Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
ff00fb7fb9fc06ad8a291eafb9e255cd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff00fb7fb9fc06ad8a291eafb9e255cd_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ff00fb7fb9fc06ad8a291eafb9e255cd_JaffaCakes118.html
-
Size
11KB
-
MD5
ff00fb7fb9fc06ad8a291eafb9e255cd
-
SHA1
b3ab75c38dabab8c48560a0b2d4c91e1005af076
-
SHA256
e3a8cc0388e86194f9ab6e8e067dc80d958315500cd17414429f33717f289f44
-
SHA512
553356b73d577a9487565d755a7cc89a73e3be35fcd93254cd4d691cc9f60d78369b36700dc240e7a275e5571b75debb3de98161e458163542c0e6835e689d7f
-
SSDEEP
192:uu9c2jxMrL4XwZTWkxN5yWNKQPWa5rCcQVsxK+nFAHWFaF9Zs0UAIQA8NR49V:uu9c2jxMrL5ZTNxN5fKQprCcQVswLWiK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000004538daef3946d8e81dcf12808f5af8aee05768ab54e40b9831bb2735ceed8d49000000000e8000000002000020000000581aa498937ad3cf0ee0527406b2c5890e6b01ec4227a785653f2e13dd82528420000000605812073a8be836786a57f6748a41ca7474ada91b6981980e1a316d2a9fba2840000000cc3d6962872ae8577527829e96f5180d29ef680e059121f9f123587b366002e5c840eebc3328d7290a23492754274298c8cfcd3fa700b6e7bcfe7f9474878353 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507a060cd193da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37710251-FFC4-11EE-B1D1-D2EFD46A7D0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419854739" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000000a3b3cb9ac6675cc55fe7dfe8ed16712d686be8c233d48eb9af9437c2667d426000000000e8000000002000020000000cc84f7b28ccb6b829aa5bd8920985d60137f67d1f839f5e78480872542f2a27590000000d8428a4ae414af9e22b694fa8df2c437678d12530a814157aa577d4c8de0a576ecbe95698fed81598de07c40e258db091efda4de093744af528ac7106dc185221690158df15d5c1c31f2b7ba9d788b0a576ac4d98a44f1a3039948ba5ce9bea1d10655711a4842bcac841d96ba2d6dfb09c4391378a2c3f26fc56e6a6edbf04ef127d6f1908c513f9bc8bbbe23ff3c4d400000000ba527ae81544f57cb3e8c1884ebd97dae5b5a03a33ec6a4f7c5868450183208ab267070c5e3e84a0fb1d7f03b5976fc9e49e3d5c894bb89e9f21cc5c47c012a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2864 iexplore.exe 2864 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3024 2864 iexplore.exe 28 PID 2864 wrote to memory of 3024 2864 iexplore.exe 28 PID 2864 wrote to memory of 3024 2864 iexplore.exe 28 PID 2864 wrote to memory of 3024 2864 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff00fb7fb9fc06ad8a291eafb9e255cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5793eb87aa1949c6d84c6ee90594a84a3
SHA132d332dcc0cf8021a5815a70190fbec7c7dc7dd8
SHA256c91b1376797152c172109591d4575fc1e329cab776ce0bfaab802f62d93c9827
SHA512835c901207f4c102aec058737e22635b2beef98f251bbaf4fb2d843aca7f8b52e08bc594824dca208a29b36b10cfa7ff35f0507b064678d268a1c29c393fd527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8ef7b0f125ae2753fb34ba04a63af3b
SHA106e605c1efcdbfffd291468a3bf09d2a68ac3646
SHA256addae32fa557b169e7f13e4b69403b1887eb3835c69df90665b1b8480b94d0a5
SHA51271f9539822cd87e86d717acda7b3df47837a9ed393b7a858dba9233bb1a2b783eacd98db08824f7b02414706428d73b2f9bb6edefbe53d5a6cfd8a812069901d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581b11b850549f691dfc7b74d2dc1f63c
SHA162690cc64a7664e085e0ce52fd18dad552a1ef6a
SHA25615e3eb31bf51cf41ffede5acdca00a80af01eef2224f76229a9a90a56c0c0469
SHA512783f10c89fe961a70b93aa7176f9de568b79b5b1bbba6ddf2d74064df8deae98f1480ec24f79d17623642b6b382878ef0e7336c58657dcd95ee74c3165175704
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5376950bc074f891b915d97c945a8d1aa
SHA1b5579c2adb4996ac5bb3ea092268085346b268b4
SHA256863c1d6a0bf36bfde0175b5d2cdc9ac645fdf688a985f0877a0cce0235831745
SHA51225c4e21d94feaceca8d594e3ef8220e710573447fed63d7d77944cb66e979b3bb55dedc628e860e8827e209e2e466cce44886c7aa034738a463ad6ab9d9a1385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b92a146d29fd67c94687d730282fb831
SHA1d9fd6ad4018209fbdb8f41868920e83301ee0de7
SHA256971e12c00a42600811de86067b1bd2a9fc0bb6d2329491676232cbb5fb3a2aea
SHA512d21461a303460f4c8c20554303c9315aaa08ff453cbeefb4660960f18edbeb1bc65f119de060d371fb9a1fdc8fa11baa40cade1e9012abb77dfe30d3efa39a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbde6a044094b668975b67704737da09
