Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
00177d6eac731b91d76c14ae73d50296_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00177d6eac731b91d76c14ae73d50296_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
00177d6eac731b91d76c14ae73d50296_JaffaCakes118.html
-
Size
36KB
-
MD5
00177d6eac731b91d76c14ae73d50296
-
SHA1
b40744981d89dc0c2f5398645efe74d73eae2890
-
SHA256
720cf0f11392282d212a5714c1b51cb29645e3d87ad7b7c0e30bf706196acbe7
-
SHA512
e5d5a87375664f3c400b302112d6d17699d08cda9c0830bd89296edfc909ae797a4be1ff2661b97d8b92158faf32a2641802cffc4db32d22c7e0cd4ce46525ce
-
SSDEEP
768:zwx/MDTHRSR088hARPZPXmE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6Tbii6eGx6OxJI:Q/yMZbJxNVAu6SQ/C8YK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420241597" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000d22450271951e07016a4ebc6eafcc6bed948c66279c8f264d40ba02b254c132a000000000e80000000020000200000001a13aac6de0fc9718cc0b1dd45953226ca2ae82c3cfdced6bd9009f83e643f3320000000744be2a2b181039fc20887a3e64b03c457867eef30185b1b9144b289463492ba40000000325760bfb0334eae7b0a2da1caec61d523167b4fcb9655b3d7704cd912a4ae4508e836b3b10612a63a04328bb1f478cfb676a23447395f1cc69efd7bd599d364 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508060c95597da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEF7BAE1-0348-11EF-822E-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000abf713cf062e06b89ce080371f104130b681425812c1306836293f4ef28f8665000000000e80000000020000200000003b13f0f4a222e35b07e1824f0c91f3f42cf660de3eff33a7e063356d45a7141990000000d75de7bf81ed038d045db9775e94bc4294f7988afdbc56794f7dce66a76f302ccb7d27671a5571638ece8032e6341cb171f50f58de20afab03bc5d65e1553c334e500bd5a0b09bf97a24f0fb7bbc41afef1444514e1fe8842318eb28926008188a3db1fcf4dbdb4257b41cc90f7241aa6833558ca77e838427916b64de3f548796b821acb6289c6ef47fef984cf6e80a400000008a15615fa00ef60594fa48ac96a692434392678027ab02917c65073ffb4e23fd4e42229286bb1c0ead2edb5938242bbd6e04e27287fa56d382d5580f3114088d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1504 iexplore.exe 1504 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1060 1504 iexplore.exe 28 PID 1504 wrote to memory of 1060 1504 iexplore.exe 28 PID 1504 wrote to memory of 1060 1504 iexplore.exe 28 PID 1504 wrote to memory of 1060 1504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00177d6eac731b91d76c14ae73d50296_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5105cfadd56287685e4b117116ebb8102
SHA12ff3b98699c9f0f5004231c36af42ae6ca7e6f18
SHA256027684946ce8c45e5651e45aab746ac3c8423f8edc90a021111519b5d1deb3f3
SHA512e654a40c715ef53f6bc65f4c5565231999a2c4ec73f0185366521c002adc40a4ad1921cf274ad9c24b9447cb4b1d8ce6968e21d8cd0493cc418142d9500e633f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51988347dbd8592472acfe1140cb977ba
SHA1fd2184b2dc19fbba83a22a979dce0f92646e2048
SHA2563d9d9c29193464e81d7c6047f6fdc32d7de0756b9ed895b9de131178a75516d9
SHA512a1ae0658782a9e428f8711f0f30469c611daa4bdc235f8d6d5bce1236dcd1543330e3e9d4e341022c89c486e5e72238847e62df2e50823c429bf37c13cf58a19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530e8526074989687da9e1903fbb55781
SHA1cd2451887afc4aa70ae86753909aaad6d2c981ef
SHA2560c662ca61705a95340054c99601cfdbea075ea93de9188173b600777bfa556b4
SHA512cb0fdfe6a0c61dcf49904a8c414274b8e55865873700d4f1e67d638e8ad1149fa82fc925bbc20557792064732d6dad1ec72de8cf8a9485d2adce0972b2f7d3ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569ae4d109a20b8b1604af514f3a23596
SHA15d8b1e32300a274cac3970bd22def6be69e62f96
SHA256350917928de21e0357b5cd5e49f51fe9240bdbe533daa4338559184d393cd9b0
