Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
8caf334ea4380c7e9d09688266523f12_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8caf334ea4380c7e9d09688266523f12_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8caf334ea4380c7e9d09688266523f12_JaffaCakes118.html
-
Size
45KB
-
MD5
8caf334ea4380c7e9d09688266523f12
-
SHA1
253e4835bade6227008ff35def7f20f27a689431
-
SHA256
acf1046dd5426999c4f5e6bfdfcc1a9b4ea649847775954e0626de591dbab759
-
SHA512
a03543d5a57c4f0d1c1a09701f10dc37be0a0f7c2fe31b355f791e90d4685bf7b1f4388d2b1c3c8373783aa5fcf406897d9affdc201c64308aa1cafc02bea790
-
SSDEEP
768:kGKM+BvLIACkCQCuCPCSCaChCNCf3xmSxFcBqBS3cwQOMvx6JaE/00z/QEAJmb3J:kGKM+BvZLxd2DNuK43xmSxFcBqBGcwh/
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a069eaf598b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecd7412c9c7fda4db9cfd923fc7ece1900000000020000000000106600000001000020000000ddcdc2fb87b37833ca215c9014b3466eca13984c9ed3c3e40cd7e012a2c38fac000000000e8000000002000020000000f2a81fd6980fc55bcf55068295adccd850acb048521751c585cf80f00c565cd42000000004e95f2c26380ae4c394b49729fc8572ae2ba35ef0c106e578fd95f726484183400000005fddf84d56ddc68620b414321d0530e1c706e264c461aea8cd8e72fd5311f9fdafaa7f470d10916b46d312540a4b65c095d1d9c3e0fc002dc867381ed8db8790 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423459035" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FCE0381-208C-11EF-86DB-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecd7412c9c7fda4db9cfd923fc7ece190000000002000000000010660000000100002000000003e34bb0bf295fd23b01deaf12ceb9fe256dcd8f05b57ffd7897787b0a0d79c2000000000e80000000020000200000001caded611831d3ce5ab1732f0dafdf6ed040ff40d39c75c039296260d50d1c5090000000324f9dcdb17a038e07587eb08a2967a53dfe109e5a65419a3858647b17d7dc71a7d631102c8f7376ff6c0ea4323897a37276586435eae5fc312f26cddedc14aa96cf8d44cb8d6c3461e615a6f55cc8f69e894cff6d7deb2ad3fbcf7d5a9efb2f202b37577555eba3be61aad4a9ecc85526222b2cbab219a28084c9688a50649edd6bbd8f6604d6579f9fd9a567e547c8400000007b8b3d9c59cd4e25d3acbf1c538a24ce664a876202d8b66f659d170031f21fe734063c1ffaa8def104bc4c64e6a925f8cc9f3207fc41a801ff4b56588185095f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2348 2080 iexplore.exe 28 PID 2080 wrote to memory of 2348 2080 iexplore.exe 28 PID 2080 wrote to memory of 2348 2080 iexplore.exe 28 PID 2080 wrote to memory of 2348 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8caf334ea4380c7e9d09688266523f12_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5c364bc2ea0f1c0a36a6c7143b5f081c3
SHA1193f51bcdeafd533ea7110da88fe3e7974e3ecfe
SHA256fb8525d524b200901fefc8f474f672f74e5dc1c0e9f116afcd771618104e4b2d
SHA512dd90cce136d73e12a16eb16199c48c50b0a4a573198537e1fb925e150bd87825e75e85c24c76e932a17e276d278eb6dfc2fd08de68235fa30473505c10a23a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbece74ab01ecf3834a3eaaf93646c6e
SHA1c145ef22c64cae327b80489a187aad493c5771c8
SHA256af274106df42fa31b173d92ae265dc3177e21dc296857a8433af5e09c310cf54
SHA512e23f811e9ad8a0a00feae19c57ff29c52a83b056fe5407dedc3461ad3575400acdc4fe84c110341ffd08cfebd4fe333b8e03cf44f45fccbbbabb5c2595ff08e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9120e6a9f5a709e77bd4ec0c2f8235c
SHA1c2df476261a8809b79b1715b74e46ce11c532a36
SHA2565193aae0a5d772cf2c6c69648c9e2f900ef4e72f04f85e12f2bd558d77b206c7
SHA512bcdea39098a453f8471ba5839437b05452a510d048f4ed2dcdbf6dfb6978458e22782432f56e96517f68697e2d0fb459c14f25b5eb2ffde428ac45e6256cd80b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513776942fcbb116555a2cd12842320eb
