Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
b0ea9bd3eedc8604d6994b7b686d9d27_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b0ea9bd3eedc8604d6994b7b686d9d27_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
b0ea9bd3eedc8604d6994b7b686d9d27_JaffaCakes118.html
-
Size
461KB
-
MD5
b0ea9bd3eedc8604d6994b7b686d9d27
-
SHA1
72fa4c30b787672c61036b8a6ed2d09750e8ffac
-
SHA256
1f84268a8fe2d87e2a06adf249d2c62eb36164e987be7960281839f2b6850050
-
SHA512
52ea26ddf62d9063f770bbde4048100d0b0928c9a5360f115021f60d5db9cbedc532b4f2ae4e73b952131857d3ab28798733b821f3a10d72772868e573c26ce3
-
SSDEEP
6144:SdsMYod+X3oI+YvsMYod+X3oI+YwsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3t5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004da428d7a8d90e49bc297b0259971aea0000000002000000000010660000000100002000000012fea3e9a2e49f00f640404453c8b2983213ae62e95d1c92534e2d3d3808bf36000000000e80000000020000200000000484d38dc6c786605f10d8448bc3e87d15fb597607894f44d92cbe021c8499ac200000008ad7f4602d487c3ee1066578fc7368d58c96f91f49be403e607d04c43101464b40000000d39068b9827850d0377ee85fabcb9e7aa7ead1c49cb13a490cd58ce7c730876a63c57bc9d00f0a8f6c1fb95b41d253df9a4bb1297cbff833ccff6abc4030cb9b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004da428d7a8d90e49bc297b0259971aea000000000200000000001066000000010000200000008f0b8afa3e9000e65dd92041f00fa75bf61cdfa26e2c3a3079d29afb07db66af000000000e80000000020000200000000592e3855af258b5de2fd0685ac0cea26f8d1b42bb93065d9dfe4e227c4b4da8900000002dc16587322d53a461b2302afd267b4f452436917e358e853f54bd3918966c552c64600fe0f641fbaa20dd3ce43f041f876b1bf46354ba9106481de10649bbb6a8721d46a129fed4b705224bfbfde672de42e79c0e4bf4cb11388671260fbdd3710fecb8c1706dbc9ad803032e6a519c4abd586368dfb489b233819f30bd7a9d8af60331865e3f43e877a800d6a4e882400000004da4913f2a535a9ff12a5d132426c7bd65273692b405018e520a1013efa40fd69d639bbb41bfa411ec59c88a87fd16589bd6307223ab0d8609f07470043b0cd2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407181ca84bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F20335F1-2B77-11EF-831B-46E11F8BECEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424659831" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3036 iexplore.exe 3036 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2988 3036 iexplore.exe 28 PID 3036 wrote to memory of 2988 3036 iexplore.exe 28 PID 3036 wrote to memory of 2988 3036 iexplore.exe 28 PID 3036 wrote to memory of 2988 3036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0ea9bd3eedc8604d6994b7b686d9d27_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57548b0c85cdc8336590cfce692f2252b
SHA18b029d33273a9951d7626c600fd9be0aae2a9619
SHA2567689c09ee9d47d2805013be386d0b3195fa0bab57aa8578cc43dfef0c9f18305
SHA5129330ba9d363cab5bae08fafd6433ecab4a93d5d1109a612017b8caaefba7b5139537018a80b74701ab93af364fe0d54a82124d6c60532a291fb4f44aaa887f69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2dcc614e08cb91b2577c54f320482b7
SHA1485827a1a9dd4b13dcdbdd909f6e9a4b00cdc0b2
SHA25605ffcab688bae5f0b3c017ff1ef5564e6e6736b60ca3b6adb5712bb13a4f04b7
SHA512118354e2885e1b0f24822656fa43bd05fc3b886b7b2fb9ad2fbeb8b697428dc1d7000cc604c3fa21d29dec552348ba2b74f3abbfae4e9f148e344cc8e15f2847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ba226a6976575b2afd31b5b21017116
SHA144c7f0cd69a50a19a1e82911c680840ddde8dd40
SHA256aa4fad1564e5b5f3b875fd74bf2d687280abea7db4c037b202934edc765b9a24
SHA5120bee9c7166157db22ff295ace3dfdb50f9988ad88adc67fcccd6fcdd686124dd29e5564e63f6ca5c7d3fbd089a0121069f72e12b75dcb4660580b3fb26ab6283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e587817b8d8b29a859e6f7e6b0c9e94
SHA11b4599b7c94d639385a7c5133337746883c7291b
SHA256c02d314262b236fc52fef15afccecc3248336087ca14d06cafd6375d715405fc
SHA5123f462b76dfb0d8bc72242eaa838fceff671b82437541b59e996f03639f6033e1f30318bf0c0567d33ce19843b16cbc4f894435e0df20fc2219b2fe3ed3c0d16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5838789b1d86bd71b67893644812ba5ca
SHA19e9d6837d301e70c1eed007b69e4a9d167fd33e0
SHA25663240ca53e1d594283ecf6de5f1e3778456fecd2bde30c217b91f686684ae465
SHA51202b3cdfa6b83a5ea5ea7f583bfeb79a0497d1a9544c8cff4e3afd2c32ce837e84da420d0fe075d3997d7bf671fd33e312d8213dd92c62ffd91bc10869d11fab5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5049bd07f0c3c1d2e56d7797694f5ba9d
SHA1d0ecc80d05e338fc2728a5d39946c0b8de7aa1e7
