Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
aca22e3570f0836dbc06ff970e9774d4_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aca22e3570f0836dbc06ff970e9774d4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
aca22e3570f0836dbc06ff970e9774d4_JaffaCakes118.html
-
Size
94KB
-
MD5
aca22e3570f0836dbc06ff970e9774d4
-
SHA1
a9e99655174dee75b54c11932e2820134aab2f4d
-
SHA256
616a49b3e42c3f5c0f397d8d17acad44e2d13697e2e8e2526c25e45a017026a4
-
SHA512
762dba73bf3c3ca1d1fbf08df5908ab133df54f137793c4c1df2a5d7197a4c7e217732b4e1a9a417edd0ddf7ff129e2b27b0d979a6220b2037c5373506e4b039
-
SSDEEP
1536:WMLiNiUuYL8B0Sin4fFN0/DFLEzp7LtC61byXZ0BdkrY8mgHC+qpEyW:WAiedBBdkrY8mgHC+qpEyW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000006c131d79a55266311dee32e87bc616b8b1cb73d036215e456a2fc583a760b109000000000e8000000002000020000000c2f7c4058ee65160e05e612c9b8ab73b80615c9776d2fdeb44b6c1a7ae1df2f82000000002f9759793c8e013799f648c8618d03782eb711ba743cf5bb7f8077f856a140a40000000e9538dbc572ca6057a819075a6c8d1bfb84bdae3c30701c26fe77e80a4ec6eee52f421acbe4028c4486e91716d84d533ada52a5a16f40e286cf72ba1d8f4212a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424581285" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000005f9018e5bab695860c15dcfe721e54d28882f30c78c326a34be03a404f401ca000000000e80000000020000200000006587060db0fe9d0faa38d105eebe9fe039b7a8994a3b6b67aa989ba82be1851790000000b588cdc478a8b70a16b99263a6f16d44d2da0c9d422503ccf4b9715609e3ec0d6e069412e3c0a26b94e980803304d3ad680468b5e80ec61fa540640bb128c4a273d14cc83b8d0538286b13764e3ef031e03488a055375d2a73362c00398d4343f9eb6fd4b7a2949faf559e342f3cf9ce77be0a77db9484802b00e54e284a269f427af5236fab90b973645cf50ab9bc9f400000008675036f722d153157f7b5683de62d619b419913a469a161ae4163388982c2a7975f0600dbf75c590da826b44a055a5b7f7a530ac067a65bacdf77f8106ea876 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{105705C1-2AC1-11EF-B267-DE271FC37611} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01c51edcdbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2160 iexplore.exe 2160 iexplore.exe 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2164 2160 iexplore.exe 28 PID 2160 wrote to memory of 2164 2160 iexplore.exe 28 PID 2160 wrote to memory of 2164 2160 iexplore.exe 28 PID 2160 wrote to memory of 2164 2160 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aca22e3570f0836dbc06ff970e9774d4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57414daa84ec8d6a2568d3d89fd0d8ac1
SHA160c4122dcd39ecb1d693be3b7238e9d62302b830
SHA25669e043aa26bb102ebd0c4b62558e20dfb059a099ef355b41edef859fb735b5ef
SHA512d503a1b6519385911b5f4687f2991976c81b57d70d8baa74dfb1229aa1462f47d1411494024fd9cadf74a721ced8f2e696023b312ef6f46b8868d8aa9d30102c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ce1969284aa9f9f18444d0e5a8bfd01
SHA18794531b689f7e4b1e6a4dc84514a8e60c506a0c
SHA25628f753e2e9b0b269d6f5343292ace88ed41db5ca3a87356c2faa5203316a67a6
SHA51285c4855555a445b1db101d8bbbf4b4da8f308995d4025d67ef43935e6c219e3a7e9ebc155aec5faf3c83439c5db62289d40cb6bed9857a3ce7773c718f627cbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a3a720823a9877150bd9a96e2844230
SHA1ba4f6e8704faabb127d1c6522c0419c6a5fdd904
SHA256c6873c40d1e69a1aa72101a236a09c310e465e020b66592ccd4e36d5ef0cf595
SHA512788cfb90387ec474d5d59cd33140e1db9dcaeab27ed2b68b3b2510b97a03f4907f396bb3ec84e941be993afe6ba47bdeda63d28f4b8e6d5342720e1393eacb8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fe35fe3dfd17421a369a3c862d11185
SHA1d4e9ab5c0311cb3161bd35aa67a0ecd7801329aa
SHA25688965a6e972136a46f4e3678cb8ebafcd67dd0ebafa7b1bb9d74db00e873bf59
SHA5126e30a2ddf97afe1435d5132c03155e589bbe2aec890ead50eb2b3ddb95979e4b9fccf8c4ea5d4e2f1fa97188c357a5237108b18504bbb7244fcdd73209e3554b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dea2422fbf6e8cb61fae667edee568a
SHA18537798103ea68ff410155bebc8a27f35e877f1b
SHA256eee87438c1bcb948ac8cd6c7a8acec9fcebc28d6df59905fa253f00155c33bd3
SHA512cf4ddf5156ec9152e6fd3512d3f1697e27f395f665f0c7d999f9767ca2ddab5dd206859f14d5ada2573e3274df303ef02a06e8cfb5eef7c74868611bf1811ed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545b3d0809299540a86168f61bc82860b
