Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
8cc04e6a82d9f15de16d7123b1ecf224_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8cc04e6a82d9f15de16d7123b1ecf224_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8cc04e6a82d9f15de16d7123b1ecf224_JaffaCakes118.html
-
Size
41KB
-
MD5
8cc04e6a82d9f15de16d7123b1ecf224
-
SHA1
c845ed2f3b4050ebcbbef1b42f3a06a20bbf8626
-
SHA256
e3fdc239e49d4f26259e8ed9af2e9d599ac9087e8a8708c2eaeadd02723dabe8
-
SHA512
bb38f39d6a14e6d8c89f506ec67c3217489457c2a76b1de52a586a12f4d75bccbcb158d7b1eeb5321da7850c56779b9ff9c6516e9702d9bf0ca1aa346670703f
-
SSDEEP
768:kQPyTb1t/4Vf02t0gsRQOiuRicSzIDpHOj7EpYn+xYyxzR02Ab2wtPKYv:kQPyTb1t/4Vf0ZHOj7EpYn+OyxzR02AH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423460911" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D625B01-2090-11EF-9387-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2204 2036 iexplore.exe 28 PID 2036 wrote to memory of 2204 2036 iexplore.exe 28 PID 2036 wrote to memory of 2204 2036 iexplore.exe 28 PID 2036 wrote to memory of 2204 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cc04e6a82d9f15de16d7123b1ecf224_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5795c117e9a6c1f7ab8cf4f9584f5e17f
SHA104b0d781d510211d0bba0b55857f847639c7e992
SHA256914d3715d4567e2942387a86cd8cec59265e1dcd960bcb033bc3756af134a5a3
SHA512d6f14359da6030d80d06beac5ed08787066cdc0aeeb7f290df2129592aa0f86d04a165567d171b1ec6b9b25b678f231c6560ac5a9f1bc550fce6947a48bde623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520836d6b32e6fbf370c3c1c6340e1f37
SHA1ab264d2771fd5236b669e54a8cb40f5a891fbff2
SHA25689d380f210d899f868ee1b997590b60eda8d90a7510b5697791bb6f1329893ed
SHA512e2c87c47feb7b0663b42086733c64aab8c08e4e62c83b12a7d8ede9a2024ccae943a039689be1487158aec25f5a571356e4ad57493d1cba9d0555d24c1e7b053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b38d72012191e768eda0707bf6dcd9dd
SHA1497f521ddd25407f67f289b229790fe2dea195fd
SHA2566ed631043fde763ce8c0b9343869decb21e03b756ddfea906144b91791f1ec5a
SHA512b9fab9720069eb203b891b6a1beb2530b006b60829df264510f1a565d56a55179527fd4359dbd096439ddf5d8c79bf2a55a71f865a0bf8b48188a7a8d7b4065f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f5f5b7fd3c1cfc995a79683a840635a
SHA183af188d3f93d8fbb827841acc40aa9d77a19c69
SHA2562893b788c45d03c1dac73aa7f670e5ada636e0c0cecfdbcf692e3d0a29e56cba
SHA5120099b4725b1c226f028ac82482c3bd88e62a7bc3cb1a389256916ec151febad343b1f04657b5f2c66cc7d9c8c17b30eecff808a207f60669fd0f0d8a482a4401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3f52d685e2deb2792f81a4ac72bdb75
SHA1bdea06d2079b91344db586e58f5bbefe2423dcb4
SHA2561cc9d32bd8732b5d00c18fbdd0b118b6d1d48ff6950bb0682032c4d64231b4a0
SHA5128b8da2fb6d6a066822dbc6c16ba8a73bf248e07f6e8645c822e5a8bd5780e2fa06ae304b1fae87166387b2fb2f4d4e2bfaac856de7397712ce31124e524a3e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaed073edfc827559c92e9385bf047bc
SHA1b23c4301ee5a88609fefa19f305575a91feaa76a
SHA256f4e91b67a1b10728927e79edd334e4794480d636b38ce86dd8332b286b612116
SHA5120a8c1972889371335f9e254591494236d130bc2b5b9ca0472d5b8e37cc34cf8b68e4d614f101c24343f0371c766900cfb06d0f3a03130ea004c51659282e1319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f91f20676f41f54c61b653fa8f1fd98
SHA1f21b5720030c58204bd94591c97d6b6538bb4105
SHA256fe376133f16ce628131c6d86fe109587a1e404d2a1b3df3aa26304c8a819f203
SHA51283259ec0ce4ecf9da2094036cc3c6145cd46536fdc3ebd26386c9795ea90252ad7f4cfd6b25fb9ff68f556a6130644cae7fff93975112543170066a3f6a4865b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3547654342312d297836ca1dc8025a7
SHA19427920b4b9b87654804fc36612b4d6fa38be9fa
SHA256f4a5e9759616eed8561f6b04b04e6e7cfb656e3c39d53285605fbf0e96ee939f
