Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 07:01
Static task
static1
Behavioral task
behavioral1
Sample
1513c29f8084be111f19e8d1b0230391_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1513c29f8084be111f19e8d1b0230391_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1513c29f8084be111f19e8d1b0230391_JaffaCakes118.html
-
Size
6KB
-
MD5
1513c29f8084be111f19e8d1b0230391
-
SHA1
48423aa6a984810c4c370d3139fe1e65afbc3278
-
SHA256
893cec662cd8c05cee3a71771c70e887e56515e3276d9ab65679d98147426f00
-
SHA512
2d786cc1fa834fae744810b37d67aef76cd3f8002a233e90baa6c73fb3fb685a120a4d66079d75cd196baf07c6e1cf98070a299c67336585ab183c271774f206
-
SSDEEP
96:uzVs+ux7ZhLLY1k9o84d12ef7CSTUaZcEZ7ru7f:csz7ZhAYS/pb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425633575" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EB6D821-3453-11EF-AB07-4AE872E97954} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f1aecdcde40c5d40b4094c328066fa930000000002000000000010660000000100002000000018c41c12ca0a7539f033af921024e5fbbf3a6d43844f1e8139fd7401759b8848000000000e80000000020000200000005e95d6642a6c74e81e9f174f605db69a37edb2881689eae6451d9a1c7e5c3c212000000005368c6965031b248a54a7a4743ef07403cca7e0e5fa3276a7901a2ade3b558740000000284a27ed6d50cc3d7ad7f1ae4f64ff9e4e90de5c9253aa47e9f64c9fad5b1558831658d41ff952be78fac1643d06cbe54a737e2868830440c14b8aea065e17ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f1aecdcde40c5d40b4094c328066fa9300000000020000000000106600000001000020000000b8b59068cfc988c7e38a587b8308a8b39ddf8e52c58736112ae670bfb34013f5000000000e8000000002000020000000a69af2483190e2777c323140911bd828127e4d2d35fed8c56960b3e31678a1589000000088f3b5ae490b83c8a444cbfad99a72398ad9712a20f54cc466d079aad5a3dd5f168e138901e872dba18bc58fa164c88b93c869469e4fe922ab6a5ba0c6bbb3bcfe4373392bcceae68a30a3980296484afaca0c3d4aa11aa4f872ba854bc4903d8cd005db64709ff61ae33c7573176c141ad1fddaed8206c669c9f47ce8130fd4052e8631ae397a1dea3fd309aa13122e40000000de48a0b5c20c684fd815144e80aaf2a3f55139e65e1eaa5c4bf6ab78d14672d5decd27ec9cfdea34b7eb6d0d137ba455010a09729c034481ee61d59cc532b82e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102ab4f35fc8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1336 1996 iexplore.exe 28 PID 1996 wrote to memory of 1336 1996 iexplore.exe 28 PID 1996 wrote to memory of 1336 1996 iexplore.exe 28 PID 1996 wrote to memory of 1336 1996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1513c29f8084be111f19e8d1b0230391_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e900f10871a9de75c976161d2472a6d3
SHA12e289702e56e79d46428dc55f87e5c2599be9ddc
SHA256bc6c33f9458ba9c7858a5d1af8724243eeefda0d66180941938991768db2fb0c
SHA5124165c4f64fed9151e9bed90d48e47e25a9860e8a8c10a1cbcee727fc4d974b8e17a9114d4971ea5649737149518ecdd8fb44db8221e7f66dc3b3965a6aab8658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d8befab19d5056a90a3c1380f6a09d2
SHA1578de4e3d74b3f6dabd6db560432d33cba2bbb56
SHA2563f5d1b81cfec7339fa3fc61f69d4a63cb3cb1a4c039e2cb4f87af17960db65ae
SHA512fa729f6a0f3ef2ebb437d09085a5923a7fd508e96e91da8415c6d016cc9ee9550a208fa6c48b792470ba58fbff90188bed04aa8960bf1eb64456559e6aa356f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c29c1e65edbb44f56c877947fd4b0ba2
SHA1e1c891687dfb7d294eefbfe4f5ecde5d2d243344
SHA256c9ace7c2f0646bb8e6191c0185cee86e6971c173af40623870e43ee790262577
SHA512e5c718afc122e6bda6e46a1a00b241d01498794dd8054b36f350cce9cd32500a2cf4a9ea3f0b9325bdd23ac1b991418b3314454b6295a416d7b24e70d8ef8a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5509b8b42991857f65abac4c45f321dd2
SHA16487bf176c30518e65f195cf2d7e32aa085845dc
SHA256fd2f08218026933c1d98da9843a5e7ca1773671efa13b92c45f434b7f6a577cb
SHA51238c4d2c8346b68b066c0876d9618c22b5959b13ad387d7cb33ee787b66b1080502396eed369063860be2a974470cbd6092787e6c34e9bbc9c538206fa86ebba5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d63a3b457e0744fda294e630e7573200
SHA1d930dd30911a3876d4fbb2d27886fde537f6f5a0
SHA2562b1030c40159bdf5d6d504ff42eb621917b154c221d96f517c9e6f1db71cd986
SHA51281cb6d0384f83a91acfac445da45656ac01bb781a5110cdf500d32962cd6e21a55bb254204e71dc66fff05976641ec8df2036f709c16c593545487025e663c51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52800643a78399ad1bee1caf54eb77340
SHA18c4d7506d8a8148f26a4710ef3226ed47e014d37
