Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
2690b5a34b0f78ad8434aa5b071dbda8_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2690b5a34b0f78ad8434aa5b071dbda8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2690b5a34b0f78ad8434aa5b071dbda8_JaffaCakes118.html
-
Size
89KB
-
MD5
2690b5a34b0f78ad8434aa5b071dbda8
-
SHA1
316473b316a10f340df9677f2c009887467f2884
-
SHA256
057f7c0440860d459e62a5e4d87c1699a9daaa0c965a45efe97c77f09689e3d4
-
SHA512
51c9aab23d6074b68de7a94d95eaecdcab6c81104727378f18f964c9641c6bd4d7f96a84f14c213d03b7134ef807849294a51cdfe4f2081ebc421923c5751667
-
SSDEEP
768:IoP6VAOAcjIHq5MEkFMadt8z+sQDpO9Kh0zSu33yhorTIorvYP4uRoGlInOKXKvR:IoCPJ+8N4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b0123267ceda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D992541-3A5A-11EF-9680-DA96D1126947} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004912514db0379144b458dd617f2b172500000000020000000000106600000001000020000000c4e0fb3bc802919d5d9f250f995dce793288f4b02bb0b6089dfd0127407357f1000000000e8000000002000020000000beb2ad2353b762e6a345464a2e85a5ad182be7bfc6074f23b681cc0956f84edd9000000007b10aa30457471ed98f95f778e0fd79e7683e83df37f27cc3f8d1f59ce77bf4f270cd9c0bdc6ca851022d33b758e50a68a369776203c2fe6a663e1511ed18722e2a9b4d4ef9d632378ec39f99577729974633bb179efe464b194dcaf62a9e044034728eaabb8e24e6e41f712b6f20c5a6c649032bdbf1d022c97e6c6a1c79b8151bde95fc7e89ea7e0c121217c478b7400000003c48f57ccd4ed80969a8845ebf53499d8a6194200151a080f032b7afd559f2a1a3d9e814d8b54e3f9b90ee2a1df95d5cac5260c4ef3772d1a52ab970c592619c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426296394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004912514db0379144b458dd617f2b172500000000020000000000106600000001000020000000631380307461dc43d2559a1fc840ddc88a79ca36818be58fbbf174d62de725d9000000000e80000000020000200000000a220b4ff16548f59ae481e1d633d461ee403c9666aa84617d0992fd38fd56b520000000d2adec2aa51616f4a605b697e2e964752b8596a17b10a95522e90b92b8df18c3400000005ceb742d78e92e107b3d4758567454be67641c4c3d0f10eec2bd38e59d4c8f7e9fe12eecbd6abc6890178a80c3ff55b72b2368cd01ad3da30014c228db1aeb30 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2540 2604 iexplore.exe 28 PID 2604 wrote to memory of 2540 2604 iexplore.exe 28 PID 2604 wrote to memory of 2540 2604 iexplore.exe 28 PID 2604 wrote to memory of 2540 2604 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2690b5a34b0f78ad8434aa5b071dbda8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5443d75a48df68a7393f1e9d381091923
SHA168c264dd9f20d1a5801f8cd5721f19d095c88bce
SHA256d5bf85beac0fa6da5606facdc8c1b47395abdf679c3ce7bc617d7605e435a401
SHA51203ead56dde1fb13cc4649d6fe5ce41e9d8c98d1c7fa95cd722453bf139ea46907c8c617d36788913de830cf7c581ac10e10db77fc055e9e8769439946046c398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53145dbc0d252515bca8b250038f8eb52
SHA1fbfe6c20b9e879b8f0a7d03f5521ed491b6b1556
SHA2568d4eec613962ed49bfe1defcfb72b0dd0d7b9853427310a6be5e3c60e0eb13a3
SHA512609291cac0ee46267aa9a257416a9bd85ac58848147615f898a19a9ee16ba5c62a0e983d8ffb8fa7e2bbfd3994717bd89ff3cbfaf8bb671000c9f2c3860a897f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e9ce569ef159a3d9e2a492acf391564
SHA1b97ef64de0fc15ff8bda3b2b3d9effd7a9b3869a
SHA256aea4e66c639d87e7c7ff484389d940ccab89d770de6fdb9d8b82601a778c65ed
SHA5128209d89ec61887a7bc116e4637feecea0b293d14cb962c53fc2e2b1de1903d19e85e75f4edaaa5a17f52b0e3c3942fc39b443515dd1c42fae420f26ec4a754e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505d8a9c7f9efe5e129b7e91716b4d14a
SHA122dcc3fdce98e8aec7bfd4f5e83fa742523a4411
SHA25683e7ec20195b3ddc3e853d370f8a296819e50f79efbdc2eb025c0d020c6db546
SHA512d4e5e27a54920ff5d557e1602fecc370d5a5318a91ad5396c2332470b01e5675e632655a54ff62fbe2411d8e680ba071f1631a243144e2e2aa0bc9dccede48bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e29c3085fd6b54f68ba7b17c1f2973e9
SHA16d32fc1164230710e14eed0f6ed7c6ecffd3faae
SHA25637d91d12917bcf9c3822567463aa9691c4795ab5b5a0797788b630e16b43c9b1
SHA512fc8a219320e7161ee88a854244ebb9f0b4b276c7db72951c8b809d9581f8d9d38ea1a63c8a6f4615b533daac3086e0aa0ed4a0eca4b2204bef597b14f8cc1a6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba31ad58a9530e332143b19a40550741
SHA161883c842c2ad265e438bdad8f960a063ce7aa70
