Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
f44ad3e08db7feb484c6d1b983dcf3bc_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f44ad3e08db7feb484c6d1b983dcf3bc_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f44ad3e08db7feb484c6d1b983dcf3bc_JaffaCakes118.html
-
Size
1KB
-
MD5
f44ad3e08db7feb484c6d1b983dcf3bc
-
SHA1
07f02d788f0b0b09c4738409ade76cf6f4e7513b
-
SHA256
fc3fc3caef16044702afa38f19668ae623aeaa86aae29151f95809aece28e535
-
SHA512
b05e863908640a340e346ac140a35b2f8148fc391335e2cf2ac83794ecaa716ae63586150d05ad771c8699f4bf375f9731a68d9642d54550c0c35f973f63902e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419462226" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{533B1F61-FC32-11EE-9E49-E25BC60B6402} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000008a30a53dd5685bd9e0046e20a99e640b9b012edc7093ce05683f422c2ca4170a000000000e80000000020000200000007658c3cef90ff0c5221a175c49c165d810445f37c4b51f796c59ff30eeba82e42000000034e91edd144305fea90278b04c3ad1b20ba79a37cea67a12dc977bf50028bd0b400000008076ac6c0a02c44dec6c5780e76ff4da04648273bfe6f077661833a6654be9528e48ec670fc32cc220ce093f9758ba389e37a57e96825649ec8ec41dae044844 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201173283f90da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000008f5a275060ebda3b9685a59eda22c989540ecb6d1310dc2267bc9e3444d9a5a1000000000e8000000002000020000000d8a43c8990442ad73bc4d0a504512eb4372aed370ad31ec5018b1e80ca0c0c3490000000b0c184a4d9fd5a6b420f3193b68412d522b3b7db519d868c126c33404f64e77cc8537279072be0348321249fc497fe67e6c2e26a54500fe53ce7e42baa025987775ac1dfd79acde45d0039d40f9a5644b6f44de16c993bcbb1ff4997a96439d315ffae066f6807f225cf3f031057dd0d2e8fae949abbc8f389d86ccadc008ac44b599bfdfc7b392e6b464ae3707feddc4000000030f1bd2440a0c2dfba9dae19f3a47fb877702f5050b4e100f2989b787f92f80ac50948d0ef9b96b3eb94a9475f5d708242e1a5768820e34e99b4a8317752786e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1884 iexplore.exe 1884 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1884 wrote to memory of 3024 1884 iexplore.exe 28 PID 1884 wrote to memory of 3024 1884 iexplore.exe 28 PID 1884 wrote to memory of 3024 1884 iexplore.exe 28 PID 1884 wrote to memory of 3024 1884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f44ad3e08db7feb484c6d1b983dcf3bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505c267faef9a67b017bf013e3ce29231
SHA11f01f8d5f7eeff57c76ce0332426e140ae5321e6
SHA25676113e3d3fc873e03272ed639538f84ca1de6c35615fd49ae73674942b45564d
SHA51290db9d55621ee9d3c99988e9eff2d6e4397909aae8f8ec5bdd4c6c65f059c2266730425011b2f68f566d6480b6ccc959a9d6f9725f550c1b16a08f05616e688d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559d8acc96239b4c52a0eef9e0eeaac47
SHA18d101d1c25938eb1591b53e02ddbd586c2b0db9e
SHA25684219a5778fba8237ea49dc005bd856cd27d92cea0efb92d3dfb0fb0747e124e
SHA5121bb8838cebac8c92fbdbe809e3b2bbab1513c3515d45c830b96924d3c08718d584e41b15e21eb4d0c4d0305254c34f9de3cf088629372ce4cabb841cad564fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5891ab08c34d9a80c5cd218ef34751e29
SHA121d0a76ebc17cd792beba9f22a278566b1d7990f
SHA2562f8f2a8c668d43ab422f7af2379c76ecff3042bb2d4e9a9fd05114a182f3b25f
SHA5128ec9e19d26a45d0e204a75ada9dfe2b8cbda786c371c7b346ce1a546318677db48a777ea10bbb2fc51da18da2f218973c6692e00b6805ffb34c11b53a7e47c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d2871f114c0fedeb2443bfdd2efb29d
SHA1fb89016c5b63be7a77d737507b9b9dfabe20572c
SHA2566dce2b55bf980bdd1db4dc16b99533947ca873dcaada96d3ad90c0358fccaf21
SHA512eaff817c9063d478f10cfe79b35e53348bba2ecba80af86f3dcdc5ccafae0dc6d3dbfe59f4152363b9362622116666e4af105747f6053da800f141cbe1868e68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3ef40cd55b59fe71c6251e1b7b56aff
SHA11985ead9aa39a8e4a5fad6f9bc8dcda04292464a
SHA25661667628e1e1557023d2460d6d55a4599d4f35b47b426b8902dfb8d8873c2fad
SHA512d58389ecec48457a78d6b2d62268fbc70940f5a82f638fc8a81680350ff88d3b0209a33efd98e98c338626b4830b4d0a1a58cc09cce54214ceb1c71dd52f9034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ffd308927170041edd515d74909b05d
SHA162b1051dc792b5d0b63865d46ff18529fe75f4ca
SHA256c25338b38cf08ef97c068158f798f5054afaf4368152a3b6fadd91226385c5da