SHA256570340e0e714ea75e4ec497d5ce9e93a69521f350af86a41c14773c242ee0f78
SHA512e005d7c27ad26ce8843184edf25eccd224893a703de458838dbc3452890e4628c57f68a0ffc16e6a6bce042c44755ec5a467dbf9c062748b4a31bea4d1922a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e967e043f0fdec5b95d69dc4172a3594
SHA1e09c0a467212346c36edaf9e09f1a125e73d528c
SHA256efd301fac87aff478560f85ceecde5f2a94aba3d18f921d1c47fa4d1f4ff725b
SHA512e49cbe474d4e0fb4815a05590fa41900af5a64b775ec20383cbe6e561a27160efcaefd0f4b4b2b0130721f700166a0a1ad9b438b2f39f8b232b74c97001486aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5921b129cd698e66de69bc0513904c74d
SHA105df3e5f1d02744fca403678a51f1d431f84555b
SHA256e357bd241154f2e264435cbbfc4c673dc74aed85267511be975439ef65018ce2
SHA5123caa503f7638c171e28bc637db6032be8a65431be69ea7d9030c4b7e1457319dcccdb0d6518e60d5ea77d171e0a639e3ba797b460fada2befac44d508dca0595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576c427328c2e043ef11c9848752426c6
SHA1d91d558d9cf6bd7717a0d64ad019e9b4f6bf8083
SHA25636750b7162539e6be481850473884c18ba331f9a913fddf69d21e82aa2b3bcaf
SHA51294bedb9e9f6232ad540067191517e9142ccc88f4cac1d6f6e69684979b4c1ad80c5cabcca044ce58dd5e6344c276ba49c71e25c35ddf193355657eda329b9616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58105141b5693ce8e27b467394d4eabd9
SHA1f64c0b5916e52e304bae7e1cb48c3079f1a1baa6
SHA256dc8f93ff98e861b7f67e9ab72932b1cb86f0b2d17f5328aef457560d47cdad2e
SHA51254434c7021a06ec4642502dd6912e7c82e620ff9757afb8d26dd2c55c5220afba03c3f9e76f444504ff736b88f59dc5b9fa3be95e8cb50ac5c455d1a70a9bf82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5369dc03067dd19a621465b3572d7c824
SHA11ebed67e365b01e82a6d4c2ec9158a7333e14f62
SHA256df6e5fe91ba7ede8b27e0830a76176e396afa695f02696081f869338c8fda142
SHA512d2ec33ec07199b08b269d352924591d077e66e7d4e38681d90d3c6f3d096b0bffc678d58db761cd1fceb3cb6e58b0edf5919cf2f4ce582283f983956f33ad6f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a2d64be58f61ce0aed6d1de58bbbe37
SHA1409b090c7d54d90e27295642fdd18c744890da3f
SHA25679289d0b67f71c05c1fbd0463b8bcf3259f5352f1b4dcc2137f722ccf486678a
SHA51257de0528bd841bc07ae7b53ebba902c5732d337d14669f605c8d5a4c2d3c02d0c95ee0fcb0e2dc7a6e4afc6dcd6d2a093f9d1cba2e5caee79508335822027f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acbf3139732dd4310e7b718e52572f00
SHA1340863d61b1e4ea92f002e98b725674ff39fa9bf
SHA25626c63f2c668d86fb2268a97d3ce186a902d208b65c4e44d4c9c2e48d252334b4
SHA5127a25c09ebb922a279c0361b0fae024bffcdc92205d350b0e5066469bcfb05a6fd89ebd29fa3daba9b84a1f5a209b288a17c07dd082f5e7b8e92f29829ded7bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50438c5e0cc6178306b645b3fddef434a
SHA18a7c6ef26370ec712cbf07faadc4365482c10892
SHA25623c75d33778e65053bcb1926b2e426aa347c2d58d705ff8d95207ee8e456505b
SHA5124c6d2f800dd9e6808afcfdedb68686e61c83b306ed6908baade0d178d1288cfdd042f4065319d45115846138544c7e5449c7dbaf16c19c6a0288450494a020fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5803e8802f156aedcd8222e1410f34b9e
SHA15ccf9de0e0e34f04b18747b90ee8e9a98269a075
SHA25635e3714d1a06ad77b2a33c5d77636bd1bd66349d274d64c5c9e0f00589996946
SHA5126da108d91850e89f48a2d527f12fe1139ad0cb38f5f0caa8bcdcb21ada76c3b4bd1a004459b2ea2b13755fde86dcf3564fcde6f980b3213692639e64bff48313
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53360e74e7fcf2d71dc1dc17589c95bcf
SHA1a8e31744b61d891b1fa2501212afd1673bd0c79d
SHA25634a4dfce284501cbf37c9ff4a8d592e4adaaeae0b271977bf09ef57dfe3edecc
SHA51250174e3c193a8c5a3212af5845bb5f324cea41380f4649c479f3852b9b5e0b99feddb759fd3012b6b20421cac521c55d9e3a4fc66843d79a8170fb0b896d6418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc34190376eaa33591200d223172e720
SHA1c94589524bcde21f68c0e871ebb2914dce4d8c1f
SHA2566a407eeab165629bbfee08574bd0c53a9435fe56d90e710456d9deaf12759567
SHA51290517bca2a9f358052e136951419e6a9a1b6125ea34e5987f4507991089481f0cadbefd042cede8f4d6fe0931037002ec3a8f74f81bdb852f148beca7a6db507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b86ea68e1ca67c5f255c63cd022acfc1
SHA1441a689650013d4711d1ee87f5126bec284540a9
SHA256babe9da51e93be73c939aeffe8c358c69b013e7169606a224cc16665d5386d2d
SHA5121d9951470332b526262b1a7370ca70cc580dfad5b31dc9960e4b2dff332ce68db899f7cf0568c590fb771d5cc87debf2cbf96c9891b76c474ffbc593e98aacfb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b