Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
23259a16828c12bfc57cccd32a4728eb_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
23259a16828c12bfc57cccd32a4728eb_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
23259a16828c12bfc57cccd32a4728eb_JaffaCakes118.html
-
Size
18KB
-
MD5
23259a16828c12bfc57cccd32a4728eb
-
SHA1
436122597fd5e1729a0374d8e0a7906f63138f1a
-
SHA256
91aa376fc190cc898fa3d1cc57e32380a3a08f1af430a026c7cfbf4c70c4be7d
-
SHA512
88cd87fb59275c22ebb8082a41e47f157c884a0e26b47952900ea63b770246c1924049291cd6d48e13d48e8051362ad962e0f21acc29ecd130640a9adcb48618
-
SSDEEP
192:VQ5cVZ7oxovwLJxFz9k4ba08EFhI04YLXdqdWZSj0VuPfcyCo+iXypzguiLallFK:e5cVZeVzOeMqqdWZSj0VuPfTYK
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000958c571ba38668343185bfe6da77d22456800c802bf83e28a758408aa277898e000000000e8000000002000020000000889dcc05fe52572e93169d5bd5792753180038a7b4fea5f5ee6146e0249fb6d5900000009b34c0b13aba4eadba172b6c50df91a4c143087feab6a84fa04486edfa406f37af583259fce8b5b90542929e339087b57d830d6f07683637a39726aa012170ecc681ab93948fccaec6f47a1906980506959de01fa9e1ee2726b40b1b991470a5619d64f340052919299dbffd1ce639cc4d29e7a8553b907cfbc108203710bc7b557e79e60279dfc8ec3065b0f99f2255400000001c8888df960a13be86c7a8f90b68f8a3587d8d4361698aaf23aca760dc08c6921e991e8640f2274cf25d23b3c621b7b49239380dbf3b42726ed4ec34f875ce6c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1BC00E1-395E-11EF-AFF4-E681C831DA43} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07ecd866bcdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000026f94ef325014e1a0d823b9c0c9ac6fedb7333e620f8f2a6d0906b5d9ddd9b1000000000e80000000020000200000002fd48ad89846528ce7a4a5baeab3a80e2711d7b1e46cf12dc4e731b22bea5880200000006fc10c75c73fbc76c6daeb3f1929889db3f023a3d367653158d8519c4f81995240000000d51e8061b8a6d267a3c43d0b44794578fbd0a22d8d5cbab9ca939df107745e6ce8d15799c7865da41ac44f592f727375f2a7130430686d3b7476994e1f32784b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426188302" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2724 2440 iexplore.exe 28 PID 2440 wrote to memory of 2724 2440 iexplore.exe 28 PID 2440 wrote to memory of 2724 2440 iexplore.exe 28 PID 2440 wrote to memory of 2724 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23259a16828c12bfc57cccd32a4728eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab7490b844cf054a5d8a91fd4a5ca1eb
SHA160c21a2db05969cafcdbd70ee6d96108af635411
SHA256773212f046bb6bad8071797d12ae037b67fb340a1906bf0976d1de42877627dd
SHA512fda1278d70e5c179e68583aa4ae885cd836e03c2516068a8612e1c459cf5f6ddc862323acfc3be4f2135d112a77d4cbafbcd132b4b12f9df37036ff7547b5e24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d41412c1bc4b4308de05335bfa390490
SHA135536c36f14b64eded7e4ad8e095829b080d1228
SHA256897f1f3943ae56bcc8f352002c02f33b17d20635a88240cffb514d81034e743a
SHA51266964837b5b2ef285f605a0815af9109fa3d3f332652e6403a64f89774b5ab6320a79b53dc3b6bb04ec5e1a070a4f6324d1dc16118cf565cef6f68966f44073d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8452e58bf5c4914db62873819401203
SHA1d7a482489424b0bbcb34950d8a339e498b65da93
SHA25682d3888038eaedb0bec175dcf16131be3e4bf8adba48102e4b7b36fbb43777c9
SHA512f754ede0b2ca3b7726b4e63adf1d105bf7750d8bbebf6ac856a36ce5bc1002a90cd73f95ab4ac0dbf6274b377b6f5d6ac9fc0eb1a7433dc9dbf368730eb9f88c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511627debd00c114e47ea058ca7bb6268
SHA13e2eb015335ef5cdbc08b1c55a3f192e4ab0d59d
SHA25629f124d094755be5fea201a92abd729ab0a7412cc3d7bf71a3a96d5dbd6fbefc
SHA5128c2655b21458e68b8ad5627aa2fd4c2534070179898e5f7299708011f3273d2064710da5588c86ab5b0d8ff2ab62b3ded214ed7de0dc9f04b8984fb858921cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b383790150a6c0469bc6d91ce6247451
SHA10cd0761102acbc72801a7910abc943bf48fddd46
SHA256b038f42a7a82c4bc17a88aa1f8a80f1fcbad6640da8e3937a611ce349c349aec
SHA51272fc0c6709a0e37cb9bf42840da3981044e48c92c736a445c826c260cbe5362782a78b5d3746762e1bff1e5be7af94b702e76d7f8ff009e510ec8a339f689f24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5437cc219442c74d2f6c792769749eecc
SHA14661d8ad2e0fb398dee0c71d120a6bd9a9ea99eb
SHA256ee6a698aa9cb93b1b4866472ab442b7aa9d7e217a46904d4c5334aaaa200743f
