Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
ff00cd2a6c959b970ac32688113bb9ee_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff00cd2a6c959b970ac32688113bb9ee_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
ff00cd2a6c959b970ac32688113bb9ee_JaffaCakes118.html
-
Size
2KB
-
MD5
ff00cd2a6c959b970ac32688113bb9ee
-
SHA1
5d4293d92560637f4cfa9fdf944e98d617a2303a
-
SHA256
735cca1370d49ad9b8295b7181aa815e716642eb90fba0f25a189faa3b32935f
-
SHA512
a6c74847c36c5f1720659f7c018ec24361e3ac77efb0169c98bac132f816ea6b7cecd47c38a41bb9de375a63927de31ef84fd462e34364f74ba019b655dc845a
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E5A5181-FFC4-11EE-BF06-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2011a506d193da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000005a4659d1b146e9747014eb7046efe064658f352d2025f7ccac7350b5c1c5891000000000e800000000200002000000032473b9d6f10f366f5a16dfffa567cb16cb5e7153d58751fb5bc9f75d66c8a5290000000f169e7fc423321c97ef2cf2c23bbced3338b1ac4e167934b3f28072a1068e3e1c00660dece8c517851611f1e28ba7f66317e887e1230d9f2321e1f1c9764da68a5dbcea7adbf02bf4c3161ae9eb0c73fbbaba705f8da6b0dab98a39f14fa4d4d07265e00fecdf985e2ee34db7de2d3463a6bb82e063d5e434bdcd328bb1e95093d39fe8cad57dcb93ddabbb629cf396240000000c96db4c9501e55dcb6b5d325efeb971f306aacb9f648cf049fe7e77681a5d6a8c7e8439371e00c445c164865fcb8d97d42933343b50191bacffa24b453ed8ae6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419854726" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c1efe5fe745ea9b2e8656f731ae2dc49c37dadfcabb5fec7d944efbe43ebaf39000000000e80000000020000200000008e09691aeba4d926b295a34e49b56f0b6cddd8c05aebadfb53012c3b2840758020000000d9dd449368b0aaf93c1dda0d35d6a13566ea86a59167dd3896284eb7f8ba626440000000aea8cc34b14c1f97f0ea54b54fabefd2ca31cd12f2995661d5eb96bae11a2552a6a472cd84435fecae58995fc41a232536f39461020e91805dc5798a21f70f76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1384 2020 iexplore.exe 28 PID 2020 wrote to memory of 1384 2020 iexplore.exe 28 PID 2020 wrote to memory of 1384 2020 iexplore.exe 28 PID 2020 wrote to memory of 1384 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff00cd2a6c959b970ac32688113bb9ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d88b91d7f80c2449b70569a0edfc53f9
SHA116b066ac39c0e48192b2da916c60cd268d994f9a
SHA256e8961aaf266c0f3619c0b481793fbcfa035cae076fa83421697efb7d37675b84
SHA512f2a6cbb04dd1a1b10325f0974ed0c570a25164b55fbf5f7fc85097ff0b01c7f4bb6f9494833a50c94a642f82380be598be45476f2441ef1c29ba1fe67a67309a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e63f0f9d44cf1a7900174a27e8872d1
SHA1ff90474580d5c2a651849c8a051eb7c385aeb8e3
SHA25651729e0ccc0969a81008c38e4ebc64b20be5327b3149d9d18610956af515b95d
SHA512caa5d4a4eedcb5a36b0505e1a4c56342995a2934897bee9991040a8eec1dec5b50bef9afbe90d61c88fc20d6b81abca7448db3f1348c1da410ab1653693a0640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff8d5faa654fb7ab8806e60bdc79d9c4
SHA1cc82b3a51da6cf6b7b7fc4ef347f7d3d2ae0ea32
SHA25656ef3c3446006fc25d5ee78f5d64fb17c0d684765357bdeb8aa253e84a9b6b02
SHA512f52e7564f2f9c9fef6b937a354dc3083b44266c889cb03fbdc750dee807e55e406b63d32c4a67435f9bc5a8f1fa8660e379fe91c4f6be24c3821d83b627c166a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb3fda2d15c2cadd2b9eefd26a67892d
SHA1055e955719de4b788745818ffac0c73945077f3b
SHA2568d4e3df4068843a41e33d1ca3ca291b1ee5a1af8e8abb5ca5bb2cc58739c3c64
SHA5126ccc5448a9c5d7f6b0684c821e5886fb44f306f9af0923b6e8d6a44c21f5ef7973762027bcc4e77e6753a1c0126b8adb4f1c7d7ae2860a7c351ebc599757b782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d12d00beea578f32152abc1098c2903
SHA1b6a66275c1d1b71080aa39735042a7d26cc1a7e2
SHA25614ab77e07186a23f3b248aff75b8d436967e4430ee8114dd273489b79d77cf19
SHA512d846758c1e4ee78c97508db2918aaf5b2ed9824f7d2cc61d4a3498c43c314acdc013c552bdc73c61b5e0d7d68f4b2a5cd41c1e8db300cf1a67c0f16bee5dc642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55640b666267b463489bc3753d0729d62
SHA1d4a38757deda87e64e41381b29b46e575cc8ffce
SHA256ed11876d5a6b58204d004dc284f561dfa3fccc2694cadcc545a42c15487b92e6
