944f6e3922ac9be94230f0119f44ef862e7952b9eb0cc447a35282a1b2d92670ad8016e6897af100d1b86ca23c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b6a34176774a4bb6969e253b9b62c5a
SHA1d228cc9aee9a5023306b297997d77d5c205ded7b
SHA25683f25ce56362c65cd0b102703ef4a31497300f0eb8a3e57525e09e191608172d
SHA5125982f3a2e3755f30a067361ddae558c31853dd0ad0038a07e208ea66c85470eb24007350c3d40133d3a35281fa62405786048075e3c9bf1c4337ba36b8032a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518d751f0a2dc2c8374b50cf6d4afa6a5
SHA1c57b8d569283850351b20e541f54b0f807932ece
SHA25682cc4dc714a2a740b740120579596646411b4cff3b160fef0f435cb44fbef303
SHA512f6c5324aa2078992fd408dd8f5dca8bb39d46970ab123d5b22cfeb12474a61dd6e9231d1552e871c75715b095cfecfb416b9e6a24f3f7be53971f72d9648ab94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f16908e34d89076b732aed2f61714f47
SHA1ce0db8f8631805f1734005ab8234da5ac830031d
SHA256ffbf35f1970805c5421fb86a9ea5d9f5d5320281b81d0bf8d05d7d6753be41bd
SHA512ba8fc106aa307cbbba12e1f1fc45c8bb3cb41a883bfebe9c52776042b96756852809385c715a6b13cd9913d49cb3284d133a9149127656f4eacffcb379830a73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ba3eb728972dd0b5aaab7946a036da8
SHA1016ff4f692f5522caef352ee89bf39615be7bacc
SHA256bbcc5a173fea4ccb4b66c36f17601d1af33d2c052248e049c318bbc3336165ff
SHA512cbcc5f2c932dc3a75cc53872746c38715d4f043719eed537ccab0ac1303d49ff017f66aa0a638a86c622c5e235cf8e9b2537d367d33eabfffed3895871cfe26e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb1c4dd1a452ef74f57bd5451a3a9cd5
SHA1cff4888b9f283c294beecb629fe036f272c52d75
SHA256ea88d63e196b3b3ce44f36076e8e6f7b77e4507d5bbcc8247f68692a0cd1c6a4
SHA512b308ad40e56c7c9189fd0bc76ebb7dbbbf6ddc0cd8ef42a973338a8fa8413f8354cd22e25f5d73ccf94fb9f95ba9902af4866b2c4bf2599122f25ea39fe58480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58574a73ff8e02a52267dc6cce78b78ab
SHA1647c4dd49d404797260da18f342777e5d12649da
SHA2568e13b3364c9723ba06da8b317d0039a30c2f7aa2244c9a5ce1350239a0769c18
SHA5120a1b8c0a714e85730de1750467ad22464e63a5e2993e585c4bcae19bf7a39adf223f4653d9718b8b1a38165414fb2ec3a54287355b99a20b04fa3978ca48e6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585878f84848656d2366e085e7dbf5c0d
SHA1980f49c9c1abea6fd7a8d040d1d730d3c3f427cc
SHA256bb5c91b27467c42429d17e6a294bd753630378aa4d3addada63f8edbaf673925
SHA5127fc326bae68dc4628df61f75b8c40d076bf663fc69c883d93bf92d8ce5d2028e685ef07bfab6e0529aef00e121039478158cfd6fecd38f84af6b5c63b3a5bfc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59992731802df7dd5ce3033cf1e118dd3
SHA1439004ee2ab186f90645c508a1cc3dae6b683b37
SHA25653bef79b68c251a69d5668a01ebfebdad2f63ffbd09bf6f57b6b65af92b1fb5f
SHA512c2d50f74a47e958980900e9b74d482b00efbeb53c3944fd3e1b67e42f8b15fbbf44bbe9ae7229e27d420ce6d2a7237ad063fe0a0deaea241f9783b06c1132ae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df291a02e1d820f02babad32e5e4c14e
SHA1f0deaa00030df44642eefd2c594137935594a389
SHA256c7531d63c0afada865b0c506072226edbdb5f01ca1ac1d18051cfebeb3883650
SHA512c89e4b75ab340f8c6bcc3cd2692a6cf60615aa34934b31d167426c0d8c61f9442c7b7a57bd88ac3e6f0a15f37636c38605192cb2179e35245048c12e7853176e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b369a88bd212991b726e54c3e597899a
SHA15399cd3ab88e5700ef03e5b7c6a8a017aaf53537
SHA256da8692520d605525a3e4fcbab11565a03a4fb2336fa8670fbec6914e437425f9
SHA51233bb7312b7f874a9969ee8eecf604f49224a52d5ca8064e9caf921953d516af49a4e34f88c1fe852459bb9193649c0642d07a919d4e722b8cd162bcfe6ac6bfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa0d01ffaffa5d316f041b870b44519d
SHA17305a1dbda3fca393167ebc4ee20d8e494c545a6
SHA25607c1ca5434a23c07d90dff7b7c890bc0f2ab73d30904553bae00e7606311ab4b
SHA51221af908b865af9de170dc6f7a399a2b313abe6063940a8bdbf484f3106713baf30fbb835d7087ebd34dab6d86e6654792bbc466930a0b98441760c6f9537e083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5235d47b6d7dab3d67f4c18ce1206b517
SHA1d99d7f5b502127397507c549b6a6091a0c839225
SHA256d02f1a849f400ff0183410c5f23c229fa2c2380ed12009377d46bd031aca43ce
SHA5121fe39270c6314ef9721aef3e5eae04c09246ddce3a08acbad54237892f2e44e455c5f51f81393ab4a8021ab17cc009a51ccc85955197c33d2ba422745aad9608
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b