Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
9a4b7a5fb9f1419934fdeb7d6a6e5b12_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9a4b7a5fb9f1419934fdeb7d6a6e5b12_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9a4b7a5fb9f1419934fdeb7d6a6e5b12_JaffaCakes118.html
-
Size
17KB
-
MD5
9a4b7a5fb9f1419934fdeb7d6a6e5b12
-
SHA1
605950cfaad7e5d054ed3b50e1652e394117265f
-
SHA256
adf205f6303a5f63e92c0e257bc5d39a950274e797576b9855405648f51b393a
-
SHA512
c396c5776678dce6afcce30de2c042f66b99f9b12021435f22d560b01662e92da3f864f29488115de951e8b5e3824577d6a9a8cbff3c306689870ce703aa2144
-
SSDEEP
384:HHXbUVqvIK0EuA/BMUwQNngpqBV2Qazi/SrklrD:n4UvIK0E//C+NUffklrD
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D9CB8A1-26BC-11EF-BAF4-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0016af2c8bada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bdb2c3af970bf24e80b626bde91327d200000000020000000000106600000001000020000000c47a86ce8fa6fac96c518d7ec633694baf61f746f91cc88f8b89d98b97113d34000000000e800000000200002000000077c5e9ef68e2a23f6ea161eb01bc89ba6376a4389e0401f08d53b131af36820420000000e2604aa835623a9d60f1e5d35fb28ecd9f5a9c9deb6d8ec9a49148b7bd14f9b3400000004d037768c1f9cfd7f34d98c8e3f2bc8383d1f575be4589c9800a6a06bfd5089726ec20694b1690b1249352fe98cfc4d58c5b96f81bafcfb45480ba31c3f7bf23 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424139354" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bdb2c3af970bf24e80b626bde91327d2000000000200000000001066000000010000200000009d32a02768038db0a740dd69c986ae8126178961d18a984331d68ccbf5bc76c1000000000e8000000002000020000000a01abfd7e41c0bb284ee0deed8d58befdc066a4cea34250a324499d3d708792e9000000036a74f3353821d159f48682069b0f643e06a20d1e9d4e93e36da5ef7e612fafc5388f8864ae85def6d2dc69f80422c1415a264140587155981bb617ea72481a57a8b2ff55511c9056c70424c44af0a0fb995814a9d050125538e53a4e23a52a45a9d76a182446e2c0ae2e4237ba72660a23537bdeb2f8ce962d45a577c7bdc36a9e0a2923f86a2da684e9866b580351a4000000093561805e8d8e85c23392e0f65221165bce09e1779444e8b8e19718f54fb6885f1769084bd83a34c51a4f3543f0defe2dc92523b7d71c863d716e53fad0d87e2 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2964 2860 iexplore.exe 28 PID 2860 wrote to memory of 2964 2860 iexplore.exe 28 PID 2860 wrote to memory of 2964 2860 iexplore.exe 28 PID 2860 wrote to memory of 2964 2860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a4b7a5fb9f1419934fdeb7d6a6e5b12_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb67dca5717a557c9088f91a5b6f2de5
SHA1e2f1d3c6003036e1fb0151ba8df9ebd063c61420
SHA2566e9303078a2fdaef7687b0777e8966749ee52051dcee922a61e327cb29e406e3
SHA512ddb6a65ce2981a962c8e0bddb1ba118daa950ec739309bd4a488ecb54e59baa41d1ebfdc475a663ee00b79aec9065aa85f2976f1e8cf160abc764b2c84c0b1a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50be2eb9b8811702ef9fbc25be759d53b
SHA1e787c0b09867aad1e5cd42348734094e7b6a8080
SHA25625c24f0533b43be619240d0d5625d03cd4157392b97fe3a43a100970cecd4ca8
SHA51298e50c9ea1678ec7f2b8d46da2bcf63115835300fca1c762780a7b936449461a31b46274713191d8e83f44a2b352f2be9f967c96cb810c508a7b9526f88f5649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7fedbc4d3fd648bb8d5f2b440ffb7c5
SHA1909a19848ce39c2e3ced55414b3448f4488ec4a6
SHA2569d9f52675736cab7ae3a8606d1f1829b7c2c174df8bb170da62b617f6fda1a0e
SHA512c62631b563ae6c292bb10ef909b38064f98409a496345d4c618b25ef6c79f28d9d3813ff1db5503ce87d281c05185fd00527b3e29ff4ebdf8ce7074e90717e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e496db2155e9a41f0fbae6e761d26ece
SHA16c64b633c4d6cc50bd7a97b1b100f97a33ccbe12
SHA25671f0fddefa869380e8f264b54a7ed5d6f4a61488efcef2dbf1551b8e2cc75f28
SHA512c67744af2f08589ea8351b594392f20663fafe3496ecb6d9d2c836521620049b56fa09f81213992837f2f15411f3d06bfcfbe0c24a4596b4c73acef7b068e478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e3eaa99a866f1fd96f859976cf557ef
SHA16a465e8a7afe809ba800f370cf58841b59aa29cc
SHA256b61696e0203c2b8ad8ec8383444522b986f0aab51da88159e8d8e1441b4e78d3
SHA512b5b396cd1d81767e00d22a17c452f5ce437f23b0242bd01a0398ddf7a60188cd72c9c3420c299579d81542056c7a7ac906a40d07ffaff9a165a1edaec11668a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b3d5de6cf998beed0a7c199abacecdb