SHA1f12123447815baa06833821bdfc41126f6ffa58b
SHA25696d4d485394c5a8f2836d5be514e2b3943419e05fbc05b9b6374250775c312ba
SHA512cca548af7f97d349556818199b1187e7d11a49488d3d29bce9564bdc59d4a087295c86018a30cfefcd849716757aa3f4b66babcf5d9fc4c89c67143150c68f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c56f380b71bbb121058ee2abee5686cf
SHA16287ca4e2263f8e46897c49e99b089943b1fd114
SHA25635059e5b1000091f96db9ad614b9a8fea82b76a4715881b51ac9b811cc86ef52
SHA5126b501e35b2265bbec36b599a59a264fad0338162ea89aa8bebe36748c1aa8390086b7629d86f6ca669d08d6854ba5db8e87e88da5bc6caca5c7acf01488b9b91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55df3843e8f2500a6bcede9e7fa1eb079
SHA154dd0eaa62af61e1fa8bc4a2225c981368015e69
SHA2566bc4e6873b49f1fa9a1e4ab891fe42745023628b8d2434399c0d615c888689fc
SHA51297fdeb426d5680522b9b56203a9f9756e74b055e836f03e5d9b3b7f142a20b955f97c6d5daef150955d106d99f953facb706ad4022b5a8be95974f2d9e6fd521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521f19e532b168176ddc3627627a84dfa
SHA1385d0e836efb975640699fca24e405914ac1ddb0
SHA256d4c103d0f775d691970bcee26df9a83f0f062999dcebcd02405c3a4a63bc55c0
SHA512f96ceac99786dec15e62abe1e64b549ec5c3b1b60542d54a94825fe01615a31619983dcdd6f12dba6db2768ab9d04ef94c994ea661a746c1090a3d3f2c5784a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1f7ab514a100db34129d3c5d5f0c69b
SHA1addeba6ddcea8179ac32d0c5cb8902edbb16d376
SHA25697d6c200c500323c3e6e99a512f33bb2e34377491f83fa884f34af37219d9acc
SHA512f0c3ce20480bba6dfaed454c4bb47463711220d4fa8f900f18a66528dfc89274e3d68918d5dbdfd727d2930aef81a031be1f618fbd0311f7060de63e4af41450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a24e08c83fe977bed803ee922069c64f
SHA176cde76f5a64d32da94ef7152527f586d5568e37
SHA25654785bd90037fd53432200ad4caa7d918e1b7b772d8e9c8bdfb80ea2a44929db
SHA512ecaa2505f5e955fa7d97db333e72410ce28131760ee4fe4e80ab63c05a242985de5219b8a741db33ea90427c273044a46ce70507ab196a886a50c9896d4af87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb9470e0e83948f8b675f130994f05a4
SHA1fd452585d39bd6481c7a9ca5a01ca8b74a4e67fd
SHA25623a98c50fe4f3fc4c3b99ff508d40f8009cd9383536a5fb414376d96b2401afa
SHA5124974a4b64c2a89f4fba0e3dd74c2f935e873369d654871af9d7ae3bcb7c134c2ca4fa39817332d9d5a83be5a3bbb55ac4b0e840a3b2c8e4ac8cf0264647fb133
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbb089327e580ef654f90cfc4c0d9a11
SHA1a0f7eac833cef4bd19eff11b67317bb383aabe82
SHA2563f0033a889a3f08634bb4f2a095ba555e5ec7bc917a521f1489e869a870b31d9
SHA512d2df078eedb8455f11cda531bdfaf546ae5e5c3300d8486133058482fc0422205d2df9da08a2b20c9b54269f2ce3937d7379298672690bd8b447713dffe3cfeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a93432f224254c8e71dbcd65a8d9fe7
SHA1c0406d2d621f1c036617f3f1ac09f6322aad3a35
SHA256329fc8c32c686480652816114165592d71d4e64b3bdea5e2e71d443490fde435
SHA51271209b0c2c41c962eb8a86591b5b57fbc12c69ff746a0ae3c44a5a97238ee9b568866baf4248028df7751d29b2f7aca0eecefc56d1f1ff166884c36e073ff14e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5bd3693d3baea748e26857732b71fadcf
SHA124311a63cee6e429a74f38a48b71b60e84ba4c45
SHA256dd354cf0aa0017173fb2af0db940e458abe685cb123817a4eb5434a67ea799b6
SHA51293ccb14cf85072bf72a0edc87950a0ac10bb90da8e6a5c542dd71d40fae429a4747a17c78edd29826e566e1567b37ad283f35c51130a3940e0eb23a03bf6855a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b