Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
14faee5b4ea83a1634cef761f1941087_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14faee5b4ea83a1634cef761f1941087_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
14faee5b4ea83a1634cef761f1941087_JaffaCakes118.html
-
Size
11KB
-
MD5
14faee5b4ea83a1634cef761f1941087
-
SHA1
5148c34326c62788b1eece6a72ecfb0f734fef71
-
SHA256
c661488ecade75c0773ff3365e2f010b5198a87672ead072d251252388ae2161
-
SHA512
ec4cca63f31c7ce35ce77e50bd006b45270ff8ba67a43caca575b367bf2e1b14eb3104a38a4fb2707f28fdbba30fabbee004b83f6142273749d87f47bead7e1d
-
SSDEEP
96:uzVs+ux7pKLLY1k9o84d12ef7CSTUcj3OlpKIoB9bRcEZ7ru7f:csz7pKAYS/gQzb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b770db5ac8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{067D6F81-344E-11EF-9387-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000afc9478be39d0540aaf31b91cec0a8b0000000000200000000001066000000010000200000005b8957f78e9e340d89d0cb78976df2b34934ffd1e5a3617fa6391369124a8f34000000000e800000000200002000000064003fac508b74bfe85cc1a89ad94dcfdbc28dbebab5ec505bf0afafbc6f7a90200000008d43571a13db6f1432968d8b8adf2f93444b70c10eb4c0f6ed47ad9c8970ad01400000001ba507f656e8850bd3b86fdeb0fe379187ac5405da1d32fb701f38cbb5b37e449d0149d9e58d8e92e19158e45df047182c4e0d9d8a7963cd4d1991e7c7b547b7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425631386" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000afc9478be39d0540aaf31b91cec0a8b00000000002000000000010660000000100002000000012bf9ddf8c453f5ca0191719512f2f55f1dbf7a1cf5f8aa8b4f7d1c6b13d9a36000000000e8000000002000020000000605fe728e271155698e84c80361d0562aa87d724347b4acd0123285e79a743fa90000000e5d41e4cd02cebe54b97d8d89c083867802e8654fec2eddff37d50768cf07a4d11c2b7ec46556b720a735628e93d1908ac520eb32721def01b774d4b60939fe0b80947fc321c31b6691c554b473a71d4380d0d755d9f7f6a8a4b223fcd83132afa450b375a3686e590676c66b84b2c74d3060d24e8e849643ad550cdbd64a5da48c038c3cd0bde86645b59eb57117fbc400000009a3bb610c73ef31d287985b098feea9ec7cfd5c036b3a9b1c4c08f86dcc8b7e69869d7266555d6d6a7b6523f0465a8744887b3e34f1a9349934920245c20e7f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2600 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2600 iexplore.exe 2600 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2520 2600 iexplore.exe 28 PID 2600 wrote to memory of 2520 2600 iexplore.exe 28 PID 2600 wrote to memory of 2520 2600 iexplore.exe 28 PID 2600 wrote to memory of 2520 2600 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14faee5b4ea83a1634cef761f1941087_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59454f45478b9517fa0eb8a3755d62e76
SHA145755a07ce46660ebae8b1be1a7003b0cd26c1e4
SHA256e12b8fc4f53b0b3b9f93543df0bda525c4c687887eeee4190ef09875253d3679
SHA5122fdd17af9f3d8649bf348124021d86a8bac4163b34e6a76e196bfcdbda48460d2fd7e2695a25802028c71b128746e13d76d3962df8f46fb2e5f484ed0e15c82f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8811d4563c6d39d189da95e367f7a69
