Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 03:57
Static task
static1
Behavioral task
behavioral1
Sample
a3c116c5687bdba9d8c2f4c838a35f4e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3c116c5687bdba9d8c2f4c838a35f4e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a3c116c5687bdba9d8c2f4c838a35f4e_JaffaCakes118.html
-
Size
139KB
-
MD5
a3c116c5687bdba9d8c2f4c838a35f4e
-
SHA1
dc96f70300de6d5e4a9b7572c6b6b84b9651c359
-
SHA256
7bf33be33e4a9f3a432ea19eb33d64632e2394ed779b19746739ef2c7622f710
-
SHA512
510074094751d0c1abffdf60965e841c456502867538f955646946835ffb70ee01b5149aaa639397798e99328680c7c873e8b96304b391f022cd245d49b7b17c
-
SSDEEP
1536:SeNgnu5sle7QEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:Se7R/yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000a7a14c834624840b3b24606f834b2e000000000020000000000106600000001000020000000b2c5949f64bde3a2514c80a04b0871dd17b998ad7db0e08baa9ef89b594aa4bb000000000e8000000002000020000000a87359033ff4e86f2f1199012c3fd244b642a9d1439b3bd6e1754c2501ae884320000000f1d1d9c36b7ae71db540d09fcc8b376112f39961522d113666a11c5f587552b3400000004cabc22cebcf128bb3f2a17764c409f8f4c0c3a9b32163fc0321a80ad1237d37e91ef10da2f312ebe12cf9f7382d1a369a33bd32e141d9b0ac085c1cad7df6e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424412907" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06c3f1c46bdda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06145831-2939-11EF-A564-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000a7a14c834624840b3b24606f834b2e00000000002000000000010660000000100002000000093756008919aff22df924ed8120fe23cb1ace709ac4279c491279d193e1367c7000000000e80000000020000200000000529be47644de545f227af32ef4b5afc49f76b92908cf0d8ab7c911b3ea2d3d690000000ac3b08500f0a7a11bf7c77437d1e03af2d371182f6eac127cd297e934251cbf85fb8205f4440231544046c191bbfeeb495f8787c54871e31836f1934246fe71c058bc258d1c494034346f78bfd33dcb1164f7b629d3818f79d8e810812e19af6bfe5709162493d98fec5f0092d8ca0f704ddfdcaf0b0da8fe39c843082dc02e31326219ad5040ceaf2c7d131b2a10440400000001b886eaa506ebdcce154592ca5e47dc8c83bd1cf58b063e22cbf3d7451c34dbe43a58b8f4ea5e388e17fc54452e28d66b35594080d171a409f9816c03c16804d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2000 iexplore.exe 2000 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2520 2000 iexplore.exe 28 PID 2000 wrote to memory of 2520 2000 iexplore.exe 28 PID 2000 wrote to memory of 2520 2000 iexplore.exe 28 PID 2000 wrote to memory of 2520 2000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3c116c5687bdba9d8c2f4c838a35f4e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7efd809c57c49a89e3a092ab3ad684d
SHA10dc14750a1c3343b08527a064d67de51d5a5c25c
SHA25620db3581e77621aaefdfc6c676ff5d973feeff39ce96a2886c00bbdd306ec88a
SHA5127cf871a02f4e3a97e0684e522ab7313fd15667525c68a5499761bf145c1065dc4b14c5ad1ab8eb1df7147927ef7fda4535d0d10afdebffed3ce5a2035b2d8e0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579646bbe995724d98f595e74ff0c2212