SHA51200c3b9bb0024d854517ac2a4eccc078fc0707b624f1a74c942c99d90b56cc22f84e2027a136cac2bfab939da6c7e9ca62e1c83fd6aa097fc24c04271c49a024a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cb63a3cc0d1855b5a7388d0c92841b1
SHA1c312e1c9503730c885b9f25e181850fd5bdfaf1e
SHA25611d6393ec99f7e5f6ab588216da54847c6c9021f29c045aac78c72e06bc70ecb
SHA512958b07a0a72d05b352ba529a6c48942fae362198dabd880478757d2c910436af7d9ecad2b7464e4187749a2c1298045f2716c7bb3a9e93d14bf5aa71b4dd247f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b40bfb4d8c66dc4951941ae44a8c41c3
SHA16c6d5329a13459982fef76cabfab68a1e1cfee5b
SHA2566a9c04cc03021001433cc8d38514930583f51b8012ec7ab5ff8806cc8dd4b9c3
SHA5123323b162025ab02a9b26af2783c1e4c6c7dc37e6273231a0ebd07cdec6503ac95260d1ea6861473e80dd7ee1d97134236df6f6b19afaaa6c83c40909feb0eff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a68f244a92b2e32ad337e7d6cecf5772
SHA1139193087ac265438e65bf9160e3a2111a06ba00
SHA256de4360313696589ae0fe936cb59dc4d491296be44b3fb629581933fe9953b5e9
SHA512b2af8f40f6d5eb156ae03e2d9c34abd8dea57ff01db5461ea4f2ffb265a8cf9b30eaf09bd56815d9a342b1cc99217b7de2521d2260d58226f8ba473c5a39cd59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fca06bf1b03bf68f450eb974f116b3b8
SHA1a0f41f67ca49cf3f2c2216b577981a8a9fe29849
SHA25643ada275f207c5cc01363fcbf515674f894f94bf4ccb9424bb2130b19fdaf12c
SHA512ba3ea6d133336b656cf8a33560b1cef9dc2b5abc8d6bd304f8056cb0626315551f49959b59e1fcb75c362d9a5e8b2137a425fb962d6fd00aa87ca984778e9d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54585806cadbbeb7ec71b4606a62ff45c
SHA19809fa71c7cf9dbd36fc51ce5d8ac1916a15bdbf
SHA256a1354e2c9ef954ca8fb813827845393d3959db998d58bd3affda572d963dcdde
SHA5125395e51f03b27736f1f6a0808d3529009d44b1cd89a4f17686d2c9a3e8f68402424bcce562f6c9c43c8e8339083832b4ad7f7b646ca15a84fded0636540047e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5301bef7b07237e4e5806015045757153
SHA1a7a71871994d580f0910435b037260ca06260140
SHA25652100521df1e40dc8476ad3f1f503f08ad4b36273d0ac5a461bdd790095e6d41
SHA51235460e52be880f02f5a7edb6c03a44d1e69b194a8d5a461573cd004ca563ff3d94d70abe62e88bd1f733c2335aa7e94fb634727eebd94169cac3432d1376e332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f7a630987b861af4e9378ff0b567c5c
SHA1de8ccafbd98d51afe3b31be151bca849dbf50536
SHA256caf3304ff161c375d8dedfecb2bd5ff845cf52899908d1c9a62b8f07fa0003bd
SHA512eccc6b09e5725231fed6eb2705362aa84eaddf93589a6d8825efa6b59cfdf5fe95428e7ddccc992aef9673fdbd1ab5d401af7d6ce4f48b910645ae73f88c7a3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5badda9f5a6b48f264659f11338945e63
SHA199b79236d184ad945362505895758a2fd810f0eb
SHA256addaf9b95e5ed3bbc6412d5b89e7b3440ca651aec3a40a4d67c93b3c89764b3e
SHA5126b36400121cf260705b646609d3a2fa14414df63a91e31394b44e20de70a5d3b2d6297bb89146dd044214f0c2bef75d20ea556503bdacc75a2402e405baceaaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ef189a09bc3df617f6159afe0bffd45
SHA16538f6ab32b85704399001606603bb29841b529b
SHA256cf4d74ce8983c63250e251a39a7585b705fc8bd20549e915ee715ab3638776ec
SHA512c1bb6c546d0601bf330ef8977ad28b074c1cada8c226ac2e37d2bf3e10aa93747167e110e1b8717b7fda74743bad2a84f49fdcab87ba8abb531f7f1f36bc8021
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b2196b92904ad97f78d385b21d4a78
SHA169ecf2ef4ce23427902f70f497b0f8a9afc794dd
SHA2560905f1750dec1e9708c44d56f6a2640981f82b6b2dbbe659cff4942209471f0f
SHA512f6940d39ed3a81e9e1742b6eb4d4bd5ea898469f9c16e84130f0158b5c6d0087b96d79e235ba859fb0b048e6873bc69b4ee195c888c51db8ce37260ac01acf1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab06f141c6078f458ad8561e3273feac
SHA1ce41f84b689c8333b282beb0a0e288fe51272dd2
SHA256e9dda4f9427d64e3069ff057d3be942fde5793e4172c8604008b985409ecb578
SHA5128fe368c8fbc4a421276c879e57ce1c00abd4d0307e635da61b77ccee27e8053830cbb4ea1b8416ec9953f9a8a66be65d04881e0f74d39185019994763f87ce2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c57b1eb7a06b62744b846932ab760e9d
SHA1b80623cd881fd441cb3add5c2611eec64ed2e475
SHA2564cb396127a0d4a619af7274a7f1624b7e0ec6a3e925d61119da8ef389f7f81f9
SHA5126257539af1241792d94370fc83feb2ba3c9e8e3b0a6c52de3678b8fe27dce83fe964d4e8b953c2aa959697ca5baa38efe8c489846f1a04aee1499cb97c8e91c9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a