Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
19a3572f18eacfb02cbc447b4f569a84_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19a3572f18eacfb02cbc447b4f569a84_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
19a3572f18eacfb02cbc447b4f569a84_JaffaCakes118.html
-
Size
3KB
-
MD5
19a3572f18eacfb02cbc447b4f569a84
-
SHA1
62175abece5b1435403f0df9bf9d6244614dd389
-
SHA256
398bf6b4b387d24d11e4738ef2961b405d69f55e40125aba05c9d7850f0d32fc
-
SHA512
3dd24e1e634c8c4b0ab80b2b0045713b99eae188e4249e3fcae086a8f5b514625ed08b37c998c196f2d180db1314c03160187d97fb807c11a8a1a1383d9d19bf
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f3c3849d2e0064699b0deaa38896b8700000000020000000000106600000001000020000000bd88d7e02202c78f6d640bad4f8972d120e9d04722d4654fe740d8d4592525c8000000000e800000000200002000000009d538491cc2cfa0016ec7d25be3b4b42fac3eebf6f4e9a58d51c34c334ea021900000008566cf91707c1c6db3f222bf4c276353702e9082f95d7e1beaf3e6de21ac082aa4ac1cfb9d885209d0de1df8b71318d93c0b528f8aee50f1ff3d7de2c0ea4524b3bd05b7284b1435942df3576ec2eadb0a171dca5553baa693e1ead4db8b21d9c79c0df23638ee2daa64f9a9d94120b3d2b5e764688f79844ec6ae1214296ec1085f066b1397a2516971c86fc25b7fa740000000c77c0429c129540c18a70cec0c87b1ce114bfb66c50246166740cb033b3dd3beed32f5156cf334862f8339bf8c9830c00329d09f3d9f9072ff10c33c4f23aa7b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D157E31-3531-11EF-A34E-5E73522EB9B5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606c84343ec9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f3c3849d2e0064699b0deaa38896b87000000000200000000001066000000010000200000006d52214cc1431122b01a60dc44a3342acba161d7ab74d3ba2afa8812ef0dc3c4000000000e80000000020000200000006db673148fd2bab9c045e1d41097cc68716afcdd0d00219312a703854874aa26200000005367cff8285a7832c33c65f64a07d6e3c88931b9b05f098ee0c86c3fb2ed7a4840000000fff7367988f5045105e7f006a4c1b2e89a8f574b4db45a4bf7c2be563ab621c906a3f092b5f7fe1b11423df917ecc923c7f94b090cc074bc718c53df365ba93f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425729028" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1984 2236 iexplore.exe 28 PID 2236 wrote to memory of 1984 2236 iexplore.exe 28 PID 2236 wrote to memory of 1984 2236 iexplore.exe 28 PID 2236 wrote to memory of 1984 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\19a3572f18eacfb02cbc447b4f569a84_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec424f3c75ee0057f7ddd3e90fa5ca4a
SHA1cfbd1605196659258cbeeb32fd2e8e311bb7ddf3
SHA256215567eb63141ef35140e6a3ab3b90d4b5bac0f2c6e2d6f09c793a023b206ef6
SHA512f4353e69cf7ee53abfbb6afd61d8c2f23044a2112a36e07285ea38ffd887f30a0cb97fa94b300d7adb212f39c5975d03e7d91334cb143ecde4a345894352fbbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6e7ac2dd64e31382df75c446a9325c0
SHA11cde7d942f054b3fc622f0905f4033466b0bc8c9
SHA2563c47ee31e73c0df7c7d0a9f623602d6985f5a30bc6d4d71fe979b9fc7ad3b94a
SHA512617d3f210c8f04140af46b99053d715f2462dedf3c178cd245674a11a2bab1bdb457624365f01a3c00f13a1a8c4fd0490eb4015215de09210f28e0f684c88a80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0d026ebde5fe48e41ff78f139f234a1
SHA161d12006c1446175e0f858b59d2cc411342d4ea3
SHA2566745b5eacc80bafb677e9b3d05a2625f98f059bc27d2231c46442b6fdd04d949
SHA512be49e0dcfdd0a1d23c2e87516294f21d73e96d7c72d87040f19e94b9a363a605822443c004b700cd55911cb70fdcbda0791bad4456314dff97e7bd7be6aae219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9597d0181d964f0398546cea21ec90a
SHA100c4fa0dac63888d137a716d790ded6e838c01a1
SHA256c26373ceb67da35af555a1b0df388caf53f0ac7ae63902351dbbe76d2ffbbae7
SHA5124c54b801881c09b9a42e1709efdfc25108d269aaa2c18308501da70d876e3308c13f0721dc664b6c584878fcba7c94060002cac1ea4e69da3ffa5c0ed632b516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583706a326f5d7300a374073e7b94a897
SHA120861481c5099c320ef38e4c7a59160cb0619965
SHA25652d2dcbc562b55e89f6319d945fe797e1cdca406f2f68eb3d90e630366b14bcb
SHA51257afaa81f0f35836aeabc83cc10b195c5f3f5cb33e2f2c98fcf30a0d17310012c71344452406315830f3fa17396a44c687eec3d95a93c04996e5b8e36d0dc929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5468d6fc8504f01ebc8d01f8c86a40601
SHA1b6f0a66455c575c8d45298d2b324699e8ad4323a
SHA256260b1689e25e4f1a464669769e2c8bcceee6ac1310638a98db23493f82893882