SHA512a48170ec6656c749a8b53063acdb167c155096d91fcedfcd45654794c1e0eea0465bc816d8bfb29a4a359722cb2fad80553902eceab32f383a0cd9995919e295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524abd387cafcca0cb6c99c35f5a23049
SHA1f06cd2f39a540131c74fce7b9709422a6f7237ba
SHA256a45fb2dc2821afef041fd4a72cba682721deb7920af3f147a41b6b2fb6412697
SHA512b48ce194037fd354c293bed84e409ad67ee2c20f9a65a5fc52c3815a4d41846a01d4dfd0d5e266fd856f97d27abbb8aa3cb9f683e990eb15e178d3d4dabebdc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5999f5145ea18bac72696473e4d32a967
SHA1f763b3262cd254a27ceaacf90813ce9a20ce6d5f
SHA2562991412b05867b4ebc72dc4770737bf4ec6fec3a49ae7b3bf23a207336b149b7
SHA5124a829afbdf2c36e07e8139f2b1ec4831db5c654cbebd539b52e4f505b76b110f862c1d804618e86030387fbda9507bd3af88bfac0f8126949798a18dc7ac104b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac74c889b83d45b65cb901a9b4f571f2
SHA1b7f2e0e21f736935d54aee0a3832ff7329a71dac
SHA256a46fa868b751f5990aaaf15bac32b9dd5990a34db0be12b9c040d14f1d9a4cf7
SHA512c1b7d355824225bb1df720c0d7496424ea768813900ba71eb35146cebc8762786cf24313ad5762969cf60b104eda8d105ece35a44bc24d4e8fffee1349afb75c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d0854b1cb7beb63fa06b2d4d9ef8994
SHA159c9b4d9db2f4bf06577717a324113df36cc4c27
SHA256ecca871f94eb5d40f519692fb88d54dc1eb41a103616fc71e9324b761237c85c
SHA512149ace38cb22862fa24cab7ef9ff05ee1d9ce01bfeebbfaf9d482b34540778ce3b2eb99aa046327737d7c38bae87876f792ff0bba3e69520652668018fcf86af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fdf5a96086eaeba6daa2a522e873fb7
SHA140a4270bae143c8ed405c4e3a80387941f098e91
SHA2563b5a1d919f70d6912af0d52cfebe8d172d8a3198121feb1d8234264f7935252e
SHA51224f7795340c2373ff21b6bb9483f224691a652e3e646f7f4b384f684dccafe7c933e9ec8955210bf90d5cf3b2dc4c37a19373f4291b71b47e5931fdae2a1de2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e041eb0b28f7675aad70358bb37a16f
SHA1520f31c4592980d4f93368674f7f0002c405f523
SHA25665480124d1f6ba4fb18a4bdacc37041a62b4bcd70d323936ee5adb21c5ce849d
SHA512941a03e4e5f7f66829ccfbaf699363d21ff25a110df6025d21895c3726fcbe6f7cf96857762054f599f77acc4bc8f555d754d4f78c80c80f543d58c45ec2f19f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab5dcef6fa46d4579948e037f19e9405
SHA1600ec1d7a24d40ee7a4867c594e75d0ad2e6d5c8
SHA2562cc67336dbe03d70fbb7725fe524a20b44a9e6cdffb4d56510999618c3f6dce6
SHA512b4c39b52df66c2333632f9b32c91443956e77458ddff6f1007311f26636dfcf213ab6fbd072eff6f026c7502bf75b0731e083733f2e7e582c033b3ec0bb7651b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daeec401151f64f72378fadbf519d9d0
SHA1f12307ddeb932c359446ac057db543a05aabade7
SHA256844bd6e797586e92dc23e6d81178f51140965bac845d010cb2440d79cf541abc
SHA512a9b53917e045bc89603618724465c3ddd5ef2166c671121844024148aaed0dfa150c0bd6cb21207668e14a917fbf400949794fb502ae6c6b491a62078f104b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5234f355e8aaac4afcd8813e8214b09cb
SHA1e2741304699b73f19582221e0c63c9a1b7365a8e
SHA2568171f9ef0644f20ca1ac0d40048c2a7bb5dc7638d47e8799d88f2dbe640a5aa1
SHA512137e436ea28e15122742d923004857ce46909758253924766b42edaf21eacf01a9c61ac59fb9690439c1086864e5648270851680c08c2d62dadbdb47ef8f5098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537d725981e8ede7e6af21e63b5da1b33
SHA15d0e4660f7cc7f20394bcda7abf660ac435297b4
SHA2567e6be4eda486ef6b4f6e86a25578318bbc374571e1e1978808db0a86b824b8de
SHA51287d8f58e0bb52f0e239240dcccb51286e1d292d715af5a5fbe5bcf362beb39e5652128121204ff3e78eae518eda7b25f26e515406ade24f9cf7b73feb7abf61f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59003705daf0fb22dc9745bbd49485833
SHA1673954ceb7da36c7e890765e84921010e7a2f4dd
SHA256d17664c4e0e93ea5e983a19ba44793310f432b7c7a7e6d0ca4625ab620d8ca50
SHA512c8c71b2d2e7839b6d986806af34172f29df81507ceb5bf81dad626b19ef76d50596f8edd07a4468dac63eb81c9bfc9ffb317a08f2c1609a751c9f5e426d91de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e09c8589ad6f1aae1952fc20d6296baf
SHA13ab71a892a42e8527e1bc8a4259e931d2771828a
SHA256624dc961f69feb6a3b1bb43b59df529ccdc6317f778ef7261ebcfe32080198ab
SHA5126de096d38e87d22995cd59cbd364e9c29bc1fa9329bf721958a7000f119dc64da0dd034f65612d82117a83788b8f01b9f825f4e56fcbebeddcfbfb172b4a37bc
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b