Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
f15f9185e9a72f152216a94be6318869_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f15f9185e9a72f152216a94be6318869_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f15f9185e9a72f152216a94be6318869_JaffaCakes118.html
-
Size
6KB
-
MD5
f15f9185e9a72f152216a94be6318869
-
SHA1
e3aa251dfce6e792935c7cf768515bb44457469f
-
SHA256
e09b443987128fcda2e66beb38d2e2a6a5b94aa2c05b069e83bc3f17577d8485
-
SHA512
6e106ae6976c8aeb9384980f635a05a72bd51ddf5af65b304d142536ef658fb72ddfd6112947a011d8aed05b660c46badb0c1a3c72c7579d37a38d623e6cf457
-
SSDEEP
96:uzVs+ux78XLLY1k9o84d12ef7CSTUi9/6/NcEZ7ru7f:csz78XAYS/h4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b23e3d8f09650069262cc9c6a58f51ba3eb5c4123cded9a8ae99fc8818d169b4000000000e80000000020000200000002b32213a46c35e4d92ea5ea6ba9f83f28df83e7c8c969f2fc88147a16998961c20000000cfe3e43d0007d6690e5ef6501e1e809432ab354662db9f91f2afb5bef58d4ef440000000bd347984bd932865957d8522bd78ad4eb764c5b1d358806983344a565887cdaaf4de16331042a1bd06a2b15c753644f2e0445d69c98f4a742bf61e754ae9ab9b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D95562B1-FB3B-11EE-A296-4A24C526E2E4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419356364" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000bbff69a73c3bed4367f63c820ce5d78299b1b58f53ebce90b5ee4facee8f7167000000000e800000000200002000000069133fec1ea37c679253502caa919ae03dc6f546521f15eb7fd977acf1a292f990000000e745ffc9f04c6aed054e523e421de7059fb292c8b085908e142a4e293994609a311f1a03699d4634b7fb2e839740d79a1ff4fc0dd2d0a6e593846a1fa8a6cd65fec764e4d265643f0b1f297162b1fd1cb97a5abfeeba28d2bd3b71114831e6269418c5d15b520f15bacb0af396417afbdfa12c023583cc0e7a29fbfb4495edf744f19f7deab9e2e6f28c6d808b80606a40000000aa7377221b18a0f2a084d19e1357f623929d3b53a235d403c9617da0d4d5d4be32bdeb242803c421f75c1a039d7c56df16cb460124a398ec4e4efad409dee9b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009ed2c6488fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3068 2372 iexplore.exe 28 PID 2372 wrote to memory of 3068 2372 iexplore.exe 28 PID 2372 wrote to memory of 3068 2372 iexplore.exe 28 PID 2372 wrote to memory of 3068 2372 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f15f9185e9a72f152216a94be6318869_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56de725750622c2d6d284aca6a1b3bcdb
SHA16df24e4642ae723144cdb4edc28a19dc61985018
SHA256e2c9aee02ad383634c5f5bfc4477c4a5eb20cc223ceeb7a1acecccc9506cbb35
SHA512b0edff54a6b36009d691bef22be2fa5bac13e5a1fa4cd5ee4a06c089046c06709598ad1592fb95ffc14274dc161643ec15cbb99f72ca63743668e5bf11d57b54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c888c412d2a24d4caac5d022047016
SHA165c0bf05b6bd7feb1afb3c0f71c1b1acfca00912
SHA25680cfd39519ecebaf2b9629a8fd2e79cff3c13e9ec8804f3d9628f3220815f47f
SHA512fa0bf54e09992cd7b79f137625fb6a205e8fa5a96a8c6ea6afd413d88e613be9bb2bb6115a2fe7195040a26b20ac7a6c9d378e62f9276b82135c52bb074946d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4111f26d9606b3de16d40cb8237519f
SHA124b17dbd9d7ec3e21012eaab304ca36ba459f23c
SHA256d7449e889938d9fb4d2ccca6b3121430efa156579fea812c986f1dcd3a489ffd
SHA51233653cd9693015cdf56a1d4a20ed819912c7f4836cd25fd125cfd37251bfd152dc17e977ed6d830207f315fad96d215e862af273db8235dd825cd9cf9b05626b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb5240503f420c1eabe9f64c2a7485ed
SHA16db80bc8e10eed560b2331e1cb0251cb5a812806
SHA2562ee001704d1f6a2a68c213f855fc63159be4abcda27a4f754bab029f25266869
SHA512309db9cdbd11ec2490b2fe757b0e2dcc4e7ed582f95c2078159b6f53144892c651d0636e4d6f18587056f3515820717f59b3f5761068c9565e331d9967338ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549a0aeab0b6144ca8d5af5aa5f74d0fd
SHA16b1b0faeb900d5dfc1861177c851eb80a936390e
SHA256a25eef27a19b2dbe9e85ee36536112ff7d6c6c0e86827ea8122d0bc86db111e5
SHA51271e2588eb5000fcfd2c37c015df0c4f683cfcc702565f2e5bbdd8de5aa01e7a3c60ae749798a9630eeedc1a68fe596a87d741d348646eb0043dd7e13e0e19e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582a73931b316edc652cba4692a9fafd9
SHA1290af69e0f98c72bddac9f874678135908815959
SHA256bd17a22697fd123a0de3e51ab451efe24341701631265f5c059b35cd3914306a
