Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
f8059f6327f50a90fea6ff1692286c80_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f8059f6327f50a90fea6ff1692286c80_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f8059f6327f50a90fea6ff1692286c80_JaffaCakes118.html
-
Size
2KB
-
MD5
f8059f6327f50a90fea6ff1692286c80
-
SHA1
826b8504cb13525626e0aed0bc5298ef14940742
-
SHA256
30f57e74e7305b9c002a43b36bbb6139a890739cbe74fd8e2f3126c536649976
-
SHA512
22dc02ceba5f1c7332d4323c0a87b9d8a810cfaa9d97d25ff0afb57d4c0b928f4902cf98c95cdddd3d62713fdbd50445bd5ca1d7d92e9755718f21125eb58137
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000030c046559e98eeb4fa8cca08d96f3ed9be8102c456898a6cd14048444febbb19000000000e8000000002000020000000dd7295efcb873669a523075bb6f75281060f7e339ed2490f6f723930c18b40c1200000007e3ea19b35eb7946ea0a07a5c30b4088b533f56ec2dada99b040b6e392c662b1400000006ff2c11bf3cbcf69b1be864d2b3a7e0a8105e9cc530fe209654567f66330a963fd7c28338121e4230cb135c57d1e366bd4919bb10921012dc6a3401f23df078c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304a0aac8e91da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6E2EAA1-FD81-11EE-8A04-E6AC171B5DA5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e9eb82cdb084060e4693e6978425a44b752e3317d54170f9f07580a9920619a3000000000e8000000002000020000000b8b6f23b8f6088aacf252a114609e242a5e239901faacb44cb19c5fe63591928900000008d8e7235beca61633a3537e983161c99a26b762b187fb8885481d849348c4575b7f32c9f832f2db51012fc6f59cac88cd8bb3369782a37f93598146b603ee633cebb088c8878545e7df5df4261ea3af7e210e213ae9fc2a1d98b029b4778a96bf616f4d68157c0b15bf160b563801714ae4b3486d88bfd50b09e44db0c434403b9f9805b66bc2ed63d788d319df5d60e4000000008521afbe725fd31ca4b1f5d150d0fa32c61315356bc223f086762f1723ea2060c22aaf09489fed301bfa936d2ba84340c64fbc5a8d520dc53d976c25e942ef1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2736 2364 iexplore.exe 28 PID 2364 wrote to memory of 2736 2364 iexplore.exe 28 PID 2364 wrote to memory of 2736 2364 iexplore.exe 28 PID 2364 wrote to memory of 2736 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f8059f6327f50a90fea6ff1692286c80_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50824369168d701243e7ecb197ffa4f30
SHA165102bd226e31418d805e5fc9e19ec57911ec519
SHA2568f0b2cfd9a2fe61a941407f99b5cf4f2bbf8b32d70d595380863c3479df9cdcd
SHA512419b57b9e3fc4f7f1d520cf523f6d7f991f3a94bece0b9bcaa96d2e0b11e430b832a0b9cec9f2c6dfa9eb6cebd49e1368e4133b194a143403baedee4523fb397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529bca895ab704c3ef7cbb7426972e094
SHA14e5abac1c78f462e806ec11429cd7153883cf056
SHA256e8df73942a5fc6c069c4ceb1880ce95fb214a2cb6424a95d77c24f0898fbdae3
SHA512d5e919273a445022c2eadad48811854b057d526cc9ced7e80e629ce3f248df952b090f246e6d5ac5bc53677a0c8de17b55431f47c4e4006979dfb644037c11fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51da09474ad640673c6cf5062e695792d
SHA102321d0809998a96487e7dc9827b728589843122
SHA25628eb017b18b5c59f94c659c6555f9fb2271741fb866e5f9f5b7f17813a8c80d8
SHA5120f5d888987297d37b06172b64ad371b1f71e53cf5332125543f395164ed6f8fee9e2ce4659029f630188c59d6782366f84aae3cb8129e5bdc4a5f32d08b7dc7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59620b8229665933caf0b52ef8742cf08
SHA1551347d2a031393de0d6d2463c228c5405a769eb
SHA2560c1151cced9f7aa44ff733042fbfbbbb7d937169fede9820f2de0ec0e8e767dc
SHA5122629138392ccfae3bfabbf7352aa74973a0ca7ad4a86d7ea1a2f68d610378d648c394f47ee2baad9e3a148946e25d34bbea80355a7ad37d3279451d2765437be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa79e47d138cc3891902cff0c2cb2697
SHA19d44aceeca7b2debfbee1a603f3d99e5b708f5d2
SHA25670a5596ac8c52df21a049ca76e48b19b149ac588eec976b3788c0ac47fbc5271
SHA51232f4c77fed5f21e9821e728967ed1f408040f3e22c18b5fa71acb9e16ceb2027afd6e2ca4de57f8047ec8ecf6a78ad815c00ba383aaa416abd78a107d8741471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570534e9b7aaaca7a015d1503a6ffa77b
SHA1b7d889116b1154d365ac665fe59c7654e7dcdf09
SHA2562f46edbbf47c020b581c1f21d31ea27f43ac311d18dca9531a5eff1eb876193d
SHA5122161dc8ee07afaa0874598f9b1c1fa2756fb6106474179983cd5b34c14b63d2cc428345eecf55efc79fb374cb41e0186905cdc1fef7e871d451208f13b202ff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547047281d8659d5a2981ce23644dd5ba
SHA13e6e4a309d9f3c18eaf6c3c43f195f688e560755
