Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 23:35
Static task
static1
Behavioral task
behavioral1
Sample
01eb1cf2b6d112e5a3ed90d0c4865271_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
01eb1cf2b6d112e5a3ed90d0c4865271_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
01eb1cf2b6d112e5a3ed90d0c4865271_JaffaCakes118.html
-
Size
54KB
-
MD5
01eb1cf2b6d112e5a3ed90d0c4865271
-
SHA1
8d3d1e5712dfd4285681eab045ddedd2f2f08841
-
SHA256
5f7056a4259d9196eb03f9fba800d8d4dd735349ec7798b307494e361e0fba92
-
SHA512
0bc53a1e24b48257fbba4241b3d6fd5c786369f0efeab2a22d5b63d1bd9d1517887e14bd05414beca0d61e14b9a31312edf1df21ce9299a9f824c4e0b6144b4e
-
SSDEEP
768:SH5OhnlrZDyk4lpHXlybXcU+s6eV0RG3M100+oEOY:SZsnFt4lpHXlyb9+tc0RG3MWEEz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108dfdae3298da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420336371" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f8e77257c934bb7ea4e136b1b2b2e65b5943467371ea424642fdd89bd8969ca4000000000e8000000002000020000000f54c7788938fd004701c823648331c0964430baaf9209a4b102637325d95ac8420000000c5e34750dc287d7386b516c6efd3d74775bcc35e8fca0a11df978e482d8a570d40000000672bc88182e138bebb2faeb039b68e52163dd2644dad523b9f8f9ea309032c0c45fc2e396f11317da8b163ce51945c574e1aad175618775615168dc9a7c901bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000af48f391e2379df10327db3e8a4f0dae23a19999ac90d14d5e4eb88aebf8b8b6000000000e8000000002000020000000c84492a0bd06ee6bbf6e9cc00fcce6b622dec1ae5b9d8946f57488dc85919a21900000008895cbad84bab62dd2aed4a6d839352e33647b69a40be467e5e1e4c1bdc80f660e7d3fe765166988ebadf1bfe70572d03f1167f3b6e47ef84b2589abe4eddf983b544ca50e8237edc1464116f9b12699fde09baa4e731aeb04a89485e7767af31dfedd63d6739b0bef53021ac2d3d998a87e5f1b37ec839c23b94a25c26eb61eae93cd5d232baee975ba6257591856bd400000008870c4f571ccb06969f9f700b157c9ed30dfb704d9e4d54f18eafebc4aa060d5056260c60ea4287aeaacef105660a3f24e4b3c58ec4e607f9e0e95c29fc490f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B9ACFD1-0425-11EF-B0F7-6EC840ECE01E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2204 2008 iexplore.exe 28 PID 2008 wrote to memory of 2204 2008 iexplore.exe 28 PID 2008 wrote to memory of 2204 2008 iexplore.exe 28 PID 2008 wrote to memory of 2204 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01eb1cf2b6d112e5a3ed90d0c4865271_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e070ab24f82bdbdbeb7ae4e5c3413462
SHA1880ea540175ab35edfa2e6e595a6f029277f71f1
SHA256d66bbbef8d80de542ed15f008057c9c6f1a78c8be1844f7e7ac837b2ef12035c
SHA51290744ed8548c8e039fd1b69409f22f5cecfbc9e8fcd2d50d5277a1d31fdc273dc02bf606af5ef51767844c7b84983288a6d4d1c4c746c9e6f2c1db8c65b722ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc1fbc61b4ddcb53bb18b379ffd18ea5
SHA1b511cdec899d84b35c76191304877161a2531949
SHA256520d306100442206a1d8e8d752d65b87a55de9a9c4f48a9637e064b68430cc24
SHA5128109ea3e7f122b9afaaaa5922a76a5ae751f3e18ee7264a56ee5943f7e2e0ea110bbbb0b2639e092b7fdd9567f474fd20fc966792351b06c62180320d8bbba4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5670c2ae8eac1855b3404e07125212d19
SHA138b2f1bf6e317f4a3df0706f14eba36c294d9f9f
SHA25691c0a76411c2f36eadd15ab9313a216ff236754d1dc2a2b278f582490d2c62dd
SHA51222dcc9176272833ac643d470592a402cc3ebdc1a1d03a836388dd7ea0f0d2babc2899346da29706d010d68031a41730a9669efc69f595809c36574255025bd05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d694807727873800c1d7d41e6320ad2
SHA1e33a0452554f0d5d651727116b738d613c717602
SHA256663edeec376aa1d2701dd66f22d1e9898c599519c7fafc8989a48b532c84e679
SHA5121d840d6ca1edf60a6a14e0b15f562689574e55ea3809b1932d62b51249d7f626cd9c0434f9a126d402df3737ce1803fdce4a3313c1345d8d349e77d1bcfbea88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f80095a8f35506c818994d7a4999bbaa
SHA109a8dbe4a93d64baefe7db9b056706ceb7444de4
SHA256b97a5526111d2a1d9fe8380b906587a65088d25a824351b5bffa20115de86f3a
SHA5127c8a14fab190826943d3be8812430781c6a482126f17551e48baf02f7bcfff1806d3ebe8be78643dac2a63870a0ac7bc92833d01296529fe8f74054d428a43b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f64b1c9ce230c6af64569adc89932ea5
SHA1f5abbfbe08cecec05f8a3710dc2548eab7e91640
SHA256ba755e85e2516587373692c2b15eabd884474ad13096415839bda3b35deb76aa