SHA17d179e736efc2edf97c7274f7fa48a24565209c0
SHA256fe357984ce302d7ab78fa5873d8a79af9928f884eed63fd422addebdf5d3f71b
SHA512e75ba609c52673faafb70bafa0d55ed4dbc4c19bd51ef9d2023765d727a901c5710e4cc6b053562ca237d3a2a9c001cd39643699ece25decb6beafb28557524c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51434d7a368abc4ad4d2f4bf16ff405f1
SHA17cdbae5a5a1e53b450b0112da9046a5505dc8c4b
SHA256d4d2e95cf26848675d95b4a6d4ca4519cd1c16ff377c3a28a326896f570719ce
SHA51253450f6aa5e3d714b2d863defe50ad2ab91a1ca27e2ede43a3358858e9f2aa6ab261bb40719bf4fea62898b4922607c3ef78d480a70d6aa4f6bc3558723def5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d3d134b1bd201f0da3b02b0dd4bbff
SHA14f506432fa3df5e18dafd54af94a515989a64b27
SHA2562574f8abfe1079036898cbd6d0333ee6c62a486cd05ee1b84100273b61150149
SHA512b5a84317225b624646d6db2755604bff044acbbf9ffbb1ee089fd992c47e2c4905f2b414fe389e43c107fb846a0227429b89a134d08b0c37689cddf98c74ac91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cd0ea4f1389eb9bc5da6acd7d72d0fd
SHA1830a01019614268aae1065552fd44ff6b7ecfe13
SHA2564568dc651073cb6b2ec3f8ee99ebc072d05759faad7ebbf1dc788aad0e0a8629
SHA5126c27efcea0e98089a17a179d63e690aa9bfa32c8fbd0e45d36f98c469251e77bd000cba0068ea81c2d0c8116e6334ddcd64a7c85878ea7ba9f45da402dacf915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8c79648f82eca8bca0794bf27848386
SHA1f9577d3fe58604b8f80b2c7fcc9fe2b2b12379fb
SHA256261aa366716a5eefb5dbea676d82e58db9b2f1bf5ca6d68d21cc17ba17be7b77
SHA51221c8d53fe598bdfa87c4ecb9691003be76de5a3897953cc6db936a6fcf62d38d9ac2ea404ab6f0106fa9b9f07fb6ae8afbeae9ca65b7629a23427afedb0cbbfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5014182fe729d06a3307fd05caa38825a
SHA15eb39654e5f6b4a7e5c0e523d7c0e72e60f8e33d
SHA256855b38dd21d8029a14dbe357f1479af4e8c0bc5834e23a1911799d5d58b96d36
SHA51289ea584b50c84bfadb8eb9c143353c790a7ac2430d8e158357b0e24ed6ec16329ec71b06626bd7f101cb97695d1ebc3e08bb2c792dda9804bbf602e4d67a3674
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d2ec1d6ae7758f35508b4ea98089882
SHA14364aafe744d955171a57fd971807138337acfba
SHA25616d5f86b7298b918023ccfd04c5294e7c559af66ea78df135c6b3c38fe0eefc5
SHA5122a28dd4b94817eb21df30d7589f1e4ed44a02b26d43dadabbfb08d0de1bb4a3543636cea266b3fa3968daddf8ea662de133275d8025344db2d50c07bb66ad349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2f4ca57dcdf7ec67d3e731a22f6ccfd
SHA17d3d5cb521ef1bfc875a49b41af951205585ac4b
SHA25651e22c490b2e2e9cbffe407ef167b45816e4334ba3742f8aea229d6c7154fc7b
SHA512afc6335af13ce9212ac97ff667f3316e95d2894319e67f310fa449886972bfae0a5e8de0120704386a52aa1c8b8fc5378224f50b1b317b42422444043f7997bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e03a2679df258422427c0bedc107b43c
SHA14100495876062a6d9ee494d4f4a4b32dfc94104f
SHA2564c09c986364028eb4ac0b4b1bf00ac36a7f9a4c9cf4a5c8483d7cf640a07b167
SHA512772e98134feadd15f2376146f781ff66aaecacc01baebc976a9958e95358c563c87bcb0eb4ad5f7628f55a9e16fc4c2fd73eec56b22aa7aafa3f23ab78a31b28
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b