SHA1646ae833d1306b7020da81f4396cb3bbdecf1ace
SHA25677bac82aed521a999365397314939b19e191f3e19529d64152238fdda6331502
SHA5125d87bfcf683ac27d94131f9c1c58a4bed5b5fc6f03e9d45a46d16019d582370902dbf39383ea42c5b447859c8bd409b830c8036d263087e7bcd70b2fd01b9f63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cd386b57a7f000849c59b7dcaa8207d
SHA145fe48d7f86ba07614a861a4d057bd5dca727d1f
SHA256b683dd999d7590183d62b6443ab242e87901e42f2f947dc509ae7968e5bfd805
SHA512d4c30c8e9104cb64132747b8db01125e27c04f7fd7a9cd3f7b5fb509e4c4b6fe7cae1b719ed54a8a34958837c8169660c1d11053f6541c7c487765459102a503
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58acfbe09998548a14fcbb08997e68fb2
SHA1bba11e22b1a83f435afb7442674f9a9105c1a841
SHA256d816fd2320e3712ef71d16146e0a57b4c3080a1ae307b7dafe410e429ad82bea
SHA5120ee1bb7a8bad8204140302b80f4d637cc10ce22eff8cf59d63d53096e9ef4c420be70998b94b4cd1985bde1293bb6d331e02c6ed72af9909bc70194fdac3b2aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fc89c6238d20c68c25f0b69a298a476
SHA15302c75475628e7d1ef098320e61725009c3497f
SHA256941f2fdf9e1a35b0df6202f8eb59eea3a0aeefa6470a8fd339c78e9ebad29434
SHA5123dcf03332b9a22ec3886b7cce13561912dc045d8d7b4c5666902223cadd7b8d6675b5d5777b56530366dbf91ecde448702d2491e6c874dcbb4257964ef13ee91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbdd8dd93449469087aac55b769de0e2
SHA158b6396ddd86ac963b7559ea9b90455d6e92fb87
SHA256efc6dcda325003475c1e4c72eea2508ca29de037afcf23404416558156c3bedb
SHA5128b1dc4b8a162d677ba881c8295fdec2f9d26d1b42e633fbedfc42ad7d510ee10f89937cd376bfab62c1df78900360222f6b416cfed59399ffad300894f41e016
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f17a297e4391bcbcae96f172f71237e5
SHA1b713de1e08ec2a45ccec26522e1b36bbae507934
SHA256d86566219aea1948b725bf1c614a84dccd895e1501183f9b836d95e43098c307
SHA512e057fe069e03507a51e55cdba11731db89c5a9fcb6e19eae4372cc9d312129b7f3458cc845c8b4a5dfca50866693d25df2b9faa5b390e73228dbabd6996dfbca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc26ab0cf4b6e6cfab6f0f458bf4c136
SHA10a69cbf3ef7f252ae5fb4d268ed752eb1a06fb29
SHA2563dfcb9bf48bd066100d45eda3810545dd832c54dcd43e5043c9c5abddcebf51e
SHA512224441d7624e895d5e0b5df197e27cc4f632458bc1d12a8d101e9606f886dfd9cb0b0c607e8aad0b2ed11e20945e4ac784a2ffaaaabe735ca7cb03c5f3b720e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517f06374e5f18b119b632b08c8b6aa96
SHA1e88e5de2573333373d8d8814ce1ca7b1c3ef4e88
SHA256e9cbefbd27599e53543befeeef7dd08f62c58f239b944e841742a897c38dc2d0
SHA51234138c2c6a6731d7030c2968cd4d81afb6174b00f9d905791a18c5bd7afa4b1d5c5b34836c37ae935fd87bab49af300dae0d54a580dff4d5c88de5c5887a7341
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567f2fa4a0cdf19ee9cf7f31171b70fb4
SHA188bf5c6996e5527b74bf822753d5fbb47f7d1f01
SHA256af045d907547ed6886dc68d7399099705244596b9135efc81abbedece7c9f160
SHA5120ba882c00bfb00c72a59979662bef871fd4bd46e62e8d6307eb47ab32795449eebd6335bd8e425d0811bdf7ad32e58e3b551116719b3cd4090b211f682e60c7f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b