SHA512f8004721f42baf0c9f898852943bc435b754488a7f3cae7d98b600137db43220b1afc6226398b857e2824aeb3af55dfbfd78ab2d6c7e4c849e206b47e57453a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dee252ec84529c64e55d224fdcf65b1
SHA151e7a8b05a6fcb9a0918de72453c9f0c43c42d8a
SHA256817715dc9135cc92dbe37936f7b9f03c329464c7c63d84dd882f47825aa95821
SHA512285f0ee4ea997ca1643ebaf32e038e4ab624b7ae30d68f209d362f33641ea2299776a17d424c89b6f22c05b7419d935e067a332bd75e30a6934f6f3879435300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512bb53f973f0c639a12455f2260ffc69
SHA1173ff5806f1e6ab5721d1fd5118965766445ade7
SHA2561efdb9ba050cbab973522c8ed39196205ade0cecbbbfbc22e3efbd2034c6f833
SHA512328cc88f862743005db54b7b971a42f53d611febe2f0fdcfc0b16bbd51e8e92b81bd10b2950dd8da0821c8a3fff4eb07231de0dc9aa90a19e4768a11792261cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5619fe5717d9cceb836810f241f5b9955
SHA1fe2163e06c4aa54e12ae3cd154efe7c8f0fc0763
SHA25603a1288b19ea8fc5ee4e12dd60e6057808906aa9fbb8b14f5ada0c7424ea0533
SHA512172d67ae9c80cb43d33a1b0937fe6ec179d1c0577d6b814cff1042b90ce1c23c63a40239d71c41211cb829f08dddf34f70a2b9bc95210f00a787d681952c03fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fd80c97fbcce63358dc9be6132adfab
SHA1a81e643383c7f700bc5a636d04cddf8b1406ad49
SHA25656f8e156ee15d6165b99543e4c5d5ade5f8dcfb7a6c0094385d4a4f310b3f460
SHA512f0008867d820a456219eff8d3e62aea1321a98e9aa72c6fc8a1ffad11305555049b56bc984a7dabe9d2e438931e6940e6a59c1e1222dedda9053b1400eb63887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f73bf1b87e246677f4a9fda813b2874b
SHA1a7f4814591a126e9f652c3859b27b9c6c61eb361
SHA256e341705d620278b066bed65c6d30a2a621bfeaf4ef682e5998aa71202d4e0c65
SHA5121e7a677e1e336c7d8372e1acd110959b205d832aa72de3a0d098c5945e3a4d8b2c0eda281250acdc1b708ff33566a04ba9fcb6ae3ded92460031973422365bb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b81f29332ddbf321487a0c7714035313
SHA1c2abb5d0bdcf14653fcc284a8611c12151b5dcf0
SHA256965fa8e41b6d2b03b45bb7a9ac4583e3599062f7740021d8a7da5985f6247bf7
SHA512769ed39c09dea7929269660234df4d98edfd1c54f7806ba9e44eca903adb01d816a2c152ac8bff470d30c4f1d71eb463f4cb76548fe15956c81d7a45fa8ab64c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5903e6c163774bf4ac7827fbfb64b05f9
SHA11a53d20dd9d81b911884e3e59e4bc46cefb956ee
SHA25642a6949434bd6f365a2f0170c5616086ba52ae388e123ac96593ae746ae0f206
SHA5124156aff98a10dd1e6a34ffea447f3dfe76d7867c6106b6782b91e1b0a3d0735c18a6444d486da692225f797ddc8b8363285253f4bb305f090020ae1ffa81bd86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c6771b11b47f37cf7a1eb4c53a2b8d2
SHA1e5b3903313db02a51751d8ed8f31fc432e8f16cd
SHA25698d058c6bc3e0aa9dc804c4fe390e0bf53b1783112afd4c60c9a192213264644
SHA51232f3a57aca4c23bee3769bd859fb1286aa44f1c2a8c1a2fde73b672a25b4223d50a90451da91f4b5d5f10b1e239aee0b46c81a6aa58937282707a190b84b03e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef255e83596d0c84d19e8ea4ebcb6c1a
SHA128f0d98fb83b8a35fa31e9f4f88fdef71b3f661a
SHA2564a1006de14fc6b25e608e166df139f6c1f9f3e90761ca1183e86476257ac0f6c
SHA512ea2dca56d03fbea5ecc964725bf81f7501312c136553027abc8c8e7bee6c25b53528b655f4f5c92f5b3cc635792cd9f29bf9d3687f09d9176600a2149e9f166b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e448260175a7c42c869c26b2ba6ab61
SHA1e38bb9a108d5fbcc86d38d1177c06f06c6a034ab
SHA25631ff6b5bb75e3dfc1b95bc0e616a17bc7933a8087794572a3b0ad477e4c7f1ce
SHA512d0058a37990f55c1d2ef997c36752b6d1eb10a00d9aaaf9c22b6fd2fd7349d442e966d088f18b289c7cc5a04f1a89eab393626552e0e0c4da9423277bf3064b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3f7332ea21c1b58c92dd73f4d32faf1
SHA154fac0ba5697c9e09406d71acfdccc7de8c35396
SHA25612777dbe7d51c73eb0f0a253287ed12913742a001fd59f67af05ad700651ba29
SHA512a327a4bfea62778334094a3b99ab168c959409ef4f89dc7ddf0404f174d6bf27e5bfb229dcfc7ba5239ea16f0fd0e7b630a15f2ea305d3baeab7ff0017ecad9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56253e904f3469c51dacfed1523bc4ea6
SHA19b731530b788cc07a7d6d2c8f1ddcf66db6d9b3e
SHA256ffb663f71ce4132f07c85301f1be9cb53bb42bfd08ba663b3f6586dd25f7ca85
SHA512784a03a61219005f1fcad47781903b99d03251f085cc566bc3304d5afbf6233875f7ad4d1c4b83139158f3dd22f3074d34be682ef8012f157117178f7f7dd4af
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a