SHA512af6a85a88d3c8d84d4176e6b480afb0e555dd04b58d354abf6c1ee08328dba0292d07d1b266235d4aa8045c4b302a4514d4f933e817adc7c7cd15c00a8ea524e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c040e7d8bfbf1cb5f937a8f89611f4be
SHA120d977a23e2f7a373ceb8576b32002de31faf447
SHA2565a9ed5764f8ffc1c8d748682558e88113a082f60ffda4c67138bf6de79a04f07
SHA5128731c63b784f7a1261ac9660dd78f6b82d0ff5b372e97c0eaf95d62e045c3e917bd63081e2a3dc92c7a31cab27840e1e69548954101b1ece44a5fa5e44bacf22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c77ce965765f46c21378b529155c9ac7
SHA13815cc31dca2e6d0dc51297bf0509b449951bb67
SHA2569acc1e47084270f98ef3d8956601dabdd02d4458719c9949d7267381ada161c6
SHA51253ad442388ba8aded756caf0c23060f9440b2c957b83e2ffcba5df7c4b60c8f47ba04c96a40a7db7fb2e7258d2d3e68b20f6b1ab3a5ef66fc34dd4ed5ddcbe03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8cb2e58116315c1ccba30c304e8a6ae
SHA18d36612e63789f277df9a267887a65fc6cc36c4d
SHA256b980833b9b3f0671ceb6fb78e9df0fd97167e39c8aafa08e1d5bdf6ee9a1b2cd
SHA512fefa424bad9b16391119da5cc2d0dba59872394ea05d6148921381c9adb81b7df065789c0b2de49230574384c9e9a18f43e479a99dfd7d69b4aa88a2bf0dbdfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5181cad7f0159468d995e6ab81b708198
SHA10250c93485d1e818dafe10021deec1bf2d03ed50
SHA256cd8fd423a7759ab759c905ab3d010cc9e3a53898c258faa00edb6ba29ab92016
SHA512125dca38f4c0f0f1d7a924eb2797e936914be4ddc8f69c194f93a6c805db546f5e7a417808818d030387d024de33576c5def5ba861a7079c1a5d8d6e9b15b061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e85550568bff3ad567d77fadc0b5ade
SHA1162ac652e9b5a74809f1fc50f70d24bc38fd9def
SHA256d1e023ee517f24ab9e2d3985604625009c133e43b741a8e404262c0d8b3c9dd4
SHA512f5cf2494d6d8820f85f807f9e09c458c83f433ab375a5a7022d6a48269880eb70baf5ccf236fd818ca25bb2ecf3880cd58e41522b4ab05d8ad8e285a0ee48f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b581214c1f6fc1b28c92dfd6e3092f68
SHA13891956a64e340baeef2d9111a4e263e80ada9ee
SHA2568cdc9664d9de9fd237b42f2094585bd58827c8cba407f17413c1c9996f3ba24f
SHA5122e60e96e5e456bc4e7e02f32b374abe89dfa26b5868a593613a75f42141143f5c67babb2f85bb2b288e3551bee96972cacf5247b887b40d94623a764fe9c0669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1c01286aaf18f6d88c291868cb7d1cd
SHA1761e3bccd7918282f03a49c11ec9e62ce6ea0dd4
SHA2560986e2df7e24fcbe2a4e4297a50785b866da93d8602938ebe582a2f111313a37
SHA512254a5d076fdb46313fc2446f3c1a80e96aec796599de2d3f6f0a7d410b48dba406952a01e31d191ded15b2ddbae88473a3c7453cbbb8b4732c52ece6139f139c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdcf4ed9a6e49524c40c9f7993aeb263
SHA150c31b3bb533aad6c7810115032cc16e25e572b2
SHA256cb73e2093bf5694f80cc513db38175a186e639da594183236e59f66663318813
SHA5125d626eb3357c30c8d74e78002793e240c38d3bd0e44121e75e3aaa23ff1095b30883d44d3eaa6a7e69e4f4757c0c7b33ea7338f3a71de02535ea6d9f965e8b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5462b7160d1e84030214ac44a2401be1c
SHA1b9af0ea44c774ef675f6cb9b30a1e5d0de9fcd32
SHA2564bcbdcc1cfe91ce1d0aebdcc8214f76ee969accd823eb4e8e7356f0b99f54875
SHA51262cf07c29276d765ad6725bb025d14c1e8c48cb3e2891eaf7b75d136d99ff179c51f438a6e5e35efcf63e7dd12e2dc67bf0a74271ecbe48ee038f6a98b450005
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bc4315c5a7615e2bc66d6d097393cdc
SHA13d16496ca937abfbbcb8a7b1413661734083c3ae
SHA25659bc23ce9ac426c78cc30c49bed5bdd374e5e172ea1db8b504bbefbf0aef5ee8
SHA512de6859cd500aff133a11f9e2b635f3132c207b668b5abf749e731fceeb567c81af22a0e12a794962238044fad91800eaf9f0cebb44282a62246cbe7752796463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5bac34ca77b1470303a7c118bac58ac
SHA14b7a1f539a73bdd68bba74ef94763784a90a527d
SHA256d7abc68b9550ffe34e47e078fcf6197cfcd3b28cef47ba44ca9780ea347764b3
SHA51252f26908455677b3572301be838e2b7737f6b5e259624bb0b2a7da25316bad96d91d301d958c3112812a90c253061c7faa19ff1b26032a6a6ea18e609bcad24f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3e7de95bdd325940fdaaf3df77fd5ec
SHA1cb6f777d2a528f3a46deef1bc52fa376ba5915d3
SHA2567c9633ed7c60b91ab870358e6839e7faee4f339545931c24ccb7231a389ed5a2
SHA512c4a5e777f86480237ea35744c66a802f0e7608bcf32b352814179875e383139b5eedace8a1fddaf29c21c14092a8ad401f9eb755c8f120742b37d086dea324a6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a