Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
f8c09a5eede3dcdd55e6792d15134de3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8c09a5eede3dcdd55e6792d15134de3_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f8c09a5eede3dcdd55e6792d15134de3_JaffaCakes118.html
-
Size
2KB
-
MD5
f8c09a5eede3dcdd55e6792d15134de3
-
SHA1
8f2733258672194845222d53d0eccead66281b87
-
SHA256
cf702b792f116e3a8b1a4e53d3a3cc9f096050717aff7c98635ea7088afe60b1
-
SHA512
0fcf37fcbacbf10a102839b470df162110a7bf31a8ad4264a30d7bcee2e28b0223ef2e5781a55d0ace038458b574f06bdedc7704bd12ef24ffb021dfc5ecbc2f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602b72d3d491da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419636460" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE4BDD41-FDC7-11EE-9782-6A55B5C6A64E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000e2010426ddc31f0634ba2fbc354601e691f3be53a80a041ffe69065adbc35c04000000000e800000000200002000000022459e896c8fcb39dfac14d72adac81c5d949e07fe9923bdd5104363d7afa5a7200000004f2f4150de46b29cb146e5ed3fdb8bf0660572b3d836d89939ba4a0f756bae5440000000a10033400f1281e721f926493c23851bb5a12a07ab236e08f1a5063ff6127c94bc4e0d45922142d6e9792004e414adccfe9d7e7cd5acf18a729c7026a99d4819 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000deb37b4c649c9f939f8a76763226f04b1bd3cebc022223d963ca48d69719d61c000000000e80000000020000200000007099ea3519afc463776d29b91c2ca93c59bd59f1f1682dc3917594cffb06274690000000d86ce95e40d8a8ac074ce4ef16c6e8301701ff395c25a6fcc0d332b05b19d58d186af45c5c4d16f1bbc4cec34783da533121efeb8fc65d4724de0d56c75d6306fa6ba28424f1968ba66c3496c8fa4c710b4329af3ca8813c65e109762f848e4f02368ce9ac94329170a1264aed4d90ca04ca5d5e3be6ef6147a9894a481450494258eb4cc7fecc57490d4b7c7d81d38d40000000afe64e1d639c75901a0f8417328881a877e48ccb2d51d4c69707a2d5965ef5ed3502eabe50d7248d718be9a8cf6fe5189ec1a69bc167e38f46a5ec0fa6d59899 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2516 iexplore.exe 2516 iexplore.exe 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1296 2516 iexplore.exe 28 PID 2516 wrote to memory of 1296 2516 iexplore.exe 28 PID 2516 wrote to memory of 1296 2516 iexplore.exe 28 PID 2516 wrote to memory of 1296 2516 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f8c09a5eede3dcdd55e6792d15134de3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cee8b9f6eb7a44210590f84b0e0168c
SHA1796b165b40713c6720da7397fc8d1a2c95a4959c
SHA2566d85d2de46f8596af47067d5f297fbd7a4e99570fb613d3efc970fc2ba4c5fbc
SHA512b27edb7f0382b830c4fc9cab99a0132c7c6abc5f181dd469b0ca3a036622d0b52a5156912fc509d534aaa4c05e69d8e760aefb640e9e0205fe9f76dbf14067fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58988a4240ba869fd0be2fab627e60b44
SHA179bd41d52e203a6d23805dbebbb512839eb9eae5
SHA256fee2937a5dcf40a250d65038a336fd5beb935bd376445356645b9610e9771d41
SHA5128c7ce09abd3ac01cc6e737f11c877dd35ff98e6f74b727ce7cb7b99afdf71cf5c3b629a64da3f9434d500453a1fe740345170f80c0d6241b860f18e41e0a63a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8949bd1501b17f822df283ca11f5ddd
SHA1f06778b94f399ed9fa1b0342afead9e50cf2d876
SHA256bf70086d4f81f14bb95de016fff84c623c78c38d44c7069268684fab75315276
SHA512ba164f436763b81c7cbe9aafe0bc53669f23882cf9bb164a9ccf817c804cfbf43482e08771f380c13368198c53c5d83dc22f280916e9e3381f15883ad80ccdca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7f8dffd48fe070ae7eda99b52ab2e7d
SHA14d3e3365a0ad14454a5f931197e60218001c6528
SHA256165fb8706f0b2b8ed697ab6949175bab83f6faf1eaffb297f94c07c2a5d20aad
SHA512d3f0ce141e023821acc69f6ac85b3be63df7916feae1a69e2c33dfc17da10f2921c456d35331acda337ce7e0c72483a88226b0166f8f0b9581c5fb7cbb1dbb3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa57748ae167d9b41b6d04689cf908f1
SHA1610114e29153626eab7a6d3bf1b2195edf4e9713
SHA25656fe564af6fe42381ba29b178501fe6e314dd424778b8121a6ebc894d360fbe7
SHA5123043e599cee8df3c49e280a9dc0ecf296ed37d03cf2b7efdcf4486cfe3280da40c0c4203501d22a81d18ce7c1c2514424ee8801c1b6ff4c2b3fafef05d62a434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7f952fe672696cdf35c31532739ba94
SHA1159a91f0591cf248f44caf0bad269ed13f71ec1c
SHA25685d2edb347b4df3f0bc4b9f7947c00a31ebd61e880e2fde4387f54c1921355f2