SHA1e57f56af5f94cd76cfbd6e647a04ee64767f0108
SHA256a474cd7b5a4c4f0051bc36f0670184a9fb03d06e8fdb58151f4223811d9695f1
SHA512ef375c4f8347ac62280f703f4658bdce87ca5b98894e8fd5b3cba3a1573f2cd329c96629345b3c8f51c6ba4a534a47ae5dc80dc3cdf078bd97028ad5137a15fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdd3d585d1f26d90fb2bb95a7fe0c02a
SHA14f9a5312e527980fd07443db13a3da0bea89be9d
SHA2568dfaf51fea16878210d6cd2ce04a0eac966f8a481a6b28512086be251dc312d6
SHA512a628cfe9bb148c26b597b99ab66d8d955306f1138d8e5ed5f7d4942bdd7a444ef14699fdf4f8c31fe15fa9eb7944d1d163ac63ea0722cbd047c3fd13606d4543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564f387ee48eacbb6b5fa1e9355688441
SHA1d21a9e5bf4c0ca2400cf110e3526bde730458615
SHA256c8d64eb686a96bc7c51386690baad1806573414e018ade9b14b028045f1fb946
SHA5127631b0aef71e80860e17299dade9183abe30955b3314599168b5bf002575f5033fe410238a635eecc8b1aa2fc6802edba1b737da182e03a25df7c0ad21748d10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f80d408110f02ce5a499ea4ede57f75
SHA1bebe5d49e428ea406a3f7194fed23af414cdefcc
SHA2564fe403f6d2f654dcdf8add406e03d577329fb62c11663d968733cdcbf712c157
SHA51271b1d31f8d320ab9f1bfa4c5e06285766fae861684eb17f8018ea037f2af0c9d0d44ab56a538ce2e37cb85e7b9e5a8067fbad3d0625280913925de227626e1e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d64644545b5659ec3bbee53973b772e
SHA1b80aefa632827d8d1a9a3ddde501270d8f8e8c30
SHA256b3363d6ea92898fca8c2655afa5e0b9d5dc39625c28b06018d6b9f06914ed785
SHA5126256cb2e4181c2ab1579550c07e1e132958fc95a4504f5875d6b3c5b12dcc2c4337d913e99b4692b7b7b5377ebf8b17660770d3b5595ab51e4a2424176d17cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7a78ed9319e56bd9e7bfd9c930ba892
SHA1eb3713110fe7eb62f4eb5dd07196f40327caf359
SHA2561f0e296423d48e03dafe411d5334a20d366663b058d1a3148b7372c8edfc1d2b
SHA51262088d3b0de4e6bf7641176f2bc02066b448345679762cfa853606efdd49c6185ac05e269d0bb791678cb689a70efa5470826bc25a299dd3ad2facabe2384186
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5258e9902e3bbb8bc48f17687d9a627a0
SHA1f071704fc4ed9ee9f76adfe6aed9b257a6f016be
SHA256f068643314a18245ee12d6f5b2fc6969c6080f0c10c19505d32f0bed13325d1e
SHA512e5217992c7e6f338af5026959511f60f23ca397b7f62b4b3dc71ed9c99c64b8b423b9f4d0ed713dc54552e7f23d1b90f3fc6bf134878c2a2876c7b95bc9d54ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b215cd603f89474113687bb68381ef7
SHA1f4e503de9f2663fbfeabf8b57af301c524384391
SHA256138ea34605af96af55157a8ef597ad2fcb38ebcfb0de4bbd336621574b41b20d
SHA5125cba8d6a475979bc39436858b04c0d120a9b33694e1a5fe1c1594afc34bc60adb023d23419cb8fde954bb14b15bc736d3b91338e349c7f7328f37a4f956b403a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0818fb3929725d9ca5f1fb92a9983c0
SHA1302214e303c8e4b4b5dafe6afc7107fdb26b30d8
SHA256c196223270030f84b8921f65a286e8e8689884bc0ca9717551cee8c8e5b28279
SHA51250368b47b300c21bd47a01d846dc59309f719102f16d98690907050bc3a6dbf924ce3ab65fc11b6636b4d64c3d0d5b6606d6e1ae0599131db6a8cf7c320151fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8230f49516bf1233952b1fefe1149ad
SHA1afda587dce10b44dadaa5048dfcd6c8671d502dc
SHA256b7520b1e6951e51f472fda121ab3e82d5ce454774ccca56032b73db31fe76a44
SHA5128c8209e6365c66d1cc37f4f0cc907f18a0360bcc0c9c69a40127266d6d797587f894b4914bc2931941b5359414aa0321e7195621822ac82195af4c33f2c93696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5164b4c703f5c186b7c55f5f3b4881f9d
SHA1f96e051dc7c027f8a40bf40a127a02b1e41aba86
SHA2564bd786e048ccb7049c8a427aaaa233cfd577e94057bc82e59fb17fde23a32479
SHA512b61174fd05ed8bd2d88cd0679fa5d92f7a65b7b5896d3b96acac3e871e303f81ca4f23917d4a0bf4d61cfa68c7cc26114a1e37594c23331fbbbd788b4fceed1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ddcaf9a4f1df91ba782eec73bad0152
SHA1591331b89b02609406594c0a2bad889859386d2c
SHA256c80171712d6161876d7212927fef847f71974228f6924aeb6e5500d5bebe083e
SHA512f8f1a40e81663ec9603f073b0264c2d8657a5931d56302c592fc23c559163429c33e23fa3bdb5b411c17b63c5a60fd7cfcb97443e99a69447a79e0bdbcbab2fb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a