Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
ac704c2949bb527a6bce8677aa75749b_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ac704c2949bb527a6bce8677aa75749b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ac704c2949bb527a6bce8677aa75749b_JaffaCakes118.html
-
Size
67KB
-
MD5
ac704c2949bb527a6bce8677aa75749b
-
SHA1
b23561defaea097cba8fdd4bb8099e76254141a3
-
SHA256
07b9a96c29d3175e16d75281192fd48769d2d966e9f83ff1d1f1f2091206637a
-
SHA512
c56e171063f8ab16c35a03c7882f6d730d012f74ce9cee192a66260993b525a3eb4e4bfd53dfdeb96d1b4c0444891f03ee0b4120d9704f950b70b385157cce38
-
SSDEEP
768:Jij1gcMiR3sI2PDDnX0g6wJVym5tDRoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JoOfomPDmTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b55b66022d7f29449402e2477c47d32500000000020000000000106600000001000020000000795be8729262ea50fa8c66d9eeab5ce311edcef622bfe623a01d473f9e47368e000000000e80000000020000200000002296313dbbdab19edbcc0db7e1ba7bc5d95c4ff1c09ee9e6e0db78f06d99e227900000005db2e05f734b781f337300362191814ea1c39fedbfc52ea1e9695a150e2b26f4f61e4a7b723bd046c44189860926f9d7725002020bd92b237e31854fa35060e60327e4c9ac7322c19e6ac1c737f395800ddf28032f02995228836083dec9cccab1e3ac67da8552cd9ff9ae3c919363a048b5dac768555996a8703bc3904d7e300d3a7973ae21f88f8d0a7cc8203fa05940000000c3f1f5a85913ce382128912377cd87a32946a9cfd37fff447706afe75c3f78203187885b8e18f44063d4ad8c33ecdb488a2f325961dbccf2e9dcd8dda49b6215 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01B4ADF1-2AB8-11EF-8547-E6D98B7EB028} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909279d6c4beda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424577394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b55b66022d7f29449402e2477c47d32500000000020000000000106600000001000020000000574340eec7c7f1e52ce90a019e8714409ae258f1a45873e2656218f226b207aa000000000e8000000002000020000000cc2e806174befb5158cec3af03fbd9effdd0a1db6223472e0a160b9e30933ab3200000007e786587f27b9b600545379fc25db56538d50e1d00fb49fa886e71978e90f900400000006d4a3e844465224953cf0262504bfdf894884a0a314cb467dca7ea8d42bbc5d2522d5152d2bbfa7a4834486d979317762992e079b59b25ea762920ab23c2931c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac704c2949bb527a6bce8677aa75749b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e6c528095c89844d5a40d377be9d604
SHA1a1347206af85d3ded6b8c4771565bbbb1d418f23
SHA25684ed083b31040bfb47f828d9699adcc52bec748cc8fc8d75821da33a5da94be9
SHA5120e20f3e8d86c85752e565dd13c5595dce5ddfeb908be6f5bee48d62796f8576c472b723bf59465702e4d60a2dabf0889cd0e8b3ab485f61b0171bd2f9c14aab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c33e30bd481176933fcc53d1d209dcc
SHA1f7814a701498c6426d6a036eb5a9d65f79944409
SHA256746d05699b1c1e19544933ed0eb124a325489306a715cc9a09e21b6c7b298f54
SHA512a489c7f4fd5c5910530ac0c0a779a16236445f79b518eea45e8864f572ac8ca53f551b0caf950544c09486d23674fddeb7df1a563d80728feb0144b4be7af378
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9f9aef9aa2c2fc620ba31140ef3a890
SHA17f550b5d49c023fb8d01108e2f8378205103e6e1
SHA256739e6939c273f7fa160d8553d6dca5d0cb6f3f31dd5060addf7fa74a9185ca58
SHA512e7f78375cc30f750a56f495cd14cb43415abf292b4ca3d5e97ac120d6927d74e793ddb9db65b34b2bd6e4baab5a44941730d3eed6876e7a9eb8cf9a30aa72b3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56df5e4173a44f8de7dda66c4d5d17346
SHA1f490acce97c81390570154fbeb772fbd3e9a6752
SHA25666637bc8c7dde5017032234ba038a4ca481645181936141d9f66b7f9fa46ec9d
SHA51236540e3b99d3a1bc294807ef34444f220ee4820f703411742b67a8632c47466d50c6bb54494f59db77134b40cd1bb8aba5df0ebd7363cd636b6786fc5d58492f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542cb083a58d88956c108451f4d1277c0
SHA1f72f058e8ab6f288d6b1104146203d7ca4407bf5
SHA2560c8f6efa5624a05a608e4d55083e8166081fe4e630c9f3e15afbd6059a4cd3ac
SHA51214c9befbbd0b5929e10dce34458ae97fee129bed1c001df0ad10d668eaeff4aafa3922edd4ff45f77b2fc76ee553db3a92e1be7344f89fc57793dc42d70a97e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566682215022b8f2f42fedc3f888b77af
SHA1afc2196e699f5d62ab9467e07a300529e84658db
SHA2565039d27841797c854cc1e41c2eb0b74d80298a681db40d7ba984426d005a95ea
