Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
abae6bae4148006825ce1388b99d9118_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
abae6bae4148006825ce1388b99d9118_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
abae6bae4148006825ce1388b99d9118_JaffaCakes118.html
-
Size
1.1MB
-
MD5
abae6bae4148006825ce1388b99d9118
-
SHA1
7ddda104d354884b87828bb356d8422e24d46e16
-
SHA256
4d76318bf56afe29da4e3a326298efe2b83d2499e934ba234bfaa55afdea0a5d
-
SHA512
25c7fbdfa0725303ba5de4495acb04bf659211cfef4efb42e6eaea7dea07a9baf21f0b4140ee277f19c255265adb07d7b170c187cf755eaacacd766edc4ff893
-
SSDEEP
12288:+5d+X3ZrscWy9dHZ5d+X3ZrscWy9dH95d+X3ZrscWy9dHt5d+X3ZrscWy9dHX:8+1jh+1jF+1j1+1jL
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000001197bf63cb9b7ed81bddbeb4f1c13d62e10e710eaf9c2574f416ee07b104223c000000000e800000000200002000000045016aaf2f8df59063c73d4d461d879ba59cdceb40c2b325b408eb743a09878d20000000b20b96f87ec0283be980d4c39183924d9615fe1b921d6d6cc0a0b26ae6836a1740000000751f753d2412be6cd31777c624ee23d1cd5fd6cf50e19494f2794b930d10d3974380c2836a7662ce1254ecf125d7ca3478f2c324223bf26d887a1608002b552a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c657a5a7beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{913718A1-2A9A-11EF-9E55-E6415F422194} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424564751" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000061f9184a93a509c792baccd0c706849dd57c23f6f51d0acc0289c87fe1e5645b000000000e800000000200002000000052a20bdd0b7e4f8755df9fc35e186ba4853c8ef8777813ba31d37fed0fad65a0900000001ab1007e66faa865b4b7c827b1fff25669c03425447fb70ac39d2dd2c03d4e7757cadcc8078192c449ab2ba9797aef301b61165a01830b82705aaf40d949ce305bfb68af2a4478ad09deae3b7b4b9ed320f216376edec0ccc7cd9d44f8065be1a77b061bfe322f0425b6b7580ae5bb6396e16d0fb9e50b894d14fa64fc482da0c8392264341f35a4a4aba7624aefa9af400000004e4b3bae51e9c3896f89bda732c4264b4dde3532e068ca54436a97dec10244bef774f9b796833bf4ad6364c4110ac007c6a295730c72c475ae66f226119d9e2a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2724 2176 iexplore.exe 28 PID 2176 wrote to memory of 2724 2176 iexplore.exe 28 PID 2176 wrote to memory of 2724 2176 iexplore.exe 28 PID 2176 wrote to memory of 2724 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abae6bae4148006825ce1388b99d9118_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fcf60db96332650c309c480bbb07f01
SHA171004b79664a57a9757a178f0dbab7b1bf8b2d8d
SHA2562c599dd1a704bd74f3ab99a0262aa1c763227097c9d6b54e8a6c5c955458f491
SHA5120b3d6f01227368606daaf9b10b4b13eb1a914eedd44e38f6afb723caa6fa19a1dd804f5daa80d14016be6092d85f7cb2b19e32ee7fb40782120bc08f78e5ed52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fc6a35bd3305b41d202a2bebe6034bf
SHA1bb36aa431436f07413249d97af63786b33218d89
SHA256a8a9644f519df34ef4b8449dda615ddb8830e318b02cdec956b6bd6c85168fee
SHA512195757d7966689cd9a48cc0ec3427b3b70fd57f821201c04da82cab4ce263e59fb50da8d119b24dca6e8c8e9f869bd4f6a2ac45eee99950310cf64f08f5f61f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c77cc03377d0a8f19270b1bf2f078d2a
SHA15b7566d2776601f2531cfb6fefb2909cf260208d
SHA2564f1f0092b4715ca767ebe6d63fdf80ee4d338efb94c2af3c67bf477255a7f79f
SHA5126fea7e5916457ee235b16529ac5741e7b65b3550ee8cbc0497c850528d2203e5ced314496eaa85e5d75e346abec2f3cabfaec0a5d42b3d0d2fca9afacfc958b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55459f0c6d64330c9ee7073ffb27977af
SHA1b4f46d560741470dd7c5edc0da8b97548819162c
SHA25610c4390ea10af1d9adb5f8a547ae49c08665266474e6700330c7a9a3ff6d8925
SHA5126fe0344279d43aa4861de94267713c8ddbe1e28513baf85dcaed68925eb14143960c5f79b17dd32ddd0019d2e0b5f23a201b2b8b38844b188c976ec245c77c5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52800d5843191b32354e77d42e59b232b
SHA161354fdd70189d57751fa8d4c545475579ffc0fa
SHA25653b72bd3dd85829412cc93098eef5ac3a2b4355513a8e9cdab6a1a705d59a387
SHA512fe98e9154b0cc1eedc5b232678aeb264e3cbe8702fbc67ef6059adaa8cb070c8012423a99da4ac335522f92a725d2719a4c1b3d3f1767642059c53888323dece
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a25c6e39ac329f44e5d38f6ba7dbaa22
SHA1d9892e5a024dba8df8a47da8c4aad9c91ecb9167
SHA2568a11e04700b5df529dbad60d772a70b94c047add55b4449ceace7fe35de8e9ed
