Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 23:17
Static task
static1
Behavioral task
behavioral1
Sample
12859ad6d6ae45e637c3dd5960a1549b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12859ad6d6ae45e637c3dd5960a1549b_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
12859ad6d6ae45e637c3dd5960a1549b_JaffaCakes118.html
-
Size
146KB
-
MD5
12859ad6d6ae45e637c3dd5960a1549b
-
SHA1
29c3e08e236e88e977a3cd0a3a16696ee7eeb994
-
SHA256
a04a14c67825d392438663fb7800879cb6a514a151ee167d96c1f9fe3918453b
-
SHA512
95d2d0a4277a41625b777571291362b8cbaa0482ae76f4a04ebfa3c3cb0f95d417ba815290a8c82d593c39d8199883de54f33eed5f96ce7939172f772b578f03
-
SSDEEP
3072:SXTsrtSrWzt0OlhtnydkNnWb9EyfkMY+BES09JXAnyrZalI+YQ:SXArtSrWzt0OlhtnydkNnWbfsMYod+Xu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000006a8b4efb03446ae175b61f138d9a50bc84710a1f548710abc3af0d93f0c2954c000000000e8000000002000020000000e5eb3c4b2832fbc170a7b6d0ac24a7a76d87dc5165531f2e73f671351586703a90000000ae654f671bccb83cc4e3fdec1d297d2db3878aa1adb46dd5562f1433a8716d2911604481f3a1097efad5787018adb3b0acf94f86ab7ae722bfe4e7f02de665fe07c0cd3302edf43dac18e7d481aa1fd0d46740b19d02247d5119437fd4196445d3c878b793f7f0b232ced1b03542d5afbc33b8972815069e7cf963ced46c9d58bdf29d697cec69fe8ee580590cc4c5db40000000a9a3af7c6ea387ca26aa521a923b7c02e523b33e8295392020e611eb9ea54b7288d6feb1b80dc889041ecfcd5f0853192da67fffddc73b6ed2079762fe2d8738 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8060ad6c6681da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417829717" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000051eef48da2e7861fc69d3774dfb5bd3282f6d78a79aebd140e3fc545deccc657000000000e800000000200002000000088ad7026175c58b03c8180d20ef949f55a1f657c2f8ae8b86fddeaa0541ba46b2000000086e89fc4d3f6c1273ad6b080a039d1957cbffce11bb0fc9b70756e27418018c3400000008292163be977596b14b9d18b6516a33f28fc05993b50d5fb8771080912807ea43deca55bcd3aaa02f8150d920d7575fc1452ae84887eb1bffc1a53e0e3ddc156 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58DA16C1-ED59-11EE-8832-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1084 1460 iexplore.exe 28 PID 1460 wrote to memory of 1084 1460 iexplore.exe 28 PID 1460 wrote to memory of 1084 1460 iexplore.exe 28 PID 1460 wrote to memory of 1084 1460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12859ad6d6ae45e637c3dd5960a1549b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540895135072d2fd8a5b023a4222fb8ea
SHA186f5e03e42d1662b7c3b82c9aba0639e7c28636e
SHA256d23fecbcc08f7ee4c10598985d3d00841166de17f5c852e70145a8e59e772b09
SHA5125f48536fbc28ff647fb50e90c881b1903f3ef62e98ed117a049e59488edd8fbf222c47766df88aff2ed48f5d44d2f801e025c3834ac72c7a09b6434cfa1fc57e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53585c8f06b5b99f463eab6843fbc4421
SHA1298203b319aa78f9d0b3457a1f99051ebbdc4310
SHA25694fd6e3f9e0dea7a4d13f7d87b874e9544ec39666779b0b6a52a1f6ab32edbdd
SHA512e382190623860fecb3cfc6bf6d2615ef25523be78954062f826f754b36ee019e109841dbf2fc2e03c903b2f8bfa70b64e904281b2a24d5af0ec5768305e80e28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544e3c28e12a4e190be7ebf46bc73928e
SHA1ad9e635d1e2f5c5e7f5d3e505defcffa342bada7
SHA25602b4fe3c675d6e34832f5f800cdc4db70ce728e537a0d26133b7a8434f5dfaa7
SHA512c11a232b01ce29c7dec12f549e1c0c91e0532b280bc31b525e1ae424f6853474957d8897172a7c6adce8de9cb81c4893cabc368a80e6c15286fa93633db2cae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e081fc946a9edc4d0de4df2a28a97be8
SHA11bdf44c450833a242015a7ea7d5765d9e0c32468
SHA25604d5da5bfe9bfb0139d9d16b730d83d691d0cf874e59210ff2a088a2957db0a0
SHA512cd1cc8f8c14213ec268a5a3f728ede96890f0185623ed9f1f94737ca05bd008d3f2558ee30a8ffd479dc14b08863282840c70c633949abb169c52a5b38932d2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521c26eefca37a57fa46d2649822b6b6b
SHA140d0752175a6774146a89b3e382c8933054cd4c7
SHA2567b8bd2123e73153c41f3bc62ea365c015f7b8af869713c8896c2953dadee208a
SHA5123c10da91fa7e08e265532c3c598b956ce8a9ef4d7717ae8ff7b1a7d3856b29c10ec2c97a20ab00cb7d4e0374c8717f519daff146da54efcdc535ab7dee9cfa5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f83136508a2fc25d955ca3b33221d55e
SHA1888b0a58f2cbb73a08bf29925644fa8a62c405fb
SHA25604565a0cff336216c7e9a7fe167c2c71be985dd76f7e1cb40dd087f5e13a2f52
