Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
a65602304a99f9a0f434b7c5b231fef1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a65602304a99f9a0f434b7c5b231fef1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a65602304a99f9a0f434b7c5b231fef1_JaffaCakes118.html
-
Size
213KB
-
MD5
a65602304a99f9a0f434b7c5b231fef1
-
SHA1
89d9849936e8418a874162982ec2af1175486a02
-
SHA256
c168b40d4bd19388344c3157aa049c1a84a2bd72868c452f7fae81edacacbb48
-
SHA512
aa925a0d339719355fc68d09956fe4ad605f309a80150975521b56a74fdeb3090e7981596732c5ccf370bd388b1b3bbd445fe9d543c19cc3703dda90858e565a
-
SSDEEP
3072:S0V6ja1Wi7lyfkMY+BES09JXAnyrZalI+YQ:S0VdQsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33D838A1-299C-11EF-9267-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424455501" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2940 iexplore.exe 2940 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2336 2940 iexplore.exe 28 PID 2940 wrote to memory of 2336 2940 iexplore.exe 28 PID 2940 wrote to memory of 2336 2940 iexplore.exe 28 PID 2940 wrote to memory of 2336 2940 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a65602304a99f9a0f434b7c5b231fef1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b95a214372d2b85f785bc39ba18f945
SHA120ed49f28f5f7a8c07dfba3a918dfcd7e81c8af8
SHA256df99e4a3c6fdfda7b599d8805918400ac19a017cdb49f297e0212058d37d9aae
SHA5128da2fd32e3662baf381d4ec1d62bfb37f0a6b301a915c856233c3eb03825d60d72b302998b27712903099f493f00ab023a189087a359868ba172461b2d8bb2d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ac014ce2cde57ce046301dafb98a494
SHA18306b6fb8c4410a395af0a69c436ed3bb3d342c4
SHA256f6475d671a7da2fa9003d6ebccf56a8ed44150b221e0bf0f60af718a2ec2b561
SHA51283b6d49540dfb37de899a0d1dd1714d9a8cfe6f6bc3ffef9224ae493ad258d14520af02289493ab8ee95fc68039fdc2e6266c8c93bcebff7c84fa974d67ad472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55eba2b00b9517ed8074d48543011aab3
SHA129f97de19866cddb8b73753ad5840420ffd96f26
SHA2562e72cf076831cf5006fe9221052ea631890d4b65497ee5dc98d38aa1bcf5680d
SHA512bf9b1e3f5ade3781d163344baf5093bb10878cf90d4b16a8931d92d775f426a9f060e69f670c02ab8be16e8748fca7fcfbd32190896efadfd9536f3e8d82f342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541d72c72c0303c32aecf183de1265713
SHA1650832d3a9ff6d88a89c4256dd8c4b701c2b9705
SHA256ea8c80912ffa8aef3cc11817832ba009a590bc8e5b49fc2d01edd3bd698dbb80
SHA512a73bf49ad05020453076b469ae36afa2481daf00a562c7565c586f1f28f1113279dd942afd1b24f38e41bc4c201e5d651050b5d239951c6073995ac6de4479b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa832b97140dafbb0b28fa78fcc50511
SHA1520b2105dc96ceb1a6b195998ef9112bff6d374e
SHA256a4adecc26c4b3839466a364107552c1a2616f5f2b514da3c4930c153f45a2a38
SHA5129ec4cf4d8f56700b8653bee66d48746d747d4435e6ea7197258463deea21391976c673359ba9144a64b29d43d25c25ac102ffaae16bca5086d5c032a292668a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ce7b01620dc66d68be81551414bb68a
SHA1148f4a0671830169270cd938d5efaaa3a2b4c66f
SHA256710278594c414ca69df947f7ff2e87cb3e1106e39184f1e1572715cfbf747b28
SHA512df7304bfa9d3e49d324f49e1d61188f29ed1f13e981b89e2f2eaac07666f233f3ccc999eacec29764aa307ef32f64c1a530db190b73279dc43ae1bc02da2c858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9fb94c22658706d9055691f5d24f299
SHA1857ba7a4873c9d6c22565493e9d33330b6905234
SHA256596033c885b2d7185d4e01e56a948acbb066b68aea8661d079dbc2f409eb653d
SHA512bca7575c1a76bbddc327b7fe383763d33473391be23fb6821d3a27d885027f93eb260b268c7b70fd5059502e515430f5cce7ce5e70cf3932a5e5cc8db04afc3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7d6dec2672f441843275abb781c7a4e
SHA1a33e7048b3439342c7d58a03fe09082778bcf090
SHA2560c77f943f66364bb538dbb35e17e3fca1f606d4a208eb69145941936494f902f
SHA51252672ca521c9d884620f08b6d9891cc25acaf3a77ca30b7219c4dcf0094496ddf396aec031118738b3b76484c42a7991d45c71973c1174c3d21c88315f155bf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50027e454513200578a8debfe5046b4e8
SHA1e1a7626ad6fc37faa324a5c4011d1a54026fbc20
