Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
9fb5ac10c07882a9b13739333bae91ff_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9fb5ac10c07882a9b13739333bae91ff_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9fb5ac10c07882a9b13739333bae91ff_JaffaCakes118.html
-
Size
93KB
-
MD5
9fb5ac10c07882a9b13739333bae91ff
-
SHA1
7e6694e63a0cf06e73f43c037ec67ac726338235
-
SHA256
0d4ffc5131b3d99eab5ee92b43d9e1fcb3efa0699bcf92ab312f97b826ca8f85
-
SHA512
647bcac36375d3680253762e7b426b34beea16f61582fbeb8e732e5f22709142c65fc8706bbb27323149d9edf961ef93dec5a1101ba035ff85a0791baa6ac1ad
-
SSDEEP
1536:4woXVAcUw6lwGRcgncy4PGwPHonU/KRPB:qXVLU3Nnc+B
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a22124d08323d3468adf9f1597336bba0000000002000000000010660000000100002000000067271cbb3adc4856401a873fb77b0df51dc920b9b875b62a4e75c5fe47fdb4ae000000000e80000000020000200000000f2834aec52d69d8f05a6d59806d76dc7862f9603acabf570b140346df565d8090000000c58fe93ce2b1621bd0d0bf00b86d2e9bd5bf4fd9d2e1eae473da95266b38017f6e3de5016d447a9c6957303f3a6db815519aec15a5e50bfbc2e34b5105af75ffa6955e06ff01ebd8692214a6d1d1995a306b38d5b50464f8513c3a19668a4b69ba28a4c7e47f2c8f8133a4ce583080af41890168c96218c4e3e102dd4af49b9a07cf06f182f3fec8930f077abd94545c400000000422423da4008fefd0de9d857b36753a14ec26b75c1c8941ec5bcb6f701eed452bca5d63abf0a5b35c96c40eb4fdc516f041321c7340c2da6e448cf89deb99ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A0DC011-2840-11EF-9ED8-52FE85537310} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501ed9e14cbcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a22124d08323d3468adf9f1597336bba000000000200000000001066000000010000200000002e3f76c2626337de44fd2359dac9892b98a71171d19975f324c41993790eb221000000000e8000000002000020000000be97749d56db6fd01411b472d93bce5cfc22ae6c0bdeccafc8b4ce9de0e7e9912000000094e8d5ceb59ac99f56eba1b136f2375f4ddfd6de5c85307eb63b419fe32f178340000000dc574ae7e4ec744ef9dcea8cbd69848904bf4f23771754a752bbed7ccc8b021e1300359ec0fa48f2151500d344e0f1dffed2890d1b58462737703533f653d83a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424305966" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2504 2700 iexplore.exe 28 PID 2700 wrote to memory of 2504 2700 iexplore.exe 28 PID 2700 wrote to memory of 2504 2700 iexplore.exe 28 PID 2700 wrote to memory of 2504 2700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9fb5ac10c07882a9b13739333bae91ff_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebd1cebec2f24efaad5ec6ab7aea9911
SHA1f9ec5e31116da118198dd94595b82c1e54e40344
SHA256329f9dd45d9b8086d20b25326a946f35cc6f0c0b26c6690683e4d8a10893d834
SHA512df52868b30474b2b691c1e20c585008e4fd6090aa71d56d22b58738fcf5f5a2733f3cbe83dfc66b0da140ac4ee5ea8443127ce3526ad83ae8d8c543d3efed98f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0640ce1cb0c64fbf8114c8a4e871f16
SHA1d9302f6b52618ad0ddac20dc1b20032867abd067
SHA256957616b0db0cb071245b162d0c527b0f7313be14ce3135ce3b5ac3c64ad711cd
SHA512ef2dc73530b35f698c2c70eaa75e4c4613bde62d19b0ca949dbec20fb9b58f96239e0f4c4cf6d571b025999260d15330c0a874008e4d1f6a1ce81c54473bc919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5776b77402b0df48f1e739f36b333900b
SHA175e272a354eab42fddf67e50083358c7260ad792
SHA25698e931dfe971838ce5a413549ca9ea6261096149e74be6eb442e35e065b309d5
SHA512b0a0caf860b9189e77b05fd83251cb85401d84e14e0ce990ca0fec9014f04d44e64224dcc1103b6d6aaadd78cdb9151735efe78c602bc53e88ed860cefa631f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5935338ca3496103430e987f48202192f
SHA1157ebc3fdf0a264aea07ea6ba606bfdaf0269e6f
SHA2563aae653f7d8c82bdadc398e7e2f9a9dcaca7e39099d7ab26aeece7e1f720d515
SHA512ed2ac8e67d7079641db6fb9ded61d29c7f346a448ee31072034ff6738561c988e926ebc24f7b9dce63d73b9d373fedb3cc5ac8f8a56bab4372d3204c575e1100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5aa728d290017e7eab7f9d27d318ab6
SHA1f39103e93edd8f339479c41be0a4c80773152de3
SHA2569f4506f597c5428e8e0ed9ebd17608c9c6a2a402a981a4c0cac3b23d303e2cc5
SHA51210dd57268f8942d25ede29a2830d3d24e7f9f0c5418c029e41f18f1088300ab69fb09b66a18ad717ce023393b55682e5eb9e74988286e0c4d6e2066074dcd626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57df82e68d06558af2f5099b6f38ac40d