SHA512bbaddeb0d14efdc52cbcb2014092a08b4d7bbd5229332bbd5da67ec2a83bed99362fb96fb6349aee16ea38f547822026d4388c162ac9478bdae470d048ec525b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a9513266ee48feedb1ed4cc6061ed7
SHA1c2740b571aa28f605c1c0af241b820433b551021
SHA2562a589651aa1b256b36600a3155c5a788c2217943cc5b7df864709e423d8c528a
SHA5120e241c1594614e026802bd84e6fb77cdff5d75755824021a49553e67375c6cf64a53faea599c1cde8c68529fdfb3807e1b3392b7d7657b9b9cade391313a33ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eb0332c202eb289d0615a1688a932f0
SHA11fda21f78d4a1bd52817f6f60c408dc11deba169
SHA2561866ff1961a8de3afa6db52496bac0fd0a26065d4e10871d6e3e455c16cff7a3
SHA512a5b934fbfb4e84305b15edfc5024f4f95466037585ff9f8ec1474c91db0e5bd8d938836ab2160358174b27dd75d71d46df8637e3df409acdfccd3959779a7c4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5950ab1b0fbf949adc657b2aa4e50e91f
SHA1678a1b2074d17982d8e7ede1f41b4b2bf9f28eaa
SHA256c2fdf40a0d559cd507366c9ff50d230dbd9ebbe3fe8b925993b176da9aa38a0e
SHA5123614f80bf2ce821265d43c86c469965e1ded0e21e16dff001aa6329e9c1cf94962904a386a318538e7d59501c97da5f112aa87fc720b2cda4d09c16b310cc1c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d9490e5b1b7c8ad33d18410746e85b7
SHA19dea887f5dc1d12a4569f8f94f6bf9bc322b897a
SHA25638253cb16fd5dc7398bf9aa9a311a6f71de5e9827c67382d7c32443ce65ab111
SHA512cc1fd4128302a0f5f81b73f676fae64579f1f7ab8a8f9bfe43e7bab1e15ea9c8eebd617bf200dbc4a056266a4ae5c4ee074d5a3742c06b90fd087d9845cf2176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6f29fed8e4f37b5cdced5b13fdbbf48
SHA155635411ece01476d080d6959a6b04015cf38209
SHA2564bf6fc7cb1a3ab8efda7712a82f25b900c52824f6eb3380c36fa9150a7fda8b6
SHA51217ca819c9a62a48e794eadb4635eec4add61218466e135c703cbc79fae62a987c0dd0acd4c9cfa1f19db992839a4aa15dcbca40b19397083aba326d8ce0500d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506301fe6f715970864af600a5283af0d
SHA1635e51f80387df30a6d2f6bff517444d45a5ec5b
SHA2561f4e6e059ec14ce569847a1d83045c6773b509f9fcd2c809fdd082e9650e9aa1
SHA512bf3eef7bd8380cd3f623657db98aff08d7c3ed54cfd9951fe70161f5304f904f9c81d05b000ae42eb25dc9874881ef5161fe06042a61e04f610757a1f1434a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ce99aac3a5cc44d16c0b143b5f7bd76
SHA1d08eb0198c7227f28a0b22d816b8cd580a6a3ed6
SHA256c40a7c2d3d5bf3b15ac49c7e44f491a8c0b37e64aee7b1958b666ca8ce1e3d6b
SHA512e67b3a3e50169b08b13b27e19d9a14a939600fe209af971ed3c493da79af0a60dee7ae974a04ae10f297349108de161b4b59f444d8ee88134b454adf28781018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcb65d14176d25c4deba6d830809e268
SHA1ec505ebf3e558a2b15b6a2f4b60ba201a4e74267
SHA2560527e8dbebed0c28655c942a5e6a4490f7ff1dfe8021f5fd148f047d1f765970
SHA51211129dc255eb166c71ea652ddb6af6a15b3b6f3f5eda95c65e0fcd34ca7457d5e221d1260fad9b09d17f3bd6bfba0051dbbc05408057bb213403adf9906c1665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51565c06d0e1a55b8b05cab972d259948
SHA1e53fb7823b17179c345d159338648b59d1eb53d3
SHA25659bc6a3badfabf16070c649e94a880ad8563227d2afd47d5a3a9bcb8092da9c9
SHA512e7dd170ca7072bd3475b0aa5575dfd182998a716eedfea721a384b31712fff4b6d881dc0455bde51ccc57848519b1227dfea040d6e4cf7eb5652a8c9aae4d820
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536a50b057dd0a03223b6ff071db103d3
SHA1e51bf4dcb9c6589e023b9465135ceee481e855e9
SHA256407794596d45d7894e95a8b8cd76b6b446c586d1b7d32e8e1a727aef3f848107
SHA5125900091c532794f9227a23296a1a8d8c79c63b085c1325133e72785ae58a868723813966a74c3f94e8d121f64f6f20f42bb74e88b768b5ac9ce8c57671c4b8c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5251ce0bf2b0163ceafa17439f1ff2275
SHA1759e642a54514f8c7451eb1ea8310a073526da2c
SHA2566ebd3b55d19f9298ed38f76073958d38b41e79467a6328c0f184fbae93fc6a1e
SHA51234d7b6e01dbcf6dbe3fe8a7a89eff661ddf7f8e6c39455ad2c383583d9491628f2853faf675f77d91c3be8353d403c91cb00f3d4e9d9c1049b601cd9554f1d71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c045bf0832bedc566401f101dffbb8d
SHA1c58ce811838cd91f2aa44cae80efa81c9870972c
SHA256357d8073868fba2e8f876c5e675e07c7512936ec02fd03e4d0e0ba307ad5cdb1
SHA5129f3d2778c0e349009386b8e090d026ab8d34c612adc117be378f81e5922f6cf3ade759183b245265f7ca933b3cbef227221fb02f034d3d641c5f813cf38be775
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b