SHA5124a395a4dfc2ab76a481d281d906331f04799099ee41f09e0803f8ff296b3676d22a6dc2dd6cffb0641a8570a46f1276646ab61962fd26f47ebd88f9da145a6ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c380763c018f8a55de60214275fcc506
SHA1688a69a284f861feab389b88c3be3c5613a3b49e
SHA256a5b1d67244dc81b109315ee661ff7f4f0fb6e1a50350747434bbbd91aa4e3fab
SHA5120839a553077a3f919a37054a5222707961d13947b9fc36ea51aa90506a370c1f76f51a6edf79bb79955e3d2dbf36a33f2f41b29b97727afec0b1c6ba86d8f07e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559db5414ec8242582f97ca1ad428ac54
SHA1277f6a004171401c55215f3a2843a254e70a61fe
SHA25672fb76367e74ec9d124b1e1f7bd3cd428c5d84b15d6abd28af508f5ef61bcf4b
SHA512f48d549a8f3ea4a7aa9add91460bf81c0c0b478a5b65d2e0b2962ac52b87b114e798c5742a86d824dd7f7aac8805c1cc0aebc3ad1e4f9ed070b51355c584a47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a18ef5d6a5c1eb1af70c1e5df642209e
SHA10c04bb68a75f0537260dc05cd0996083b59c98de
SHA256c26e1083e1cfa5de5772f1b0195b0e7699955e4faf7b48713ef1c6dfb8141a39
SHA51279650812f189486ac673b1a036d232a3627089d44939255904a6850359b2b2a424d71078af48ebad5338de18feca2de7a9429fa624562aa96c0b45f073c98201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed01883daefc3da16f1d6279ad410bf6
SHA1cb085cc5de0d91dae452ae0dc0a48143b15118ca
SHA256989b7f452a36d78fa12228caf0a6e556c15357bcfe9d447b153531ffaf8ddd79
SHA5128a62bea1a2453f66d2063057daf4386947094c61371267ca3157b2e4754d25b09b15e9d68bf7ab526bccf0c6fb1d9bd261e0ed9042dafd59eeffe65a1aa5303f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5885cc1639790e7ed3525bed48670fcf6
SHA1d7486ee928441c3c096ef305d5d40512b5f1b302
SHA256d03a7cd6e8e83e4803f87a60a6194a1cfa4fcdefe59d38446475c72f89b816fa
SHA512d65be57ab3669d9bfd917bb58d06369de7d6fcd147eb4549d580aa34ebc3038cdd2da0d4a9d941f34878844363ef84251862fd3c7d5885773c399025441bbf51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1fe728b0d39bcce3ec31e0e9c278ed3
SHA1e9cd572591ba184563ff92b1e314791c1393df80
SHA25621a43c8f8f30a68b8056ca9537a355e78e98fe99628225111b6a00073cb49740
SHA512436078d12f97d9b9bfcaddb3e371f3cd1a2e0e7b4737198d75c0de96459f37ebd2b6a756c58f4aa76c95dfca0ecbf608de5865aeb918fa19b2827e85fd12a18f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52be912594150ac2c84f213a06c5e8e67
SHA1a99ffd4042c961e1e393a5044e02b757c64f2403
SHA256d15dea489e92a7ec4aef2e42fc0c861742e673977c11ab17ece510fb6bd1191a
SHA512b9f7a5a1dc14a33ade75764f9e2cb1f929bcd4be2bfc8d9f448b282abbed21df5b743876523d896379ea966374eeef094ef7763a998de8a7bfac6cb289291ddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cb91e6bb2ef4ff4a9009d7238dde88c
SHA1c0696f3a33204105b7ea23a14b22dfb06d9ff3c3
SHA256e1f4794186c967908ff40ad8f470f2f0e937f4ef0de015971d5c4b1bdb5000cd
SHA512b1fc1364fb1f5cebeb643b567768032523e69604e6b4342903bb2df997dbd45715c241cee0a1964e0fe6b50b7bfb1c5f78abed774d8eacfdb3eeca2f0d66210c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD50aa7f1e23d2f2ef19a7b8d526f74db8d
SHA165b003e8acdeefb078d0249ea0e64b4bdfcf69f0
SHA256d6a7661105a713bf7a62775dc18d4855af477fc4cbc05b9aeff56f39998dc6a1
SHA5122924ea05d0b74ed01189376e40c8d853ae44b895f36be4598b4c0d70b38debd49518fda72cde9d7caa332629bfa5d504399cb81cb74d79df2d065f24a09adcd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD520243eee834424ac723097136cf3a90c
SHA1490af5d83241502619d0ff3b7359ef0a8854e638
SHA2565fce069fb81244866976426a9c4a4ef716feb6c5bced7cd4856168b995066abf
SHA51271c37f0e8d3bd9d4e8c008f10fa2233c008254ea41960bfcaaa0e61506c64638e9886264212443ee4dd0c9019e3ce8338badce3d0d455063266890238989bb75
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\3ca36621bfea7bc2fdcac906a60b3044[1].htm
Filesize162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a