SHA11d16fa814105bb15271e19a4b17844d1e8e8b8f5
SHA25697689141f4ddefdda481d8b7daa5b15a17fd513dacc1509667e09bd3b9221346
SHA512c87e80dd6cb143f07655531d11cbc59eac11bbc32ca6a464dc0c75906d14ef565a341956ea4698918ccb9081dff7ab1050c1b1ff71862b7e1d78c15c7414ce3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a00cf2d8aaed6d4cd9b768e7e652719d
SHA156efa0e72e1901919c3ea83f897bd2d0d18c4701
SHA2562972381b92d27f3bf1d462b161657a05f0adfbd5a4420ffb663ba481e21b4719
SHA5125b6f1d8d26b3a7f3e70566bf79210110f82df841f6b40eeaeae9ee155224ab11d08cf35bc88ac7bf6d587a665d89672d9c6e593240202000f43daefde8e87b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5367b0aacd796c44e0f691a1523ccf4bc
SHA1306b8f303457777956d7ed9eb9a9c5b305aaa8c3
SHA25652433b264cd200f0e4a022a1004b4bc3a0c4fef9f4f0a2312be328b978b29639
SHA512b08eb0b5211cc05aa47ec824cc6af7bed0e8996cb5a7119bddfeb9192a162a431ee71831c2dac7a0c61565f857793a78e678ddbfee94842e84ac5683b693b6aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6e65ba94239e908c5081f04a5930af1
SHA18538368f5c8d242dbbbdf0bc60d5905a374715ae
SHA256fbe0f5881f45018ed900e554d7342458ed14e67cb15d18dd2e01645bb9f3f88e
SHA512ff9b0a009032d95f922f0dd037179bf6ab5bdfd7e9c1ef6014937e421afc4cfb8dac1b30c16434ef6a17ab5697cd7c2160fb73d82b25f84c64f68e6b47596077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aef450a0cda5b741ccb911142f5ccd7e
SHA123bab9b30d80c575e5a1477eee06b67b43e9287c
SHA256bd9cc1942fc441ffda115e2fd41d8096c646c83154ae5acef52651e8a759cc97
SHA51217098187a4a611adb0a06056ef1ed0f25ee08bf01a13d67d476190e19d892e02b7af119561f1335b3bcf14155402ca173368a0e5210a50c27d610a8a54cb4bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1d1bd1af5d7da95967daba4f80bbb77
SHA1941360b92a46be32d651ed3ccf4e55f14d46437c
SHA256140bb8c0a822b6f131a8dea6914c19f3520158b2b093b3581489a5d0db6a68de
SHA512016e82098c16d880b7430bfd99aa48d05f655d89ebe9b162608dc4e71c1d192e5493d23912f139eea079f8a81f27fcd8e4ee8c30a05691bef83a7f8f491b6bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573f30691322741ed2293df08c1920284
SHA195504946586893ac393d52ab932c745d97add8b0
SHA256b89d24abe0340ea0aca437409d3995df9eb27f459dfbe280313b202c4f6c79c7
SHA5126f6994f6ff1aa6f1ef0aae163702e5a985f9d27452291c9846d8738858bcc5cfa349e1312a0f206b8ce3d2d3de800731143bf2230fd406c917924fcf62c6c3d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0e2c821e0dcf84b900a310f60e18d16
SHA1c3f86cf3f988756a092ab51153d27b6e1b7e1624
SHA2568e934c542cdac6c68b03450e688907b054a96527e09a81fe19fb65424b2986bb
SHA5120545b8a727be86dca421c0dd931a923abbc5fb2bb0418ef46a971f58d90c7e7f0b4e7f7df14185896b239455c80f836ebbbcee93138630ba7be0bbfdd0dfe454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5772f4064ec27eecc628f77c459b8ad30
SHA10f25877ccdccfe1da2a17b61c43a45f381133377
SHA256a45dfb9b3ac2405ec4ea6d337b8b7cdd4e329bc04787643de3901b1bcf21ca4b
SHA512ae3ef00c1e9124ac6b3148851cbad5f8b6b67ad84b9a04031479964e80bf4db14b5e4f4a211722530e925c3b13edc1ecbb15576c7708a087b3fb2b90e5361da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec0a6c3cf39e1e6660ddcb974215a6af
SHA11266162efe80f9d383ca38537228d550ab01ba28
SHA2565e30986837a21fd71a617d968835b1dfd4cef0381c4df7fe414ca87d7655b586
SHA5125c30aff140eba0b652fedbaec28103f561b5456c4304143ea34b52e771440afa4450a918c2c4beea4a398470c235c6350b1eb965d502993dce8c31cf6dea896d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c48f953bb7cbafaedc889fff362955a
SHA1cace03c213ca1db2df9302a6aace6a42c873e8d3
SHA2561d5eab7723890713d786f79e58e36b96c745bc10b75998c3ff77677934c58eee
SHA512f8fb915c9b091a4238a85c6b90c7c551d4bb92dfe33c031ca26bc44df75d2f20ef14e086befd8557d806413139f27c6eeca5d311477cf057bef1b64ac783d09c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb386fc991985727afd43579ce69b3e4
SHA195dd3832c5073c650d27e7d40e622bb920c13a7a
SHA2565a808b1208b9486c5ef509aeeff651dbe891e15e2b57aa27a902d0d2272b52de
SHA512ebb1f1c57a9732b8b0aafec971fea1faa2bf3a03335cc191c7374b1ad2e0262720feb858096bfb8a52a6ef4fd46cacbf1761e82ce1b1aaf65daec999acd458f3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b