SHA2564eb8bde4313c87dfdf82c9e1f573e73f9e29b6e7019c0c5e50846cf0c181ce36
SHA512f1641a29bbe7b1ad7af41bb76904d9c49c1cbd86d5f32f5d6885f8503011ea1404aeeef837624185ba7dc80991c82600e0aa81c90b96b693c8d92353019f8132
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5446848e9bef8c26f86ae9d335309fc07
SHA1b59fc37fc87d64def068db4a15213af665f6a331
SHA256cc50a789e8f79ebdeec22af6f6e2e8a9cdde8d764fe866677393019c6bcbc1b4
SHA512dea0641f73e4ca57edd817c69d19d21bd131c5b7111c5d058f4af918d271d00b7846e857846347a89a392acf91c120d64708f65ef678c087f7ac148bf2399f63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f46286a9a739073797a140af2cb2edaf
SHA1494bb2554c706dd91e8b875754e97cba411b5f05
SHA2568ac244efa79bf9587d8a1082a199878bca9615f7743e0a442742dddab89c8ae9
SHA5124a16933dbb0fc615ac1c6e7671bf8c429e17565d5531049e10be0099e8613eb4761e5641e3739c293424d1bd4e744f075e7fe88ae1166129115bc70c98fbdac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528d2b44eaa018e7257cdcc9db816806d
SHA15c8d5fa2ff5e46ffb7fa582fd46575240a1e212e
SHA2562fea7f8200e3bad44bce93726db059f8bbb7e30ae43a1e94caefaffe9a1a30f9
SHA51216f3f8411f40d3624692ab7f2e925531ebdf925c3071037a349151203ee5173877218522be1058994069af382e777be7086db4fac82a0f4bbf43bdf2722ca072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b622632cbd3339c1b575c049035db20
SHA1bef24986b189006e2b6c8d0af8fa6b2df8bf9d4e
SHA256f2514357e3003a1c6b915d7f1cb10902dc4ece2a2e457cde616fcdac606c7129
SHA5125a1e03d3ee555437724256fe1a73e0426cda89e109c2faafb411c8838ba2b79216c56768fa25a41258cfd4571e9a1636670bbd1da88a932acdc9c239c5d74138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553b7ff6874de1a1560bc8c9cd23e7ebb
SHA1db1a0bacd65e9681f0f9092fba106777524375bf
SHA256d0cf9f6c258d20574e6edbc16781efacee675e9e45159825b6bee213fdcde9f1
SHA5129a128648931f79ad555bbc3ada68ce1402a1780799ca54215702b907ad12be135157cf5bf53d56e60d5717afabca4ec09b812c4dcb6a77216044c52435b1e70f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5891445eaffea1d043d4a0409ff2e1c09
SHA18e8cd653adacf89a25dbded13bc33fe0b6f5fc9e
SHA2560631485a3115c0bacdc03961804f7cf99fe6e320ecf4ea9c124002ddca2e3c37
SHA512d24d55876dec3d5cd200b7be1b1f3b2406558a6d0f72fa8c54b304641a934a9a788f82d7569474d5b44706b58d761dce89fa4b1ee5b1992da0058284016ebb86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537409c67e39be4ef8dffc4410d66233e
SHA13ea174f64965acdaa5f76831e92182b577379c41
SHA256494d78ddd652ceb28ade6c8d633c7599dec17e0df1c06a9babfa4588a43d2aa4
SHA5120ccb7552a879682961858f43fb494e83ab48258e4e71abfb28ff74578268a1af86665207f7a67c5e588b65e38a28161f53c8f51cc5190c138b525babae60b102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e1b4ecbeca95218676f0b9f3899f14a
SHA1786e5ad385be14cd947b70315abee672e5e5bfe7
SHA2565295d0e3866c80dba195c2111722efc86bc02fc24eb9de37aef0b671fa28078f
SHA5121dbc9b794561972e132207e63e62754d5d39734c16a6801d9d733e46d99b32a5fdaee4def69ff13f6dbaf3a1eb550dd7bd06df5488a67bc1d5eecc278aa71871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f47a67a10be0318184e879924e022a9
SHA151dc1c7cc66cc2744e2dbdb6b9a24336d0ce5911
SHA256a634f160086e370479642ce841de8d6882ec63940e5c93a652f57d2efe5a3fd5
SHA5126abcc4f915dbdb59fba9e6ab2760b74dae05fc2f884bd11fa536c8f26cf0ffd9a412735096f747b7ae4cb14516a3a8dec97b2232dc4672bde875b59b60374232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e67ef70b9e978246c3517bacd8fe41e
SHA1fcaf45d75b8fe2ddc91d84f23454e8d999d66aa6
SHA2565665ea16ec60a16083807da9f176c73be3060006a2678e453a56795b3980b7d5
SHA51260787bf3eb343bd697ce702d9d53ff0fc1661fbd9141201b1e19d3353ef934c9ba6d0238837ade4f7cc3623352f3b64aef143a2d132b0b0d6b4f39bbba570dd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c7f3b60281deef4d3a2d39c81c13e9e
SHA15cb855af4ae0d559c7c0725ad7de9fbdbc805247
SHA256116cb16a37e802f9e7abb372e2efb452ac9cd4697d46b385f170b4d78bc62258
SHA51284286a4110e2adb1f3fcf61154b85afa416f754d5647b558667a96bdd6213b5156859c27dae3a0644ce398acede8c7741549799c32c36335afd2863a90cdd2a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dcdb849bda3f71fd45819c3afe4655b
SHA1298a4ea6783e972c61bdf760636c2e35b28daa2a
SHA2569e3776fd3cb5b6901516f21e5942a0453da6a16e29c4c338c32a34382283dd6e
SHA51266e8c444bc43c46eba51867ad8f053aa26dab476c20d56ef6f045296415ca3d6eb939c281c8ad5d9dbaa4f09b5981fc9d8f8f0b1cf87f28ace328e15483a71e8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b