Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 07:54
Static task
static1
Behavioral task
behavioral1
Sample
b27348ebb6ab929227973973306c2038_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b27348ebb6ab929227973973306c2038_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b27348ebb6ab929227973973306c2038_JaffaCakes118.html
-
Size
220KB
-
MD5
b27348ebb6ab929227973973306c2038
-
SHA1
2a25390a971ab9d0cc5d692691aa42e6b1fee733
-
SHA256
9e475e3cd6b447935dd71ff74e9099f2f181ce303766657ce15a88d83c6c7aae
-
SHA512
04ab4c36abc9f1678e280864da888df6b628596d51e47718831d430e72d580cb3298402e1a962cd3e701030927478e20f3498646053823d6f772f394642375e3
-
SSDEEP
3072:SMfmc9PTgHdmyfkMY+BES09JXAnyrZalI+YQ:SMtgZsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F31F121-2BB5-11EF-917B-C299D158824A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424686322" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1920 2932 iexplore.exe 28 PID 2932 wrote to memory of 1920 2932 iexplore.exe 28 PID 2932 wrote to memory of 1920 2932 iexplore.exe 28 PID 2932 wrote to memory of 1920 2932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b27348ebb6ab929227973973306c2038_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af802ad3369d68a365393ce769faab9a
SHA124e0a707daf171025a6fb6586852f75750ae5036
SHA2566e2b4db6c4984ce65993e04a00616e95b523899b73e2e4f9f0b8d92a2178bf98
SHA512e90d4fb3e0b97e5eda81d4ceaf1c2a052eb7970e7eeeab30d241df7a13101f635397f1f9103caef726366ed99ca7721fe8032a8071331b8f17e17a1abf654e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ab0213b8c49b8c7e12102b8956c4ca1
SHA1c58100cbdb71eb92835fa8ed512f137cfa01b602
SHA256949109ab768824f6d21d1a2876284ea763bbd313136ba13bb22390da9e905a58
SHA5120efd247f635b7512b48a1532ab7248df9757327777c629d5d2a2aa07d5b7b1ebff312b905a18861f46dc962b96e75242022fbd4384e382f5ff56671104b1b28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5425512283653cf52e1f892b0dcaf389f
SHA159ea63f43bc67d02929a03520bc2b862ebc8f3b1
SHA256a5c3c91a87f80a4d4af736d8fc987446f96fadb15c47894f99a5119abdc1808c
SHA5123be31562d0b3b43478f15def0e9b6acfd44acaf50a7ce3313ab57431ed13b6807638b48d56134a53728d9e43478ee868d43f416358992835bafbdeb3780d57e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc2d60a05593e8fcd837bdfae02fe7d3
SHA1d4c1d537e770b59981ce276b9a46a8ff74b44f61
SHA256fdbe085e964d8f1e0c571f0f66d546340c0382ac513b287714c95330fe4542e1
SHA5120c94170370e6cd417e8be2bbf4f7443d2c9859d675ccc6451142d6ba6ab549c09aca5f652eb6b148f72ce8fb1ac266159dcd53ee36360c763743a2e94732f561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dd6e03906d4126a4aeb5cf24cd15181
SHA1925d76fcea70f676ca6e54aaaf72ccf7e5f19b51
SHA25668b23404500938b20f1cea4171d0a325971f3d217822a8d442fad943820a05fc
SHA51296325ca01dbc058ea056b9a30c74d4ed2befca5d12bcb7c29c79496015a0b1560b1cc6224d9f23eb76b56a646dd7387b206c6b18b03234beaaec1e5acd659bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4580b05f9456c70a88b7dcb8bff40d4
SHA131c5181c9fca7e9a33ab7789512507d19e9d554e
SHA2561d82d77257c6d73a8e87b18be80cf12be506c029c9933ae9160a00e5d4caedff
SHA512345d7c99b7e81f81eca7fb458e949de1bd722164fc0bcc18ab09a27e44f00b818a09522bf30cea3f7766b2f86578526b5ab35bd8b800e789ff7fbdd3e3001d77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2be6e1498a2c633a30efafb3c0807ef
SHA1bee7d35b4ca0dc847e9109108f0097b4742ecbd6