SHA2562a09020fd9173da9197acf289c21ed128cb20becb4fea94cae0b80d463b293a6
SHA512450de0bd32bb3d876a96c2e8035acfacc34b4af5851858ae6e4400881928776deecb897fbe8724401d5079e60e5de096ebdbc26a4084b79dc8b4f6c4a3b6169f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc694a87834cab1c64ab16408872f321
SHA143f6371f90271544afefafe56791dee4eb773289
SHA256ec622d4efda4d1514ac34c1b197765014eed7e7e75face28477703f08b53057f
SHA51289510899514923760b3a1982dde145fcd6db07ef42d534322a6f5f94b997dc51b434cd7933e029a51a4dc0526364f16f340858fe39a08427fbaa5275e3b93883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548e82deda8f4779c87462c17eb227789
SHA1227be80b29b07d55d5282c990fe1f3b419ac8163
SHA2560a2e7f04f786a259926081de1a14dcaaab5e7bb957d94c904813bfaf2ad4289b
SHA512c80484ac8cbba68de6bc2978e8443a002f11b53740c05d2e4e21b8548485c3e8e82d0699a96f033083b8493926a87eac7b97fc4ec20f5972494d6473ab7e48fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ce3affb254cb3801a9100f26a8f0d80
SHA1e3fcbd71dd4a456dbc05c9d8c8a126c78623af86
SHA256204eb1810dbe305920d6062b5dfd17a02d6cc878237d7144394eaa602dd574fa
SHA512399a10b9c8505590d91c46775e396be9d247f892282a780b51cf53e1e4333c36a111d1d6d3c1b066c09a20eac0716c1a1a77744b2ad0e0f2d8b792f9da5ab433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d45f2d083b2e5e5958c262bcf37df8a
SHA1d2747bc52c80c528534785bf257279bfdcf92c87
SHA256df2bc6be7664b7da02bd114618706623d75be2d886bd418e194a3307726e3d03
SHA512f223923cb7c0db60f16339be7c3ded8945da371c78b11274645cef38867b0b9c86cb43f6db474a73b492429e17ab99f49cd738a7b35ea5a5df636541cbfc1e0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56150eaa7e83639a76befd17b358bab2e
SHA11948b7efbba5c08d21706130acaa973e814c2a68
SHA25697d34fb108081345a205d4f5880a57e822a40e3c2e2fd24c2d05cc7378dfab85
SHA512437761d596f9b10a81a44591755dc312581e3365964f292b2e61745c13552ee1dd90c672cc0b6704fbd52a90cc3efd16226e1c4e3a01bae0091840c839dcd0db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541f2b19e5109ca71dc76aa33a4cb065c
SHA17c8f2ccd6425aa839983b0c238671f3307e04517
SHA256721d5c082ebbeba29d4924086de7275a059a3643ef3c0ef15dcfbe310ae7fa95
SHA51209ff45f6a4314ebd57ecb4eb052ba6b6773ce9579e293bfe91a1f6114988228e5eb9acedadf8d6d63d606e3936d4393d7f8bea2319845a01973ac5e3605af9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ef8f9e69e1605091f09102156556385
SHA18a2866a1b820e37fc3b7e14873c4fbaf38135f09
SHA2560c5c43e01bd3fe1531e7318d1e1321f045e4b575202725ecb33f01ace1b8cf8a
SHA5120a15a7e95839efe77fdd791ee8d72cf8a4147f40ec280fcd38a4297139ee4749bff52788230d62a36a206a496d94c7d6e6ee247cbc34597535798dcd5da1b377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eae4340b6cfbb868b263b1e3f2926986
SHA1cf2246fbf20687b8694da565bf0b0e094a1c2276
SHA256f63f4cbcdb675dd45d996cee6a51b82ce08cb50ee0848b9e751e4cd5003c233c
SHA5123bd709bda3b3a11fc5ebe8c628d7809b73d9786835e2791d5ceef79642b3419648bc89e729babecb8210ce1b272d41ad1982b1f514f95785316cd218ebe72261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ac5227de90e40d5864e9f6bcda9492f
SHA1e67b574ef37348827d8eef60ac2e2c7cea17fdab
SHA256abb19916daa7ed985268e05fbba28e4a384143bebd0889e5fbf36ca17e1c8dd0
SHA512604cc37994548f0820c0d1a53640a720d6a725098a16a25f34e4d3eae318558ac48ed41701094b17fe7020a38edd4cc1afb92082ce0703813698619fb65d1664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570b1012f0ba4578f3b9e4fe17152d122
SHA1eb2e4cb9728a8fbae2d18bef45a3170b65f26ff8
SHA256d119b83422fd2ca47a2813a0e306c1e74ca7d11914a9630bd41c3cd8588c0922
SHA512b2f912c88606c5e9fa29d930de197abc42f32fca706bb8df24a6e49770b11447fbcfcf78dc817c286f5d995f3ac96bfa784d65a7c824ef93ba6841d9ba19e126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcd23112010dadc98c69e92e24f3502f
SHA1faa54af2f2f1eddd06a015afed987c9a4fe6e3e2
SHA2563fc71f2d28b9ef02f59eeabad5ea3a05ce65385f0928c01df910304b576f96ba
SHA512dc720fe4acc25330c57fde9269ea942d18ae5316b51afe0eec2d80568caacb2d2c7d141dea2f4e97e609cfe60a51485150f711db356cd5dd6409d7d84acc6028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5590484f2e07efd51381af52e7d51b58f
SHA14e9705b3a4015d02638e32b5f84b96ac10f02e8c
SHA256471ceeb06cd318174d6fe9a524f7a33c43b648104de866046486219be3ef09ea
SHA5127db7c2341f884995736f3f977dd18f47dfc8c90069f9f0a086a6deb1063a94c53a5d5055dff7edfa5cd8ca325754ae7c8e9641671225b8ba6eb773246fe4b6bc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b