SHA2568d9cba1efb9b0894bee575b86ebc7900c418d91a09ac3bb5bd7bd5e38d7b1871
SHA512cf5695b606fbb230c2d2d794858e0f45896d67e4f03baa51590a3ed9120859af1541601991d124e729a8c7fdfb3ff3a98b107c60365dc68319ad70255160da91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f06a56e80fcaf0a15a4276889018740
SHA181b210f74f49bf71cc6867ce4d99bce78fb8cbf1
SHA25662a9be4135cd569d71421c6ed4f317785de6f9123ddc2dfdbbf455e03db220f7
SHA512c31ef18a9a3ddf0e34326e35edd4aa095a33d9c8cd43769025bff9ef4a5cb1328135f5ea294778e98970e6af143c8d619edc31dde0b7fa9b9b477dc9bc9eb16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac995a30249b276cf334c39d105637ea
SHA1b4bbfc8da5cc6d89adc343e6376eb569f4171f28
SHA25637b0f47b66cf3b6783e9809ee75ed707e0e2b50469e6769342895d87527fece7
SHA5121e4a1fbd1dd2b9602e1d1b8e1c15a59b545d3ff1e33ee44098e86cb58d565e10f6ea288b84e26f7e2eb7206f5c1dbe2e8cab6c195315a0dae727a1906bcfb008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c678b634491da0c585a071b84a23492
SHA114359e06839e660d286e5798c9b9a6cb3c2d1a4e
SHA2563713b7ccc9088b068778208e2ad4d7cbb65ba10d440337ae7e81176191ef3097
SHA512097945f5bafd77f25351d01bab09015c644914d4fed4db35c1c319379b54a4fa20b5dd9c2b60c181dab39fe9400afe181fef29c59dc71c726618bdaa088a7968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b69093495f871cd65a7d4930741501f
SHA166088043887c99c9de660bc8b3e11e89a05c6f7f
SHA2564d88e3b46c9548fbb9c3402a83fadaeae26bb11aa2eab50fd79c7de81f725c31
SHA512b22073609621f16359953958d0bf2a8516f3d19aa53aad4b47e50692fc1e3aa29166f69ff3a0fd2dbe327c1953397964fd3ffc038b9e297c164a0a3528afc7e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f34ef15847feb2ed563c22b4ab631e7
SHA1cdebc97589f9b42b8fa671977076b67172c3ab66
SHA256451dedbf267b93fc38ebe3af11c509ea820b07dca5fdca97cecb6bcbe7020745
SHA51215feb276b58ecbcfb86c03ed0e67713ddcb88424de75069f62a92c5dc2337f210e0cb2460cb1fb47bf3652a1bd6b75c499b8876688ed4b26134e3e79fddaeda8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5114e8dc865d549dbe339e9b693ebf73d
SHA136c736bc49c6e62e419fabcad0ad47f2b8b555f9
SHA256fe1f0d81c2b858e5eed97f5a3dcc0375badd1ed98dd7edbc98416ad29c8ecf86
SHA512fb806c6d7d7f862e6edcf91766bcab4abd5e978be025ba6754f3a63e47785970b1fc3bb5876e40b8a6508c892370369f8104cfd4b3c8d20ab72fc7f0868cef6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546f593981d3acb33617e06a47dd9a54e
SHA1a6be26f20df92cc6966551c4f125485423d78c64
SHA256423bb343fbcfba59b7c3c997df0e60c9f8cecaf5d1256ecb39a22c1b56984d98
SHA5128268fc888b2d688323f6069680385f72d3c6f0f8736fc451178fcb3799e1c8947e16cee805e48efdaba8f14c0b14d96af75ed42ca57ed42688db96e59d9aab88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505fe6c0b10f19697a832cb49aa95f616
SHA17b30ed3bf1ce1ec743b1bf158bfcf19d192d7c17
SHA256cce874071975fdaae9f22e3ea2bdeea5a93858cae2d739af9341d41e5f054e20
SHA512ffbd6837e2369f6034a6e44293d534b849a30bd4b88469773d86ff45819945129916fa7dfb55b2aab42b4e5425526822e24573b3dbe73264c25aa06c1838c10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564430a96acb1ec38fdb2794f5eefbf2c
SHA151823863db7c889bb7ff1c5954abfaee021e8327
SHA2569efe341f00b5da961da6cba4e74b35e2f2451c6fabcb615406c166d7e3fd9b04
SHA512c8882e37cf3279978762b2b476d22a5e102b83fe5d584e85ffb3a6dd9094e79c4ae1800535449ae1133ad0bc122180789579a12a57058e40839230d8f2e0eb03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521060700cb7e0d106339ab0028b23c94
SHA1d1bf0451746faec10c3522c0fa60586a074cbffc
SHA256debaa346b0d763bbd2be11f70ba6469b541d352a1ed454d1434f76168ecfd707
SHA512c9e538232ac6e099767279d526c0f0354cafd7a85916ba55d53f828a8343391a502b7654d2f20fc5aabd4e31243f2f119ae80f1ed24ffad2a57f8f6f617ce7c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d45c666cae2e012c03f4359b0698322f
SHA173b05f6a5fd8f0be167a77fd306ededbe4c28447
SHA2564e7ccaf07f00485aa58d538ef357d8773fd438fee1cca04e894c2f52820cffe2
SHA512929b7b1b7e5b89e425f9b2cd3747d2f3d4e5e4a92ddd97654db6bc72777ca7a7c540efddfb7b54339e5c53f8c900c77734cbab57e19943f0047479e105ca4d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5062465fa5ef4c8e41dac0ead8982516f
SHA185562922186eb94f2bfe18de7198c14b4a8e23df
SHA256fce921659eb1971eb6c3ef6c1a5c26f05640859e7be766dc3c3588065f80d59e
SHA51236a08538a624191050fce47a6769474ae1d9f25674fb7e39b88a37d0611007779dced3a80e15bc7e53ba52bec8b80967d5766a8a368f5aeefc1cd95056400e37
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a