Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
b720d25eb2bd65ef2cb84f987298747c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b720d25eb2bd65ef2cb84f987298747c_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b720d25eb2bd65ef2cb84f987298747c_JaffaCakes118.html
-
Size
938B
-
MD5
b720d25eb2bd65ef2cb84f987298747c
-
SHA1
01ace3ff9cc47440734d76c911f511bc940275e8
-
SHA256
c8aa50975ced9d7a82bbd5c2a9f26e7babd5715ebbbadcd812617ba55ceb12f3
-
SHA512
e8a510684423b62e17cd2c0c340376dca986cc84704d795c596184b3c7dde328ccc060354ca0e7527726063661f3799eb3a99a3799ffb39f74cefd3228432971
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25C71CA1-2C70-11EF-8FBA-CEEE273A2359} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005a78fa7cc0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040ae4058322ed744983dc0d6e001812d000000000200000000001066000000010000200000003b0b56d8de3de0f4703914ea41fd752d318dd0e6c680796d9ebbcfb5eb8442e6000000000e8000000002000020000000107a403b85484ec10071a4f530976f4d9142de0c8d4426d09aae4456037dadcf20000000eaa81ff02a20ebc30f716e8142bfe601077ee1b5810197bf554cb268900580eb40000000b0a40c7b649cf32f2840bf8bbc3d93313bfb8232aa3fb25bb7cefe25cb5c026075a8be8624d8ab538de7dc01110b062337fe93e0ea3391687ce2e3d850a813fe iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424766433" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040ae4058322ed744983dc0d6e001812d000000000200000000001066000000010000200000001717d428196ed1999c267cc1ba629df26c72f9a21f443adff31e66bec20e0225000000000e8000000002000020000000850f4ce537c5ffe1a8ad6123ba492b872acc853bdf0e5d3f00928a915729188b90000000f37c167eeaef7fb06723140f1310b3f8d7b241724d1111085ae8ce02b9a72c25489f53d2559c2f9de0ac5fcdb30a0d58073b9ba337c299f8b20eb22970a73f6707ca4fd58552a5f8f593500aa3a8a0d069f845876abb7912976ac5a9acde37a3175f788928110c86f9ac8874a71c4947c53d0f4cf9fbe761f2926739c4bb6e5911f6e58a5dc8aa99e049c7d71976a33940000000af5ab12c25a300f687dde47adf7e13f73c8b4cdb8cef77ed4200fb2f22ba8a6ef784ec0ca6cc4d6e9c0469b1afc7e5a75fdcbfcd7afab5b7ac02cbbfd903d5f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1884 2440 iexplore.exe 28 PID 2440 wrote to memory of 1884 2440 iexplore.exe 28 PID 2440 wrote to memory of 1884 2440 iexplore.exe 28 PID 2440 wrote to memory of 1884 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b720d25eb2bd65ef2cb84f987298747c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5803360b67110253205c4f3b6266e14cc
SHA1f5f748cf9cd06f9b7acf7296f0cac841e7c451fb
SHA2564c87428ca1fe4b85e8781956c8eeb03a40e0cc1f1c8e045129cb8ab8c6037b69
SHA51235f1295f79446475b751a4b91a6d6e108a9534fca8e6a283f002eec8528b1cf55d14061c4d2a084ed3403648adcf6cc512ff77e7c48d67d7e399b4b80202933a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581511dc445ecfa81841d1a9cd9424a2b
SHA18912c802a87c8c4ee5ac22d74323369d3983cff3
SHA25621588e9ce782cee293299b4ce54da24125530e950b10123d6bfeb83e9c759247
SHA512827ef48bde66de3d9f49ba509dde994f63745d2a6d7af8bb0848f8e840c6d486d457e52cc40d78b1dfc02220f93c42a46f1bcb3556a9b859c013c5c2fe3416e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df77def67b94ba0886d7ae24bb9998b4
SHA1761e26aa77d87874e46d3db3d4b3dcf5fab00cce
SHA2565b19bbb8df87de799594c48a2fd78d457ef302e7a16e44be0e6569942e9be74c
SHA512c1837b5508a8489c32cd6f3469e8eadeb7cf45dd46e82697fc08a5d5413b8cd99cb65a63f29bb2b38fe58e42f80fafbd63ab798b8ffb961259f4d60aaef13b88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c07f5325699eff3b9c4245f2519a098
SHA135f124d04a63d4f7d99137a2262bd3a1ea888797
SHA256ff1d046f932613423ca727a5e10285888be141bef2e64850de7a4b7f1e391af0
SHA5120618f36203759e453e49c812d81510f36528bd01c0f5b5d0036d403c09b248e8a63a1b61a05635a16fafec19312eb08eaac108ace3957fd61bbf962900986510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528c790d12da5168ada06d767a8124b87
SHA1aab9d7b82afa16a95d212f4cfb0ba7360f2d7cc0
SHA25624d19fa1acb1eb8c17972ca1cdfdb49743312d91cb36551ea1228a077ca9ef55
SHA512c5cf051ea3db7ef1600117f3b1d849bb9c0953ceb2fe1cbb65425052b23a1d6e1b1df70b0b13d28b72ea3e2c9945360c792ca8eea7bb3c2a3aaf29a41e1afaf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c1a0f712080bebc33d50563c04e4333
SHA1964a8928113ceafcc3cac613fb9f66a2f44d91a2
SHA256d1f4eca4159bdd2a7846df9d06d0297f14983e02bcf630616d7b2327e315b023
SHA512b2775a1c812efb09453c3444d7c6c3e6c068f847829839e8cdbd90ebb0d15f13f20792585a3a197e27521a28363c6e0a6bcdd988eb6479cd7c282c7d3deb67ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506827ef3fccecffc7116f88a9c472064
SHA1a004cefe72344ea88ee2cfb1673a5ef5579fa66e
SHA2562de72e90c020bceac9e4994d8159331ad7d6345e43c22d8d9aa7d96d7626d5ab
SHA5125432d633478cca6856587c29f1574290e9ce64e4cc08f9725a7a34c6c8ab17d4abde41423cac6ec270095e78e2898b930f852232e3ed58c0de04d88bd31dfcef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed558244e0563c992a4e50c4c6a8447c
SHA11561468826ccc59af76be3ece0a0e7080f386de9
SHA256a8e5685f8835d80433d088385c77d992e04f72b8656977814476422c2bb724a8
SHA5120769b7bc2f57ee034972b60c285d3cf5618c8c613821e3b2245a9825dabb96b4ab71d642c54b44593c9f072197403577fd6ddf213cba4b692db03dd84c2f1214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fc7a9b84603b8579a27140f3370103b
SHA1d567f784232c4a087acf47719f14880966495e99
SHA2565dea1dfe67b918315bdb97ab8d62a42e9e98139242c6cc4a99a1ec7d8c37a5c9
SHA51246e212811d7e9ee5e2800aae68601fd604c55cbad9aca74fc5b0aac7d3b6098112892168aa7d1e480e4f5dc0ea2c87021e070c185ee97e988023f21d6d801bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc5cd5df2ee042012a82737586f17c9b
SHA14456537b82226abbd0bec04019e56bad78b46d0b
SHA256389d0091bfb97f617b5a4c758014d744ee5f9785e0e3ab34e06377748c5daac8
SHA512cc058b5fe59f2d42ec438b203de3c499e44df85768efd21f9a1a72412ffb43faacd240ad84b918f0d8045627a21426df9ec0724d8e9f66bc0a7a2d2406e4b674
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b