Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
0535e903c03ea39c7143deabacf2344e_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0535e903c03ea39c7143deabacf2344e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0535e903c03ea39c7143deabacf2344e_JaffaCakes118.html
-
Size
9KB
-
MD5
0535e903c03ea39c7143deabacf2344e
-
SHA1
37475ff251bd386afe9411acf2053c2cd897c1a5
-
SHA256
d6988f21d3fbb1c5a62be8486260c8f8ec710e48a48ba6d522469cdea07cade4
-
SHA512
9ca70b427891499dfd768888697043f5f4a3da01c8933d1dfcd6074c39be7e84533d0a1ef71ef2f490a7a08b2019b28f068c376d7671037d1be7a3f5be765983
-
SSDEEP
96:uzVs+ux7yTLLY1k9o84d12ef7CSTUpGT/kPsrpUlVHcEZ7ru7f:csz7yTAYS/IAUPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c4e3cd89bf1849d5aa19be42a980a4e190601b5331951a89492af6a05186bb85000000000e8000000002000020000000287441c2507fc7ad6d98de4b8394568948815610ceea3344235aeb8e71d45ea720000000d81897f622989dd79c7e9aa1467c3a02440f900cbfd701aaa333093d1f5a6fb8400000001c42237710aade07981d348dc1dbe76294051c37bd8f0d25a9f15ebdccfcd27614cb54a7260af4bc33b50992f59e32352047e299a6496e26d810b07ed1cda482 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e43e0bd054e893f75684666b512242ca60d0fcfa954d2fa80022a62f1ef250d4000000000e8000000002000020000000884bec285fb1d14e84111262027b070fff34b7327c63075cb059b0f00aa0a77b90000000d33969a72791c5cd6fa3c87e43247cc7093aa46fb2a0c8734befb693b59a7f59670d12682e06e3425363a55c52ef6204d19eb270067afdf60e5856a45063bf4b2d3dc5309c4696e3fb5181f5ee80bab4a9e95f4a5d6765052f6feee29b677cf610412d7a308a09570d8737ef205737aec4d6e18f67e557ca1390ab72a45386f2d0ab76ee20e0e40792376e1612cd8f6040000000f7554e17a2deb496ebae38322d892320393facc17eff7e24666ad3142b7c96bb74052c22c2299a1cafb6255e4f795f23cba23b32374f9a55a399cc74ef816778 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A32FC1D1-31BE-11EF-B837-5AD7C7D11D06} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425349899" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a6b678cbc5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2712 2440 iexplore.exe 28 PID 2440 wrote to memory of 2712 2440 iexplore.exe 28 PID 2440 wrote to memory of 2712 2440 iexplore.exe 28 PID 2440 wrote to memory of 2712 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0535e903c03ea39c7143deabacf2344e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585904d0a6661ec7eca961178a543b7f3
SHA1f2827e765f3d751c15334a1083ba799e7d77471b
SHA256229c6221bc54c82185b4a2415ec99e49e0c8149a0bade46d2bc69bc9be0cafb9
SHA5125d122dc67d2d86eb2b903d5666a90ad4aabc172f9efc3cfa4cd07738cb85955fabedadaa11311ac0cc8b26bd6a906682552fd7439991cbf55a1dd367bdf8ae0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f7dd95400e38a8fc5126785252964d4
SHA1e16410fb356e0fe57c1ff8039e78ab5f9097721c
SHA2562613aa9993a0c95a73d54fa61e807393987d2eb6dd06c93441b0718f60eabc94
SHA51244d67ea63dd852d58b867dccdd402f5e1e4a1244c3892d722e685cd91fdc9b0dc3c7d62a8559ce5a3136b0ababe55c803b8038de0fff2602794611e0b84ca158
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f185c63a734de91e076009ab6c691af1
SHA1dea97d973851041f4323e9e47979a2103ccd39fb
SHA256528b082c8620ee29f431a6746e792dd862d7883a664d67b892f51fd3c16f6ad8
SHA512693a6648f20139c1601d40d231b0035a962459f3ac3bcea6f74c4de4cb0f12162949f9cda9c6a08d6648dc8e3d42874bcc6a612b207fe189e3d896d3b634329b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508dbf77d82733276cadec3a18aa8a44f
SHA1d10301560bb72a8cce691ea659d7ffd4ce224c1f
SHA256ed1911eebe822c4e36b034387a1bfa2e47e1352d8954e1aa2793c5d3abf502db
SHA512378083e66da03212cb3736aa5df57d80232981e908094e6ee89ab25722aca4f6ef34fcfdca9fb1de46a729cfcc40d8e78efc944baf2d765fc8cc8a6509c8af89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5815f51df5d85eb6c751c1d1d8034091a