SHA5128d183a58f06a68f389de132d507ec0a10c10d15f335f31e969a12a4af00c7e3b4a37ff6aca4831e41d95e985af7ee6a6a2daa99ce566a1d0d332fcd9523aed58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e3baffcc59eac344eb051950af4b0e3
SHA12083352ade15f01183662b501476f782afa4a978
SHA256f1d0ff27c599c531845de914e1514473a595d85efd7b99c10b58ae0e7064b21c
SHA512bf8aca7f32affc4df94df20c05933d07a67d33d23444d34f2b8aefcefa014551b3583fffd19e1bde9b5d06bf38abb56e8186014b7fde95c304f5bfd2543fac17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500594934bab2a92387c5390f15bcdfde
SHA164fca818aaf19f9dde538a6ed87a7eaedff4e81c
SHA256ee02ddce06f0dec84b8ee06914614ffd40b9c766c66f333da10a8295018332d7
SHA51280a082d3d1649340ac50cb09f8ee59efb13d140c9a2c4ad2646a4043661e678c62a934dc812c4bbc2d2e021c23d59467013f412a35470fd834d620f758babcc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5019e6a460d71059f09de865c7a8f5de7
SHA1101e232bd0357aa2a8837157b8e21ffab59a70ae
SHA256fb267304332ca751ac4fa65cfedb05f258c1ad271bc5e4b0881ea136cfb9b8b1
SHA512e2d07a50c8c96911a8066db18a39f38349990adb9137341bd879352a1c8c8e0934ba76b1a041140a31ffbf1ecb3f85cf270f00815a1b707009099d2fa32da977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540e0d7a58eee162414704ca9a93e6e48
SHA150a31729f840da2528423fb8c520b5b7dcafb7b0
SHA2567d10975a20c2d79cfdd838335ced7f3bdbd315a75e8c796517e0580daa11ac82
SHA5128e9dea6f78c1a3235135fda0fd89763af4626b894ee54da337f0fa059ad5d434cd6da4bb6362ac34dd48c16931c36034483374fc753b98bd6b05cae4185503a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56698c4d6d1cd33db3df04ce7727e6e31
SHA1628739161f9ebbcbff3c47c41222ddc32dd4a1e8
SHA256147b9ac70dfe97b30e42f65baf094a372a2703e9a3fb733846819bba63a0bc25
SHA51275306bacf8f4a961c17ab8696f8e3f353650a96bd89b14ae046688c6c693507c33db70d4b1e54eb9dab46c7f0467395d1189cc81a69cf076bc3e44d08abc47a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7ef763b742c986e354220ca77546590
SHA110bf27d77ee298c1b44c051fb6edba66cd135dca
SHA256c196ac5be884b2f9fc2aca2c506d45aea36797e9188d93c8ab13a35f77eb30f5
SHA512ef703efbf216db8922f5c4bfba7cc3cbc72975df2fd6b5982dd2872f0392b7e2d58f59688a7d56058d2996d7f90b535598c451fc77bd3410c1d2a683b03e8093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f96d40dd61b16d71ee8e2b31608b1e58
SHA188bafa97128fe19d5ef44b40782a20f253a4b94e
SHA2567c37f567a74c2ce2850a76d0c554f701dc6deec1273b9b5be5d5002bdafbf874
SHA5125c1eee9691cb8cc91e4df94d659797fb987df0095af3dee55cb14b8dd453440d5f91cbf03dca6e8550b16a6c43263252336edba7a60d611f8a9a2fd4ed007c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536d6c3ac069a35b78261cc57c8794dd8
SHA1f1390fcfde47d3ca2a82ef05b7570c3008c901b7
SHA25660277ba2a252f23719b0a6b0f1d36ba9429788da74dabc13ce29fb6a4726e017
SHA512982baa5f03b6e4cbed488d6dd2e3157c0dd402fc3dea3c39909bf422f282ff3b283591ecf8fe7fc6b63db0212c04b0d1300949344c6412d7b18c053fef448a7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bc142b9562f5f485eece9eb21b49b36
SHA1cf7f8f5099d6621d133592d56680e5bf198e50c9
SHA2567e3a0f8fbb114b04e5136a3dbb90bc3a789dd76bb059970a94da0a2f8ccd398e
SHA5121762581eb704c6a3e2c6e38ace72dc544d028cbba1d1f87b5401e1c9b729b5859e3e5610994bbecd0f7dae8c84ea84ad1424d804911291ebfc12e9545f91e8ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560ab03b8da2dc668ada2851b29d0c0a1
SHA19efcaff8f926452b4c2916243396d2f59b951504
SHA25675d60d0f5826a4aa4c7392eb57574b45bd3fad40c6bd3a165f221af09fdec069
SHA5122031e5781b21a634890663c7f0250f3df1c3c417ec0ceea36428d2fdac7e666960624d3c6a80d44a4753d2310d88c9fa1109bc52ca7f8dcf1a7a0c9370e61c69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c5bbc7d0ccf9da892a8a02cad832267
SHA19ff299f369e8e0754280351acd165b6a764c7ce8
SHA2565f683dd084ed243e4f141478a4c82ff1df7a8fe9ac6ed6cc001095b8d8530645
SHA512f7490ad5bc6d8afa9c73796300e029adec421f9a1c72682947c845f51f0f46093071834b8e103af3cef7a540004a79e638b9bc4bebf4d5a8a3cf2a8f650dd1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b77fe9c52ec1794ece051daf330d9eb
SHA1ed2ac4bb9fd0f1e3e14a4e4a6be6dfdbe755e598
SHA256f8288cf318ca2712f28a3e7c89e06fc61810a97c7dbb307e90d8c68e622eae32
SHA51224df67f95459796e3c8e06ad32c9cc07c4e3fab983dbdce1482703b9d5b5a22773cab7065cd6f6c79d80b4ac7e1aba0d46b5821e7b348668cdd3befaca2cc19c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b