Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
161660f8aec2922515358b0e23333bcd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
161660f8aec2922515358b0e23333bcd_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
161660f8aec2922515358b0e23333bcd_JaffaCakes118.html
-
Size
9KB
-
MD5
161660f8aec2922515358b0e23333bcd
-
SHA1
186f7b1b9d0c85abe94ff2462665441bc6551a7e
-
SHA256
ebe70d20a74f5731465e21d6b1a5404fcd1c5efc8c111c5a1cb165fd8526fc90
-
SHA512
e9e14a2be402054f51bb1044416943488dd71579e19d05bdd3972714d094dd8f48e1431cc43811ffed17ea0cde48f795471964963495941de508dcc74cc6ee29
-
SSDEEP
96:uzVs+ux7S2fLLY1k9o84d12ef7CSTU3wGT/kPsofpUlVHcEZ7ru7f:csz7SWAYS/ugfxUPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7F0F371-3484-11EF-8414-4A4F109F65B0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b9a9e5f7d0708643b789dc2a1a81912000000000020000000000106600000001000020000000dd201851dd7808f4c4bfae52e4535b2b4e910c32f1799ec9a033a1acf2b5766b000000000e8000000002000020000000fba991e586134d2c46ad57f43c56bf8737a3f12fb3cea33ccf95902f099835d69000000086811c57b302986a9ccac0b2ad3f5c4248eb06cc29ba9f76d144a3bc7fa28d7a98bb78b71540f7eca970d3b9b1afdb1f90af2a5b4ed166da7f6f4704867a55c944e2b6f6726c674b476c6390154457826e95c93ec5c009a1945f96f5a2b34adb508b7257314f5b4cb49ac76db7c190a047b9bb6c73a6d35e47ceaf3f0fb0ca06637f3bf665fd543741bb8fd4595c3f424000000025365d72e09457636afb01e73c86ab4d34f13d3a8f019ee3a401efd13666aadd6935ed7267696cdc80136f0e509f7724dc1fd66e5a643dfb1d16a3108b3ee419 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425654958" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b9a9e5f7d0708643b789dc2a1a81912000000000020000000000106600000001000020000000be3bc41e7c5ed30c1f23b4f9817896f95ec80baf5d4f9e4946690ad81c5f4d8c000000000e8000000002000020000000c5360e22fd07570d6e16efd1d8f1089c662eb7ca72623beffefba6b7b797e40b2000000026cf4a4e39ed6107853f059bfb67ac6448cef0bc2ff5e016b5ab8f201b2768cf400000008e3e70e73f62ee95c21d7e7d855c2a76dafe1ddcf093bad69d0efc429635fca380f6c9404dd9a954599b2f0f7220cbdfbb675a75f3d2f1f2c21664fbf9ba3860 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cd1bbd91c8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3012 3016 iexplore.exe 28 PID 3016 wrote to memory of 3012 3016 iexplore.exe 28 PID 3016 wrote to memory of 3012 3016 iexplore.exe 28 PID 3016 wrote to memory of 3012 3016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\161660f8aec2922515358b0e23333bcd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b78d68f2c930fc2bf04c3bee3c9cd42
SHA1d9f4d992df5f2dc24e1703aff6bd887a830bc099
SHA2560fd649c25bc8de7b209dd8f64a47d6b459d0d6075a2c0de79240c4eff45f0159
SHA51269d161175249b504d18c9259d791e6f7312ad2efa6e967a1663d7bcd9db527ef1cc590188abfb8949d3dcc5fd726809edb41fd318928247012ec75b51fa26fc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dc4065bae9e3f099f38c90d487ebf6a
SHA1a5e5320b93c97ce8d34921d64c63b0d11027926a
SHA25669f933b70e9ed7a6812e8a0ed361da050cc92666f160cd56cac193c046486b63
SHA512101cd653fd69a3c90a6d27113bcbfbf50e338006eabfae0be385f7636b40ac7f707d717bb5d6dc8f77f5e757e02a2721f99daa31343c2097a3036c1dc22b1add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583476e859ff3110cfc0aad92df4d9705
SHA115e669623207849354ea9ce7c2dcc8c3356db0a9
SHA25694274e602f87fd1c1076c6df0470ce27e3d75d7ab161b17c3edd498ab49b3e60
SHA512ab315f445c11a77e8cc3932bb405a97ef66062a8bf5c75c4fb374a2dc4a4893b77fde6f87ace9c1e024c5a1691d27c4aee00fc5c8d84b4a9e752639793f9933a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d37168b059bdb1e9f6a01df4ce5f09f
SHA137485d84e777fe1a2b3b4600ef8972ecb51e82d8
SHA2564e6d7321aab5006d47556f046e6e5ef1316393258af7c8613a0e35a931987cce
SHA5129cf960796897aea6e01df556150fa409826752ba61c3a62890a80ba44423dfbe26231c9dcecc222120ab80fc2f44f934bf9e2c759a8c0147e1799d015e74eb66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af4d45c6675777a1c30cf6849170b557
SHA1938622e19eb038287ba17cb5ada09ad2a20988ce
SHA256b2ba5a3f73c0bba8121b8da04b3825679f03a7965cd1e45708dccce078b753d6
SHA512a39e48141e820bc267f8f1d02c2787a7af683cee6e9aa60ac6d3f7c4a53b2d1c0e5ceecb281c6579c430b4faccd87d120e3f366d1fe5663d6afeac2c759fc314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de016acc8cb4f35fd5193b5d2297f00f