SHA13684a3825b4b31541e6db0d18d91e4813a995829
SHA256880aaca8a8465f99cc218704a72d90bb7f388f08ce2e3c5eab07e033d52e7149
SHA5124860072456f468fd09a0fb5c50821d19b6f260a17b38266a603f5f43744a61c46259d218a7332cf21b12adb36de87095f51fcaefd8c7405547eaf83dc25bfc02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54999a336b3203ed49eb4fa0f8accd80a
SHA11c48cad70ca19ee9e43121d55f3be8126a345642
SHA25670a51050d3fc9b60acab37e207c0c6446e013e75f375e6b2546fac233ce190a3
SHA5122ad602449141b3a183800d878cd37df4ee2879fd0ea947ae1265173d1d670ba0b1e4002899a7a50b80977b7ea866a44ef1ee9c4a4acb2258e612a2e461138087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59addd1ea0a43bf4d45df0190a491d3c2
SHA1582fd790f28bed6d794c815751b0e00eb892ddcf
SHA2561ca5fd857063cbbaa921413f7ace80987e0dbeb68cec5249efc86bb686a68e7c
SHA51271c2a0b6748f4d1662b8915b7be1f6367676226e32c8a7b6807a83a2ade2296f0b1064982043c861cd099ebf17c808d19ebdd52b7619c6b126168c0b55e22e43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ac6d5c83f50f5e43051df44d603ac28
SHA102d818f7c803a0ed3dc60f8345a7b8d6ed9a2b4e
SHA256541e8552ce1e4df7f01d0524c56237357414c2366402c8ae92caf6c11eec1b85
SHA512a1bef11ce702b5804761728fb2d813d82694bab297fac94506c45bed9c49a75beb735a09f113e6086626dc88fe20d3e80d19792d81a23a3d51313a5f63a916be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2a0561b0a593daa873ff454c8d68c8c
SHA1a8620ef06eebef88774104b14b8ec05275d5461e
SHA2566541be1fd8000b30bd4758c286e85180a3cb09e9929af9cce0fab9bebaf85170
SHA512dc4fd33fc93014031ea39e2096f2df832269cd0b3af526f40a60e05e12d0279047892aaca523751d156d9032b602d6f9b4be6cb56830f9026eff31871fcd6eb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3b0efd00a6bd61efdd07c89e7657f47
SHA13bfdf9af1e11e04c553fdf3ea3be582ba9e2f2e9
SHA256af2f695e0869b7f1b9ac63362403784858008219f8e7213e95d216a136ca370f
SHA512b201a7db2a41e3452dc25b23bdd7d134614bbe3cd686e3ac3d199e119d32af32fff30bee01560b7063e7bbaeb7a5b64b9406e88c0b5066044a6f072da5a16bed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5677713367f2b9aecfa19db9e3bb16aa3
SHA1b43f517063a9f53fd0fad5a3e367a7a1d3659550
SHA25687a7857b1f19e353b3ade1a1c21857bf24c8679aad4e63e33edd7870f0aa0eba
SHA512289f791a36b3fc4b9aebb21ff79fd3a0cf2b56f830e9b81caef59fa1453259b8797f6e89f32b4ae67618470ac6c5d52fa91f1e252d59775ad92fed3ce7935be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515d94bbbc4b86f6a8a13662251898c8d
SHA1fb9531fc0294b56681a82d65e552b89e4d0bf8f3
SHA256efce0453dd640d8fa2721eb15e4319a6a42f03cf756614557875c3850818b886
SHA512febe28700ca2820c82507ad80415b70691aff219f304a2a1640052197a7da235ec4d50f46e44909f54fa0f3a6f6a4b363597e36f5ab927fb7d65cf3f1629deec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543ecec11713c7b70cee5e91ab84fc0eb
SHA184671f5ce7e024bbde233ebe60096f28e72316cf
SHA256ff09089e0e1c5e067d40b05ede2aea4ba5e53fb4d2fe6ab3ccb9e50cf8c1fb6e
SHA51276700c8a2b0a09c1fe633ecf78ebb4768d293b66f717413f6ac3a5f8e65d21092065cdcb4dab666b05aa539ee87b5c25e3e0b0e40b8f959686b9316a94a8da44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51412f41900eeb03d119d566bf3cda126
SHA19dccde9dbb64b9aab224ea02e37231c3341cc4b2
SHA256d7d1e63ed716aa189cb3123b5018ea99bf52116c7ac17cc561c8b4f7e69b7d5b
SHA512b18d1917577ee7bb2c9fbe814ef95c2dc85bc4ddc8311fed0fd3531211eca854d93d6fce6852e823951e61e0b1b7b1e72b587bc9d56d1347fa50b07f74b903b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55efe1d345771fed9b6545e6a96eca717
SHA101c34d25bf500d3e0d0216c4aaa198d63442887b
SHA25676cb0a51cf80121a82545ec2f4257d846d1c560812d9d353888152d01e53c8a5
SHA512701c7dca2ae8fdcba6cef2609d51062837d8c1d51945e82dfeeceff1442e020f1916fdf085092e2d579fc60b9c5c5074eb2cc20c6b60107038427841a784c144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c83952602df49d3200c19a621ec2b2b8
SHA14c82ea09408e2ee5fecc959de16f45162094e187
SHA2566d6d78f0bbde100e1e3c1d7b5a64a58d1fa36b6ac28dd8094d13a347a2cc1b47
SHA5124d6ca79a487db2f907fc047aece4fa5a212e6496d04430c66aeb7a80e8b8c365ff9057f4f83406f9283ab3c59c9b69ad22a3cbc62bb620f402c00f709353cb84
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b