SHA5128529d7c739f04162f82d6543696106b9bf4670fd2648b5bf1c3c1ae548898aba1b519a54fcf925614d17e9e5d96bb2ab96e0e200e1c188bc4ecd171d90cd006a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f4dfe9d79ff5c37226d15d9c03fe952
SHA16e34056b6498018b7c6dd76de2f6b5d252c8677f
SHA25632b0291c19bfa8c93ca7374d05e80cdd82d1025e7bb54a746aa0c7ac4c4a4820
SHA512057e969e1f072fd60fab5003b50e0d683f2cfc838834f11aa5133a0f76f19847dcfab048347d65da98dbe37869f55b496100f50e6de31c73d22952281a1db1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53357c15e700df104b2300365f2f40ee4
SHA1b9de233a9052a53da2b6d26d1f3f97b15bd13f27
SHA256d2e752d668b64356f036665e5da11479c82e2d262a2851a9cc2c0aae1f6f4c57
SHA51229eeeafb809c1cf0144a039d711aca496c81bd03e5665e0edeeb8a99535dac4e27007334fb2a1c0c791753681933e605b357e7d27ba149a03fdefe0ed5961628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa8fb295d5767204e1f13d8487673c6c
SHA1eddf1f8830c91438d7c21ecf3ba63feff7a07be5
SHA25619b073591a5384a265a8ca34ebbb3e2f20c4ebb4d6d1a8ba3f9ed98bb0ffcd1e
SHA512d4dee1323028173437e2a051c63bfdf8b8382b5b8f4a624bff6a2b68fa1752fc6ad768b5babb97abcbd5e79597a837504c0ccfa0d068a0220ac5a0df2cf9a299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acd280d497f79e4c622ea4b311bf43e2
SHA139d4f23ddaf7f399ff3934b4d0d09c10b9fc9010
SHA2560ce5979bb1c61176e06111d32e961b92eb66375292f0d3df5953f9f443bb4aa7
SHA512200726a59bb50e32a1ec51e8971ebf780772b10fe51bcb92e7ade1969c9bb968666bf55ca00e2c8b140ea6072fa9dfee0e0037625119b3d42faf13155a8b2057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfc3053f7c2e50593fcb3ea5749ec480
SHA1e1caaf7b6dfafcf7c54d92877a0737d49013966f
SHA256d349181310d844b112d23fe0f608280f7641a0a68b7c9047a915bda755ee5251
SHA51232098eb365048c29723e9c6046c112e65af71732674b12d59461af578f3421ba25277c92f490d55bdbe8775ed8790be0e95f7781ad6b009e00cdac20404b4226
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ccc1d4234a37f848863c7aec057016a
SHA176b6be96b6f39cb69b9c6993d1eaab62ffba0334
SHA256a6c617bfd1653f818fa5c506059e4ba517e8a5c118bc7759ddda6980da89f679
SHA512cdb3892c99259a5e4ea92360675d9787e207d4a087164741640ff440368fe0edd0b3772b0ccc57cfde76dce89e63beb16ada81ee85fa44276d59939b81d5a620
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c4da840566eb2dab37ac74fac7ae905
SHA13f88db69f7fd54fb58210b1d68d28085c4966894
SHA25640d618bcabca23785cb81cdeaa34a3e30ec7083129e7a0b9e53d0fd215f16799
SHA5129bbbdc4958c7480146fbb39abb290a8ad4d11b7c6f3c1b961b4224115f977a2dc47ea05d0d6be41fde40e2ff6446329bc9cc51dfae0a6d01150a94ec9c3c29a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cf7e2e97f9fede0548155d1d297321f
SHA15eefb728474b88dfb64fc4549908f6a93464e531
SHA256e3e5ada22b25ffe65088cbb8b6d805fa6b72494f8185e6a6d25186c46a3a7860
SHA512a05eda1185b34ca5e0de30f59891479b89dd8aa549fbccd1b64b576aceb45409f17cc1970ad4319ef8d8a0faaa801696803f59d56ecc31686aba67acb23856c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576b01222b67cdf066335f08d6ff29525
SHA12c64032fdfc9a6179120b48887c0720c66e08097
SHA2562699829cac231330d6f0bb9c7dd0897a6e1c179ae126e8ae882599012c355ba4
SHA51297ea5a001f38d203e9ddf900b273a8cc4496d6bbd4d4a74109d328bc5af0b209a69a6204516088e20de7a6b0e735d7188b267f20751252f4b402f219042e3b33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd04f44894d01461ef4f0ab43e97ee27
SHA16475fa21d65749c92f90c1ebf5d290ab0e9b0173
SHA25613312cc7c7c2fdb23660f474c3dfaa2b8e2bd6ee0c4f5ec66c77c203dd920186
SHA51223e0c27c5e6930f2229cd0943569efa7064971afa209c761feb772e948c237bc10b9a19b7ebd257f153a8211dde3811d518d0551dd92c05ba99d3b94f225fb65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac69699cae908519b6db64c806100075
SHA105feb89168e59fc49f544b5413b628ad41fb98c5
SHA2569d0cef6930d813d0273cc66e66a5b7b10f00547f92d54004bcbe3d53c6f34da0
SHA5122152fe891dc0867516801517002e541a9b2111e254ab29cc8e911655b0f86cc06ce215714edf2b79922a5dc5d33020fb003521f4a61d424af032d5098a18edf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573755c526df6653234469fd37992b840
SHA1be3b2e0c3aea05a5d4dc53efc92855715ca5dd21
SHA2562550788e264b21196f3fc4cec7a6a56d98f2b984fec8d593104447cd41041852
SHA51263e7efc68650c35450f021a29dfff5a43296c0d42a7e0b943cce738493793c659284154bde2f7256da9bf472097dea203d877b98493f6f559629e97d77c4d193
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b