SHA51219371cdcf8bc6490494e0950b83fa8d7208857184e2275c07367d03cafd8b75e9328a9d3998bbb2dc031265c44ae343d8d4fa1da34ec256854e0d4eace832138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af331c0f8a728842c9434870701a3b52
SHA1355d970e844283c69b827b220d4e7a8b87b2c22b
SHA256ed8776d45b250eda67f10c882209a2fac1bbf955d48715f9f405972831baaa8a
SHA512e364845034345403b4ffb469c5f83e3b4ed9cc492afc49427cd08002e1c3ac30687b7166defb5fe0c98033d73ef23c0710a0e27b4319548b40988c57a59fad17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f307adebf4d21267777e239315c22e90
SHA1aca30d69118ffee04cccee4494f9227a99eb15bb
SHA256a31a9b3318243c009b08379ee7666d26607eea01ffe678c5ffc5b0ab4e79bf7e
SHA5122de422425c7a173db848aa5f6c27f3036147e50646598669baec5205c1d4197db78b3950344259541989ee7ed033fab303c92244380f598164b7a9697e200869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e94343e7d9b6fa7dcc0814dda30c53c9
SHA11ce5374eaef57fa617cbc5d05ad4c5fec06a3030
SHA256b7dc1c207c3ae691d68c831d2f056c490f2e0e34d85d2c1716b11e87cef76835
SHA512b349ec2f73aaad96fb8179a07bbbf3b71dbb41a5bd07ce7b0d46b15cdda5e0401125ce16cf507e373350d6b77567ee75138ed6b8eca74e7b532b8733b7c8949b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a6022fd352e190cf04f1962afb06ea4
SHA1de68b64a14c21b9460248f248892fc5086671684
SHA256578012b8365715233b2b1b8bce2931d7ee3932d6ad9f6aa954f29ab5d9afdb3a
SHA512810ab60cf9f50a06353f104d233683a517ae8ed1f004299996c318e5a93afd7869a9dbd3e326b3ab3b7d2b36b634fb17e4b03b0b08910279d181c664f126917f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55636da71c3b5b6fdbf2854f10263e3f0
SHA1fa5603df0fb91eba0e9b6914ccf799f9211ecb74
SHA2564b2076f215aaaee2a8097df59e93e1f622e29661ae85537b65551c6f04ddd5b9
SHA5120a6d7e9639964e3136e958401f3d0f02b4cb5399b2aebcd6c8a3cb4508a94aa1905b245f21572b5a8f3e84648cbb418c64486a1aaee808679da27f5a1439ed84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be16a08d2c4512ef98d893179361be7e
SHA1408c4a4efe97cdf3afdff079ee727bd25891ab57
SHA25695e9acb880666e23127d9b7bb637aaf772a081ac4de4ba9ead086251595b8c80
SHA51259b676ef3e8931b037b75bd8790f5a4186e7fe10b2aea7585ccc05921f775f1924da4696300dcef5cdaf948bac481a2b9fb6da1d359ff9d8e1e5c4a1e95a1358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592f394cf49dc013a5d5f3e2c462bd33b
SHA1f5fddc6f39d670bef8b99186762ee530cec15bb4
SHA256bfe0d8b6215d9f8f36473331215adb6951a8142adc32dac1a8db8abc01780950
SHA51230aa1bd2aceb127f8107a80570b6886e8f32b022a494cb722fd03dcb1e58eb591caef266ba5258b14f0254ef8c17e052735560766dab3b8ea3e61f4d5e25497c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5344df84239b5a422207c56890defb3b3
SHA1d8f8d1353cbf058f846738c8b806dfb3062d943d
SHA25681c6623adb117d36ab871bee3d34d55fa6bfd48f05abe4e1973e9fb71fa60d3d
SHA512c1c29e636ff88f4522dc1c6a7eae124fee7d2d976e19ed0ab686e37355a3d05b0cf12ea22fb0c492694097f715a6556bbacde86d09626a88b0cc812c4f9278e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5769f71ad1adbc6f20789d93f0b2727d0
SHA13c928ab008843f00a38aa10d558d0ac0d58dd8e6
SHA256bae35e40a385d0ec824296902fe5bace19199f27466511307cf4fb720d6e4508
SHA5123f6f37f36e6b791cf47a70175e55521d7af5a0151c6d65ec6f65b0af97f11351019ee68df2d880d5cac663d8b2b87b184066d7b8141c80071aeb8bb48419c21b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f9282ac31920ec8ec8c1d736b6a1243
SHA16f3f82641c193e0de6125159db887a0790aa727c
SHA256fe687fa42901fa3ac7c6062052b75170705d7c9a1abf395b02c013d657d948b8
SHA512357246870b2c64f1db66c84ce5dfd9b5fbf26835f7f079dc805088254da76b20f2e9a3759267473e91d58e973ccc0109b8f6d1a5d834308d83a8765f999b0124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5138f5a5fb49942d798042d9edbfef06c
SHA14796d9286c74dce083b6789b9e354cfb2bdf0be6
SHA25604f09af74c068243c648e8465bd19c1b57f426f7db2cc5094862e511896ab568
SHA512624db2003d40fa75044436d5eb0a11d956e01759ed02d4ecc10fe2e90ef6dba4aebb546eeb260c81bfca0ccf6965972eb3bca4bdc9b48d7423d32a8fd4e86673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b747c0564499becb596108b6844299e6
SHA1887cf07519fdf083c3e98480ae502b5afed7c3a4
SHA256e1c7ad35bb1bd967c34359742b6fce6d465cb8546eb2497f0c07bab77d6bfb47
SHA5121a422ceb3074c442e4d78ce29311c89708133b7191b4b8aa023274219b0d0b69e3f1866a22ca2eec1a314766da26e782317c2e3daf7e8043d9750a2cb534adaa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a