SHA25674b3ea44f1e30ff77e7d76ccb06046f79510e3e48206870ef22c6012382c25f4
SHA51242b51cc2c7ff72695b3b5723a925cdbb47f8d22d1a11d46f8574fc537fdaf4a51cb1df4a9e65ac1ad2efbefa2024d0921b7471a3f6ed653444ca49c77bf66e40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551a8c44eb30ece6badf7e202d283f45b
SHA1fafe55f1e1d1d8b01d3f71e47d9aaae919dd3bbb
SHA25657da79d5c2402a9e11eee7021706ac1fb22006035b9b8e75b0ad588728c80737
SHA51220ccd3e5a7bfbae047e027c3b3f67d2d93344b533ff90d5a39dfcaedee301920e0c5c04cf3a29dca5cd8b669a592d8fd1081277c4503f9c5d1aae39cbd015436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573cc7e5c9f2793a8479bee865e8adff4
SHA106a005245acece99c123453ec79123bf8c9b28e9
SHA256cd8b80486a0275bfec6186925313159c100454c3fdb687cdb08b36dedc7575e8
SHA512d094d9fbab648fc898099bada26152a748c7bb5a661773285f312076ab486223467acca68599b9c1dc1e69c63ec1a15fab9d01dccb69928968027b941decbade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e1fa91852664403e8de1a4b681847f0
SHA1f44b8ea93fe30a205b94379572517495360a08e0
SHA256a2375841d030d8a09fdb9e2dc3049f1eedc2143b7c136d9e06b904a9b4217592
SHA512b96c7e6e48802ad4a538cdf2fa7ade8011dcb69b31197c321260d35dfbc730674064bb2162f5c03171febd7aaa5db467f72641a99ec9e0fe2f191cfcdb21872c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecbd893dffe228d8dac306bf60fcff6a
SHA13cf95dfae2416009459ea7b5648440c935157a74
SHA2568ce3344fcc87c06dd0590a3730aab1b2544c30823cc2f145682613e39913d9e4
SHA512dc23d46173eeb3e670b3a061423b02db564ef722295dde1f08d3bc2514371a07b8f6be9af6c3289d2c2b739f6eebbc87d5ad0f40ef93c0e19d97621d64fef4b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51760a551dfcb40ee9c910bdf0e801186
SHA12663743a03d318925c2504c488570afc4877bdae
SHA256241ecfd06196617ad922e24173abc9d71c8cc6c9af8f6cb87977288719e8ef9a
SHA512f94e772c44defbed30cc1ab64dfaf01c3880267e60d302334f99c898e50c53c604b09fd5db326d1a9b2b81012cfc04559360876a6cfe74a9ea26a37e5bd51a5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7ea89d07387683832bb464e2f35838f
SHA15be0a5ffcacfbe73f1dd8e62a3711b75b30853fd
SHA256ef1823fb2e1d09d47d420ea83d89f73c4689c6fc9bba69b004379b52168dabb3
SHA5127aa6f37aee1a1c99fa80f7377437bf770667ec2bb154544e931df322752dd796b5cecdb39d8332c5e2f95f29a8a7017aeb4bea9244eaf7e84f5b8e25d3680754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5280a219939ba838f35cc04a18242e5e0
SHA1e775252bb04aca56f4ae2f7c62cbdadbde60f5a2
SHA25635a84c627e424560cb5ef490090455954ae159b0cd160b824207bcef2ac4cd2e
SHA512e761b8fbab11e0de01b4cc7403e51843ddc4e92d11dab7094de4709586587a692ad6df8981bf48c92db77fdedff7c81129fb033af31ac620cdbc557ecab2f696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564ed15fd1d30348aa4f54f8be8347c91
SHA1e53063553617d3f1e93b24619b1f0a4860e9a561
SHA2569d371d2e195dfac4022083c0c133881f270371692c85b11716328d30e9faea1c
SHA51242baab99be8915c85935e5645f02adcaefdd7b820009096be3e4bdfbe0088a589ce215c763be3794e3ee4ac7a67fc2c6bf9942d34a01f0f378cd3ad992bd45d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57febbef363319a9d6ec74098be918b84
SHA124cea0c5bfd46777e05385ca457d7e80024153bb
SHA256de6977bfbfd45fae6eef59de098a48380f964bda524575d4417e8bbedc5fcf40
SHA51201aea26e997384c90e0a29903ad607ecd32cba156114af25e1f4a151a8b065ca5e3c913c2e85c3c72f707a0a4b8cd730838b5a63f3eb2334d1c3aad6ce279005
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b