SHA256158956e922570ec6f73dd0800f956492a35f8860a7ebe7b87254a81eec263cf5
SHA512abe21bdcc4815b08524e9cc55eeba6e35abe5831d8a18405f58cbdfed786c976a3bd9b9d5d7f1cd80efddc76164d553e442fb58e48b24513698a4e922f06a9ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6ed18d1d613526199e1e6d5ca5bb7cb
SHA1091f390ca38f70715b22eb208e1f33dc6cc92dec
SHA256047cc6e7089b56915f4ea2495ce6d6dd9ec7327e56017e8d9e40839eb1219b75
SHA512cfe771cbf1858103afe092ed4774cba69e958fa6bd545e245acb7fee7b548063a1cd825688c3296f566d5f0342c9f70f951dc6b9995786eeaa45df194659ae41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6601bd4cce40874d4dfd653c5ec81a9
SHA17b2b1a3c391a6dc70323c83438130de00cb10aeb
SHA2566a7b79aad5fd03faf7cb90d409437a04b7cdeb35d379646d6bdf92d965ce0c87
SHA512fec595c9b016632a62f5d3c38ef5f5c5925b027136cf49df8cc81ecbd8a0bc5ca4d58380a3d34b560e5547dc1fb1bf084b306521096df3ba8287afff2fb5c8fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aacb33a420cc52b5c8a3174a9cec01fe
SHA1093d351e188a94939f7b3bb4c4c643830c31f572
SHA256f9ef7005955017b2ef0abb2ba00fa00c006d8b446228e036fb357cd93de0a398
SHA512876c0bec6027ddd1568bcef4c82c787d7d0ec41a3b9b08a908c19615cc616b3d9a17251b75e35a193c7e73d50b96cbb9944372ac57cca9547357f33f99de010e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535192b3e9d12afc50837948dc354d7b5
SHA15876884df1833ecd48436e75e6f2bbe81b8434a4
SHA2564686c7b40d63a9e3ffd5046aa35c7ae43695415bd072f7c79700779d176ccd48
SHA5120e58f9edc45905ed92d1d71ac1c459fa892a5441db17b70fde8b874a4d9aa3c151af748258a255858b1c33ebd2ca5133ae2998158939c340e8243b7a8505547b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e363cb1f577c1533b17788878ccefced
SHA1e1c6d1f48fbad114205aa799cc05b76c24659742
SHA256dc72a893b271e0b85cb0f41289e3c1c0e716274adedab09463a8e5e23c454969
SHA5120c2b079dc6f13d472e219007af306f3cedc7498558190f9f762813b6486c2243f4047137a8e49a3076c05cea09c95a6d9300bb17c34faf44b302d940caa8a5c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5660dc84707ae8c66eaff05c2b074fb92
SHA18b4a7377cee7989c44db13fe5ecfb15c7934aa48
SHA256ba416f0570ca4e1676779d51828e299162383675e4eeb983eaf84d81cc8697fa
SHA51233cfb12226c29d8dbe67821e476aeff77d0f21a509025a07ed900d6c7ed7ab7c5b55fa3d2e042b62e5a9a9fe218f8b1dc64ce22ba77a626b129bcf860372a87b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17ab5feb86597b6216a60fa75a8dbcd
SHA1f4c4e59ac7362fcefba75d07ad63f56083433cb7
SHA256df81761fa64e661a89d4fd32ec7f0a04f8cf4a8fc9c531f3db339445be4114e6
SHA5127b0ab4eeacf518977bd650c04dac2e6724e9d6d38abe259307db5fe2813cf6ce672d74f2271a56b69cdc4904d467676734b59120060f9944863eae620a823be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5190187d4dad52c8b3b5c6af517ee3d35
SHA137ec2d5dbed0b624f08bb07cbb4289d9dd2b26b7
SHA2560711168037c3262888f2252f9735fd7b8c38df2c9052414d8532c93f65898846
SHA51259761c5de25c5b5314e2bf94c37b33085e84f5437fc17af013b74fc92daefb2321f3fc4c1e40969f2b5449af89aec651c4e18f00e58e2f06f062ce6abdcc253a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55963ab015b9be8d2d011a9f939faddae
SHA177d029ee51d78644d3e5dacf5c1517f8d6e11f2f
SHA256377d486a30d86bf6a2dbc4b50287f8630c4e331e9a9db64accc5ca88c72e8dd2
SHA512ba8c050e3c818f9bd8eade1c41bb1fae2717ce9ed2df115e00fbd477a5405da78baa53cb17ca171fda18830f40361ae113e835c15881ae427274d3612a51c21e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b55e47440accdd1ce4517f16b78ba139
SHA1497c6a375c2db78a53a88efa4a35b2b574e2b4c8
SHA256ee9b3ed92e8cbb6261e1085cc8ae5a7b46532dcbfc130520b38c6791c1bc95f3
SHA5124fc2a3e37eb58a4187638aabf74ccc0dd648234f6aadaabb63baec78ab858527a5a98f2c9fc1980cbbf578da93c91f6cc918b1c812530d53c3523416757574bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ea14f37372a86e8fc232469b93aec86
SHA1d13f985c63cc74f4559393b930e1935f5c69c002
SHA256881298b0b11e2bb8d4e74eb990fab598b66c82bf83fb712bdbf363c4623ed3f9
SHA512944b726b40d021268b0f84642b8d6068d788f7f35789094dff022c44c7a2b9080db7aa511b64d744576d7e6c2c589ba5a1730b24868b9b7e48dea1a39c6f8860
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b