SHA5125ed75709d1d0cbca4fd91832d68bfe79c97e75c8fafc45be2a8f0469fc036cc204ab19ec2cb771095aaec3a11da93649b8a6867071d4eabb3e15cb76a2e9f8e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e38da65b9ef2303cc061c3aee3642fac
SHA153943a99fdcf14df36b06150944f58a6e4f57284
SHA256ee11f6651c30dc01fb597d432375b964cf8e8fe991a0420ff58256b36983f505
SHA51293c42a383bad481add655898f9b107f762051e0e35b0b31b9b7dc3252df83a1d555096ef2a8a9e8507d4c7c1b9540004fe8f1b50adac367b07d2fd54943e62e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d86cb09ec563e411aeea732164e77a05
SHA13a479e1c5101f8977da04caafd71e2f0acdd4b0d
SHA256cf0fb3337c6bf8f402a72e0a3f050ebd5b1817f7a6f7936f42a47719ad539062
SHA512f3aca701a23029e189a7b18568e01c87f8fd077c61b01ce906a4b1702c70e8487d89350de33b95a52f0328eabb658dfad3cd53a81b79f3ca5556e28ed139e4d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7374caacc6881ce98d5863800521411
SHA1b242aecd7894f6ddd2772cfcc986bf550f1af0d9
SHA256d902144c907121e471772e7a10e18f4fdd4bf4c18373ee039ff42c3ab6e557fa
SHA512a01f0fb9f477abea15cf6e91527c5ab8104f3b39cce3c1472d597027d31706cabe5903cea2fe514ea164b22a28e57ff6528ce856d6962734436d3b5142bec45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f3c60d16ddbeb31e4dc210c32d8c353
SHA1bba9aa46c06bac32b9c3c7b78a30ad0f5a32942b
SHA25631d47ce8f5a9419022d3e8e0696ac1f8e834a916f2872f50911fbca8f0dcdcb2
SHA5129b2baa49a7089e86c2a9d652577da4a51164d316a0799d70254b9d851c03c9fdddc5332f1c302298cc2dd81bec05ad290bf0c6b10e927c2c55d27c9f41a9e91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537067d82c35eec27ba4cb8cf15e79157
SHA11fc6c1254c58e72e4787545363d463c4b78f9817
SHA25678e6b0d30ceea5a934adacb15fc0b3d99c28d595f0982a54a7f84b8cfcc31cb4
SHA512ef1be94faf3e1b42f0b561755756f33b5194b681a92994cc3db7d22e3a328b40358bd39ee3bffc9c2a99e2765502e7d01c1b39d4e3039c77341d95f5ac9a8ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5230886b812085bbf2477a0c38bad32cd
SHA191183dfac10da948775747c690925d0d0062e506
SHA25629b2dc45cc8afa1155ca4aba53612f3a37a5446647aada05511861fe07efd567
SHA5123a54339ab905901d3067456a1e6c3c1adc27a202451a305fcf4ff11541f42f19bbfcd952cc8762a51b8fcec1f3b99f2eabf9b3f0a8f0ceb8f5e66f5069a7200a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dd6635b2d191f86048c707e8e6b0102
SHA1b88d5d49cc120c2da2eff4ef12565f9d4b436f36
SHA256293e06a4071f408f7a2ddbbb7e48a946c5a6337fde85687293bd1960d9cdcdf5
SHA5126f3643383dd6d619acec3c365fab0c65dc56c974956123ebb32648639d4f743ee9a31d903db5b26ff18dd9b863af6da7cd98e2ada9cb30e18737f044762f3927
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c811db3aa1a150d2fede015a37353dc
SHA150d9400f4d3adc288f2aeb4b4ab0f15f78f8537d
SHA256c82d2f0aab7e7a215938d69e06aa11be2cb552dbcd4d8ced37229e654258effd
SHA5129098a4126daff182f2467b13239114c2975abb762266060712f72c4d1ffa5df2b503d98efb4f955437643f1c6cce57dc45604d9cbf694b97cf50b085804c0293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562e928eb8f36d3aea1d24503bd591329
SHA13e1ea4a971e368ec974fecccb6403147a42c66ae
SHA2565311caf7515a08e479e3b1e8e1aa1c17a64ead422e29408c769965a3101251df
SHA512a66a60e2faebd78c53459e5c7eb118c976412dc57b2de74b2c5392087180b75c338273cc35b02fa7cfb50e684665f40ae639be2f748b1631dbdfa65aa3a03e5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555abb9d264d1167ab16a07087a0a4d66
SHA1e1262453193bfaa39ab8140a1973c498db87ba3f
SHA256f7223120fe7f70466151037bdbc32a6304fff8e4d489be8f6e8c56c31dbdc1a2
SHA512a74315ebeb2ab7fa90598e09c44703f54ce28b860812273aa775e6973f342cb79c13b7af44a7607ea93dad5e938bb1d31f6411b260d761ae1e5ee489fbde790f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ddc5bd336786bb5a335799b363593eb
SHA1898a843188811f541d2eb5413be8e090ec783e56
SHA2561e99e3292beab73a0a2192528f76732d1c87bccdb01b4b98d76f4c2c25dd78e0
SHA512972d45ec93dbc83b28153d7a2228ea1fb80cf56cb54a3a7c6a4a8104ac2a5c13cb5e59361565f3ff9daebfd6d9206a790bd78d7a30627dda0a2b65d3b1d142cf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b