SHA107d025dd3d6f05e0c528c170263bd31d2b7facbf
SHA256241805d064d74192b86bc0c2df75dfca42d04db68b919e1b8217d816b7a3d4ce
SHA51298550a9948cbafdb94d5b48846912956834feeee09d56d9aecc42986cb7d51c594841d4617b0c1a34fc2aa2b0075047c7b999b5c8e626f95d066c4ec16f60f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558efca2021c6bc462f1f43662ba6a10c
SHA1bc718879754e0fb02c85bacde463da1a0abe25fb
SHA25616e88e7370cbfafe99f767a9e70a5722a250dac45016a90e8a51358ef1faa465
SHA512497dbfc0a20466800d75922355a751727943ef00b80015c33053bd23d5267cfc5923a2390e75d5b65ab3f58a8af732ca57796ae4d9d99e51ca5aaa12fb6362a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5167a4ba2dcf810cd5a10e4c068a477ef
SHA1190e292adf8283e3c43a617cd0daec07a752ace1
SHA256be3f112cca556408e3408fef0a353dc63c59250290a8c6908ceea26db74d9a4a
SHA51200e912ee1d6431b8164b5d67b5d83a36725c95bfceb1c6f0f658e473aed1f7e2dc46492499e939f25d15bc260264e45e5f1360acb38ae8a54bf1562287d35b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51edcfda3a69fac1f1bfd115693f9782b
SHA1d4f8a8f249e68adcf28a44cc1555c5fb27eb6dc7
SHA25657a500bb24b52b8a9c51cbb393d6f32469fcc40b015e130537319ad778147274
SHA512861bf524a882bec1e1f443605da466f52ff3a83430585f7ea905ca869dda16a75b3160f33247652e75fa51e87f5188181760d09d3cce632b182938231c512fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f500cfa8d1287c9953190d5c451d931
SHA1df6f2c9f100934044910f6555309a1b4382088b5
SHA25663fa69ed26a04bf1a54ed81ac0426851d16c367442fd22a93c0a8a42e9fea211
SHA5124ed046f37fcb26de82d6965f7677081fe37966bca1238c301f7798e998ba31655b6ddfdcf352a812aae7f0e269a5d0b9b2c4e78be2f049674fd62c2850e5c624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c765cc845accdade743e9c888c48fdc
SHA1ceb73dafaa82dfd1056fa0567b6f0f3062165ded
SHA25628c6cf0fcd31794f591d066e0ca6fa964974c63e57a0ae22a15b3aad11ca1e83
SHA512f521f42a5ae516a0ca064ddc3190006a04415953f7a0a7e5be5f2cf5e64565f0d2bda1464f3b294304e3837df1e69bd8e27b05eb48c50d312cc64163c5a56f23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a150ba506c494cc5c999a550c73e82b
SHA1ee96a96689a8881a000494894731123b5ec5137b
SHA256a27383f4a78c98e95f1fc9d599db311aea38f4c4f9ea252c5c922d79e5f087d1
SHA5125f5de81f89e6d5b4a9b4654c2ab57df5130d8c315224c129efaf0d1855b29a4e60ee8307a604ab0d53852d620b31d1734203721ceea5764120c1635b86c38edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d0551c5ba71a23b9db5a6f7d579447
SHA1418a5db76978bb1be9b95d99ad135ecd70d1efdd
SHA256c38cac1c905a625b2c18ebbf319c5cf51b3239c75b149771e00457fc75d2a173
SHA5129322cc009209aabf06d74a6ab9c1e53f5a298390d99c8f4e7fb88fd98e2d0bd439a3d8a938a163dd68b85598c4d1344d0f2750fda1ced34789ca66407a857b0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1ed091277b4fc12cc3a8f90f9a6d219
SHA1f75060004f5dd942fd5e8f79bf79c1cc2d8963e4
SHA256c0b4cbd5e9dae48748c6f3b55f7144ba18eae9ee85f9c1030ca492cf9200fbcc
SHA512158f75ba5d59d61897c3a09202d33a216abd6f41e6531e014d09bb5227578264ac5b4bac4ad4d3dbd2ff2f66663fecd4c4d11b0c651ed3a165aa75cc54b9d66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bf251ddb3017cb1d8ab81b4789f6302
SHA1e1f338f66256f4e7444cb4a610322e4eb729b940
SHA2569df84b440177d02382ba3725d30555637d8277139a849aeb344975ecd2d630d1
SHA512caeff9a67d24754fda570f9e490db0ba6a12a55486d9ef11397757ce89eb4d0dfe53b11526f075f18b58efb2e43de8757b7fe0f1a8df9428d7ad5a0eb455d861
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57206938f913637827cbbf0f3b598a741
SHA1db63ef90ac36482182dd9e001883b54d4d476a08
SHA256854bcf9de0c1e7380baccf59cc227797a659be900ce9689f9c2b60887c96b561
SHA51209c62f4c7fca711dd8d9191171de27650900c97565ab47e9d530e6409dc9d7e07192ce32e33df2557b2cf14964af218ff81450672f7892524644e24fa9b22aef
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b