SHA1d079a4ee8f76e8780a86162350e07afde29dec6d
SHA2561b9f9eb977c4d890109f432add9fccb30e499d5868f498c3503d54f17980d85d
SHA512afa0832aa512430434a5d0823052c61d20c474ee31cb0bace01d20827113d81ea707ce6973eb58272786a4fa0f2464e80ecf378b19be1453c72836856d6b5efb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588072b59c9d254338f08b7e7e1f8d2db
SHA12ee1b0c0411a56429c8068ee3a4114acd4163636
SHA2567bdf82e39c1ae4ed4b4d4f1a84f2e185c92e0343b82efa4ca969cff8642c0bb3
SHA512cd1793d821309a80a2e0f7916361e017a466a323e648453b10e4afd0c5722d9d5a79c2d5dd1036cf59fbce54e4e146d720e463d76f9dd639fd643084a05449b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502329f2e8ce11a53547c69fde2b1fb57
SHA160fec9c07a6db335b9b5a7c2f756577d04c6fb8c
SHA256a9b1290a03ac5ffca0f4fc38f0a5c4c643e7c70f3b0634710458534bc6a9480e
SHA5123b09f8a74b5e6599f44517c79d3674552d7116b4a5c45cd8a07245e6138f126fad2885d7ff00cce50c2e6238fa5456102bc73c3431b8cb6c367fd13d0ce8ab8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4913d859b588ea0bb6c856431d02f4d
SHA19e3036ea84b64b229e693ab9f8aa5f68ae3f5dca
SHA256c3edd44bc738635cf6de9d6d8c01c15f7cc42e9276cd1821d889b2f7ab00136a
SHA51218373d0da636191b983aebd1a0e5ef173245bd7bf60f0733889b36b62f40ca71fd662f5e10aaa12e33e7b729465717e3f7f24438a8615e180bb3b1c9d4a297b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51df38376434ccea17c5af398d3bc6e45
SHA184907251d64c01995591a27608e9550c33681477
SHA25609be115a7f09bc85a77db7883fae4cbe5dba820cbc8c40606a951924df80e053
SHA51265b02404c14d7cbe6506c0b87b7b644352bb49d1ae558c51eea0438b39b71fe032f732c6877070a3ab4fa7e4b92e2ad0ceffd22e2221e0a933f7dad62ad6d899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8b471f6a3785834570e5362dbfe5e1e
SHA1cee4c44c4cd911008fa8f85693f8ab21580e7fdf
SHA2568a8b5954440e07486af73f639d199a0323ccd263229e8077b858e4fdf2fe7553
SHA5122ce3c70e3fef73c3edef97b5ccf64f5f47827802702c7fa690efcb1e2e94a27b3726d7f3924bf80dbcf673d31f8bbab88c0e5c5e6587e5db582a07eff36b4dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bc7c1f10c2002c65655af4dbc6d55ca
SHA12ae3f62c679de5742a4db4b233096ea7179923ad
SHA256499b9794823af74b141eced714fc78d395da1d9e910eb98b1c49259ec48e9f2e
SHA512c9da86c478f5d6b8c7393e5ba1f4729b20ff0516419ec7792f848ec2d655be69c95a629310d5b244f5009681dac265694ca13eba59f3541350fb165404d4c425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce48c93b0157994079fb33ffe15c0af5
SHA1f83b10b85e44cdcc3df3748536c2e73825fd5d11
SHA25672af7251a7b9d476dd31e50048bd1874092473c7b97f3f62c09374c682a64c05
SHA5120f94222d3e3c91fd666a63a4afc9ec093196458593d1f5069ea98e3fe2aa32747f6a54de3fc4d7ab853e797f4938d5734acc57ddd0be8c0d6f28ef8542737d39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c8487defc08ef278e09a0f9cd1188dd
SHA11184e7d1b49c273a10c38e7c2ef06f0656237bdb
SHA2563d72a5e7cd5bee2738f5541e40eea416e5a553e2182bd4433864e3e92bc5a877
SHA5124d98bd6a11b065ac726d78917d9bee32ba7574e1822a6399b4a905d563f3aeaa2cbd2e6af9f7248c78f4cc625d96e8c1807e20ffbd64a1c75c0b6c9e314e81f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfb95c90819687f8a47e65893d77b443
SHA176fce17f4dc3dffe9aa97ee4f7e0bb73a52e77c7
SHA2561a51ab26416a8ff946faeb8e9bf60e002b415018b5c2dcbd18468a294f107844
SHA512c9e7036ddfa2ca56f8495139aa1ea5493ae590748bee26267c16016404b7618ba46ccca3be78481165ac8ce6aa8bf85c543128166e5a5ba0570c677304dd3976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50eee4924e94872ae1b9523b46323918e
SHA1f60ec6f4f25fee2de04ba11d2d8102ca8d7d1dd6
SHA256f1bd0468180d42857cdd7e76b8dbab88724f6276dee36a94f48beee0c63e2d3c
SHA512fe6788212259a71c069f63de06e0325e23eda6c75c0eca2a1ec7d0ab829a8ab7c525ee8b4b16ed316ca2f268d1c71fcc684342d4191e97f8906db3177c3455e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5960fd1a0b2d14b330101595931c887d4
SHA1237e6cea01966e8efa4d229587d9399f14cc68bd
SHA2567220f233be1250f2be56a62fc5b26235ae75f7ec1c61e8ddb6a002ab5b22254f
SHA512d42f7e106dfbb7787627af27c439649fee1b28655d5304155250e68e85f16976e02ec4455223b71948e6929659a259ab14ead7b34d859c053f85b797be2fc71a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b