SHA5124381826f9f0a9f250125cca163bb2c521ac612c622d69feab656c5ee85d4fff4601622babb1f6c119db67a03fa32c251b705932ddf99cab99136542a49a0ec6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a78c22cdf83b31417dfd5328e5977e18
SHA17071178c7f2bd7d6b1cbbd61f967903cbe3c380f
SHA256fe1ce33296c089275555ca0748a3eed3c45d197556125dfff3c21f0997a83b5e
SHA5127a56de67825715b5b0514bf59d400eafc0bc0771e40b887f8854ca30ef0a74c603bd60a46ec7109561d45688b79c2ed68ceceaf84d410508ed27550219fc03d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daf90a494e08263ec88bddb24f0ccbb1
SHA14d5b7a6f6359bfd6e86ecf25ae7a8167958bcc60
SHA256f2c9882e5813796db4c1de20df047c534d515a4a2f2d1221abf787ee054f1aee
SHA512c44dc7b75381d15db1b6348f65f32c51f1674ce4caeb9bb1a1510d663804c0aa8e3f456815df19e10458a88b595b80d8e21741cafde1afddb1f551dacac5a0ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5920306fe4cbfc9629c15ccf9ab439d3c
SHA1182c2fd2142fd4a47e1f35ebb938022e5c3832fe
SHA2568324bf5e3daf9560591626915cde1da51eaa4fe0008f5cab17240e24a9c8b7b3
SHA5123c134593b7f8ac9172986c3015363f16a9add62fd9721dc1613efc74f931999773cd72b4063a29a97ccd013a68302107dd41a842e53074e572bce5e20dadae02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bd11f07c68d8c924538e251438e00f7
SHA195a7742c5dacca736db68e56bb4d0df839e55e45
SHA25640f2b95f68ceeffb2bd0a1cd5976539eca7b88cf70b6f6472ba6eb6cd07269f3
SHA51224fe0108d56637b379cd040416f466957f3a40d80e2fa5b0d8f3a0c2dc7c71405e9b076d99902c95df757f652e0c6793c0a9e60996ff5bb7693e96b839925ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592ef5fa16c703fe2b3057316b03ab310
SHA188421e1b1d20e73de566bf30c220416e6c868785
SHA2563806709033e3318c34e70f63b99696fe385a32442ccc7ea41def6ff78ae296f6
SHA512b496f6be7f3ec889c8785302645d0cdd3c7cae9356a7085c4309e53370a185050281cac2411ca20ea56cf2e84b68fa2f15d88bb7da4dffb9c89a7bd304fd357c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50326f4d43048090351c55efd8f756668
SHA1f6a8fc620d95c9a098a09728547555fff67ea12b
SHA256d417ed54265fddb889d4498df0325831a18323b6b82acb9e94efdf30fe17cdd7
SHA512650baa46c051567b52cd607b75a65f0c6769fd51413632d7712ed0a3729b2fe4d6ad9b48645f5fdd8d382e3c3cfe0927614c53d5f279a73fc07ff3c0fa56c6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6e5204450796ddc77149c6a13b71185
SHA1f07bea59b1c6f3422609bc3c4db0819faa4110fd
SHA25666482a07929dc43fe20f420278ace0a6d7eff56712d87cb47b94fb138b2d4267
SHA5124cc375e2ebd2cf9ea1fa32dee025fd1a851eee8e4edadcc15c38dba2ea75c7d60192ab10f8a511a5f203c147c5329099f523bd95ef03b88cc46758c6ab8665cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a21f06a1391e2e8259154fdbfde2974f
SHA1009cb80bb9c61c8949e64e727abfbb3d4608b027
SHA25644b1736182f6ebeee7ef8a280017c99f71e8317acd653a41c571ee25a9218348
SHA512c44eaa7c36eaf291a5ecc06c2aaf9e5e8844e48bf8ba03614a09de94ede04ba041a5f40ebad1cd0b21f71f8c4119128527688677d512c7120c6af71834bfc41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ad3a8ebaec7be6c92e5647aedec18ee
SHA15a85c63af97db8fb13f8959b9e4bd1e5516740ce
SHA2562ed3dc1a8e3718464fdeb32fa135e2ab26dd1d3cb3d0190ac47897e69105ceca
SHA5121a766bd7d26b5072a9bab3a5f8a8f4058f5c562333ca0818b6a169318279a4a0f35638112bb8bc95221385e9d6c949af2ff68274ad7ec111833e40a80e86e78c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdc0b370c5d94e07f5409002dac710aa
SHA1f4f21e3ba482c59e1c8caff4d5b2ad673402908d
SHA2567a884cf28e8f4ee77f763378eef719c5754b9aa58838e0077edd464235e9fa52
SHA51269b1c3c2253ad9f9963801df9fe0bc22c61903ef9e2287842f0882745a638f915e0fbf1782a49c74dfd7b61d1cf1e00a283d60da012e92cf8cc25ec822784f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ad7b98312db3401ae2cfaa8af32a299
SHA14cb80988c42b58ceb508af0eab3fc4f08c21895b
SHA2563bd0f87e9f09e9eb1907dcbb99319d80e45778e7b121cfeb627833d4ad4bed4b
SHA512ff2db5258007031b755fd089b5bc59842400b5be8020e61b48af626773d11283f8c123fff6286323ba55bf114c5bc75ef312d2779106f0bbf5b5a38ed8f21545
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52667aca92dad49ceb04d52e1d77eeeac
SHA1f40591b359cf530298beb23ed7899c3791fa46c9
SHA256ee09ebb9b4aa02b2326f065bdacdede73bd42a36160ff0b3cbb9643eb164e761
SHA51274f734251efeed2fc9c82087a5bf40c96317018879d16c26e7cd3a3b9cd43cd43f65bbeee26f7c3643e007ba03b3fd326c75e70addb073873a31c24031ef9d07
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a