SHA5127aee9045f93500a5050037cad1030284a89bf0f7b97c148e4df9baf906a998c81567b294c34ac36d3769f46ceb9e4781b7eeebe665bd5f5872cbf9120be97014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500374f784644a75cdc16cd0588ccb647
SHA1536c1d716142d2b5b87e67f4842f8710a0862e29
SHA256e2149a1bcbc29301667475ee994af6cc7f7024474419fd1fae8713c6418efd95
SHA51280399bdd9c29777ffc056fe6904cd42cbe2c6254fa8806bebeb0fcf0d49fd73dd04ca3ce319e16b3eb8351bc8d59d4e8332c4f9def051468d3d20990048103e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7a783d4c309f506e70a74261ddac4cc
SHA1fbed1b9bef6f2da14d27a2cd8e7ee30b61f63e38
SHA2567f7d3180a6ff0ea0f3198241332d7d05a6e179b551802f8de7df1884fbf3f705
SHA5122949fda9d1cc580c2015b6ea9dc9706b9c087437f35f45157510c0c5263871ecdd0168b4b45dcc249f584bd5170d979ea5c8bef595a06fe1850d33f18125ae5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509797bae40f062b5c91fe970e37dd91c
SHA15f8d44abfff95dd0f25ddd68824bd733b1e56358
SHA25608cc77b6c53b94f3729f21fc41d24d2552b4967de93cd791560214d59128c04b
SHA512e555e191e424a7692cac6150d419efe94e20cb0fb20813a8268b979340364df66730ef4ff9285ed63ef3d84bc7677478e3307742f555accfa81e24866d03905a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5718035c1b8f868370d48d12640be9bf1
SHA1e24ef408a08b75b61d76bfa4b3f1f337066be8c0
SHA2561108c07bbd17f0ede96a48c2210ae272efa51b9f4ed89be6ce0406f89f184322
SHA512259b057bc34168637625962dc6ecd431e3df7ee535835df6dd0f6e6d23dc42cf18442e585f362e026135d5bbd79eb3217464a42a2588c40f3144f51b6ca93ef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54500be425c5801b8f384be73ae2ca037
SHA1a3dbf0ee6c1810a60f30ed38529e4a1326263698
SHA2563c1754123d72ab75e9fce09773aa7b9f708f1ea82a2304157166e3377dfc5a28
SHA512058b13e6736e46dfa340cdf91b14fe318c6ba3e7fe5136b2486c6d360273ba8d65da9759486aca8af66c777f39ca554d94b0677cdbf5e9bc9b2d84c0a6a3d049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5704a0208be978183bcc54b65ddc4e7
SHA1dbfe17a1733d2ffc5f2012d3f0f28b2d4138371c
SHA25645bf3e11f349c652476b13d37d4ed2966241c3c904d6963241885c8c63f0081c
SHA51211d064f4ab3689dd02541afb64ea72343f0f7b621e8f0ac34a7f6a55ec8fcea8939d2a4124d1b5e71524e9aa42756210403d27744aa875c6315e5e679f49ee13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5677dd810b6f035123e4628aec82eecf3
SHA1791deebece96dfccaaadf58de4b5055470f0ecb3
SHA256d2ce4d9bb85cebb2b2db38edb09944428fcc923e7fea4a725b427ba24ed5de9d
SHA5125616488341dd3078ac2cad52a796e6edd3d8681da412b64aa7f5953042b54636cddeb12b2c828603b1a82496fe078b7360439dee4def85101830e72c509f45c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad21ca037922c9af5e7532e93799a79
SHA1e588d1a386c0ae7b5221711ed4251fcc968b87dd
SHA2568dae6a5e51a93c624dbdf7f6c8821c7896b76948a57745d9015705740b32321e
SHA512391c7f2ee81e91faf51c5a6fa2fa4cff967b3722f5bbc5223edd22b721e397f9c6776d5de6f3379adc3305f5f04915e2d1c398da91e134943d0cbd6c8d302ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a2ff8b229f6bdc78df98ca0e578395f
SHA196c46e2014e8dbc525e82e5938a4a5f39ea32161
SHA256e0c52d1d00f1c2ea638a95222c46338e9314418ace48a13ea09901e35adae667
SHA512fe39afc9ef3d6ce6148cacfa15479d3db62efda1bec9ba392492e3938dc9e32649481ba91960c58faaf485ccef9cfff64f6cc4d880e9d03a0f5406de4f82e0b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc0c6b57db27e39e0e59d4e97572bc56
SHA1e0116b827c2ef94165b26489b18fef73b72ddb72
SHA25675b7a824f2246cf02ae7a930cb210e0416f7a6064ca6a0a185376ead8f2bf2fa
SHA51202a6812fc3733bc77b65cce8f1a3612612eaeecf3f74bb0617b9c663e432a9ad4f53cf25ef19fd6a8978a9aebb98d92e12119989c081ff5b3a8dbf8392d427ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba7d4a66c24b0d866401fe32da79f9ac
SHA1be67bd49dae7a8d7d769d3e353c95094e0dd40a0
SHA2561a0ca15e5bba68b61d1b447b272978cda56c9b67f444e8ea05b50e97ad0bf985
SHA512068a3fd7030e1fdbeffb8196bd60c3e71c9aee352662779f0695d95182b3206090f02388d7fd22a8a87091ca808a41a066303295f6aa8faf62fa8dae650ed2ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a22407bdac2e0917bbf621d83a06a366
SHA1a40bc15233dd0d3bf2f20f02ecd4ccdb69b170f9
SHA25677fc8435f31949d9fe29aa62af4f8660727d7cc8ad601189ae16a55e6bdd9be3
SHA5123209a84e872b52ef6b83f9496e0dc958a6677668e92446955e8bcadc61674bbd3af726c14c849a3a2704d5cb5d987a17b2f4f2ed51693cc68b5bcf54a36ea280
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a