SHA120080a856a882f5f1c3afb120cbc7bdeb5cb57f5
SHA2566439eb1abba06c13418d341140aa78e2ae6a413abb5e469eb141d0b2d5675d95
SHA5128a1a17a629e6cec52ec1fa578ea879e857e3440503a0bcd2f040bd1031454e4e01a587c431b5c0ff00e79c76fe56dee5811f48305e5646253e0c9f8fffa373a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be4ba64019008fdceb1e06c72bdc67c1
SHA1c9ef902c3bbed7189329d87cfd172e8d53dfc237
SHA2560d0b40999ec9ff1efb8fc1cb26f2154989ef74d87ff024520565d9d8ca6149c5
SHA512782552ed4388d1b83b01a38337763265fdf91a9e1ad5fde5a80df72580ff8592127eca54c847622a70d6f33954e5af29f2525dc21ddbd0fc3cb6d48c4a6865e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5982a94d58972e4547ad1070748a6e5db
SHA15f5912d52b4b2a50a9070727486a9df352e7ceef
SHA25687afbdeb7535872521c861d05bb5ee23bc0d04f009db1c601847e4db703fa887
SHA512e290642ec53482b0a237ce93cb7245859830ca57971d8bce00eaa423de7c3a23e924acd042385ce717c21dff251d3a64c44ee3604ef805130c76ba1fa613980b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591f60a8c2681e9d27741783ab12b86ba
SHA173e090868524c5a1c53fcc0f435038cbe58a5a98
SHA256c87cb44a5452a518d9883bc19fd7a47c7fdf96bea6d9b44433881c4bdc4c9129
SHA512ff39bde513d58ac224ad836e1da7ee9e66d729fd4459dc2a61e7d26651c9e3e2c8da05d8ac50baf901574f2606aca128baab04ed5f069fda2bb2482fb5c412e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d87a014c30aae136a2a450580fa1f386
SHA13a6aaa7a3f5394667c6c32e64591103668556fb4
SHA256ddb9912848f85b279aba0e0c33f3b2db740558ac176f88168e2a1b79d588c278
SHA512f5f15b8e334c1362b511397d81390b933329e6b3b75f2179af5f4ccb203dd23f0adb1b4df29aaf925a74d09237737045627b6e994f638383da31edecef892bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507794a4f9238009f505696fc19383c3b
SHA1fb016fff81bb247858d0ccd053c0c31fd1b5e8c9
SHA2567e8407c0931cea89b399d61ad23223e5468f8f2eca0fa7053bc67b52655b731f
SHA512efc141f9150f6b10ee9c211b573d2aa4cb2c99bd6663bc377e9fd3f2b361ffe748f3af98d16d750e441bfae5f6dd185f28f03a08adb54c89bba6f94b02b64224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587bfb88be24b629a5c8c370582f2979a
SHA128aace6245b3d258f04ab299c833c26541645c99
SHA256804b5a80a2045eb7547a21f1fb304dc25aee2f7fa55190f571c29674974bef13
SHA51213b4b0692a138769fd695825583137414ade16222dc86fd064e15af19007daa2c69771133b09dd476696594b8c56799e1cb258fecbb0487196d64f119257d608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1fcd7651588f328a016be84a91dea62
SHA1e9addaf30006dcc33c8c6b3e345e9cad5668e80f
SHA256e14ae3f1bf11541213cd09f2fe7db36e08d52039f7650c0106eae03323c3f9a3
SHA5120eeb7b234d15154433e6cec2e26f9d81943aed58df463218a81aa3e1a9ee40635be9c0f38c7dfa94fa10df0e582fbde436212ca407a1900c6d33abd811e27bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e212c96620a277ff1c5e883ce27dfff7
SHA1d742ab6a81122935300a064f3bf8021ddd1e16aa
SHA25687b9c05b46d4ce5c52fe715a4ef7dbab5fbcf32794e6b1e3a2d122368b9ba318
SHA512e09b716a210eb1a3752f7ea5b1cbf870b529088b610223bb35ce4a853082f267bc4286a3cd3b27ed0c3491762836dc5f007de7f9ef5caf7337f0ddacf92a310d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ef12ff0da791750c9395eec2d76bf17
SHA1ca44a3e1cf167ba21361e8157a8fce16c62df3b3
SHA256aaf13036ad389953e0a196c08c2c799ed438d0f8b53f6a488c42cc307df63240
SHA51264cdf147b1f35825aa941ba90dfd09ee835211da50f3ac913f331409edc8dc0bed222de1535c8429a48cd6fab64ea7cc20e0a33451b710c44f14acf15ee401f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5207ad13db6f1eb8401945dd22fe155ba
SHA163235ee1375e454f79b1c08700a01ee8bdcd1319
SHA256dc0948968ce40ff1b8aa90d1b5692b3262282afd033cdd0679a7f9f4ed564a5a
SHA5123d5cea69f202fe440b520a62001456e69f4d55176fb84d89319d7ab91c0fe639afb83d95a547d8ebb3ed5d725a4069c0c5cc66656296b1d1dbbef094991b9e27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5327b1aab9376f3aa6506cdcf746fa38d
SHA149ce353c17522e7aee5fe9da8bf16e50e8af3aa9
SHA2564cee016716d1baee60853336a1645b044db6112547cb03599afe9516c4f5a28a
SHA5125327790cc0008546537995c5094e2b40e18d8ebb4ec848871f583fbdcdde30f4a7067c20f0aa87b858b170b3f50f47b7eff62ca552947bd17d35829a20e096cb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\styles[1].htm
Filesize162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b