Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
0143a537d2b5673d2f9b907664c1b568_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0143a537d2b5673d2f9b907664c1b568_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0143a537d2b5673d2f9b907664c1b568_JaffaCakes118.html
-
Size
456KB
-
MD5
0143a537d2b5673d2f9b907664c1b568
-
SHA1
78a6a597d467707cecb57c73def9cfc7328889db
-
SHA256
8bb936ae2e2510cf1601c319d1e7cb0b0af68931a8f9a4800a1f60c679809ad1
-
SHA512
31267f05d5ce7fc0d2b7e23ebbd3a624b10440541d54ba56faf4425f80d4823e84f6316487c5d836239ac98bf852bc5eaa2a8f6d333eb6d2e0bcde653780ae40
-
SSDEEP
6144:dsMYod+X3oI+YlusMYod+X3oI+Y8WFpsMYod+X3oI+Y6sMYod+X3oI+YQ:p5d+X3bs5d+X3eWF15d+X3u5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420313675" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001de5bd2bba99d46afecfe9760974865995f3a55860fcfe8fd81ab28de4d67ffd000000000e8000000002000020000000a3282c67fdc53e2f4d352c50f5a7f9d027949c4c30f50db4ef88cc62f68ae81790000000c7299f224a1d6123b01f95f57744b3d418237118346f6b43a6004c8502629187cd0cd36d823d9a959bcc6eea07d667aca4d2a8048c0b800f59cc11a90a6930c97fbd24ad147bf934cb5e1ca5c3cb434621be875a003b4d8451068b0f8451b27eb87eb8c62ddf52015f30759cb03fb686774651bb9a79f26c892c974a10bd4f399c5334331bdea5f8f15c27d758cebc2d40000000b5e7b5d69129dad43ef04164921f036df697491f83f07fb8752b09176c937bf85054a727e3c368c59309a90c64c3e1efcd6e432db600dd8ab369553047c4f4e9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008b665198bc1f8bece5e4eb6033e705b399ee8dd5ab91c9365db6c0c1e1af654b000000000e8000000002000020000000228a4364eaa65fa1cb61b5a41e80038f773f84d88ad6108b6b9639813ec75b282000000098163942c49bbc5aa99865b49c79f45a065771a3b690640151970f5410e4928d4000000032f53644305fbe023672e64ed7a45c592e953d6daeb0860a3b1ae63a958476d05cd8f8d091b80b81ea80e2ecfbf781f710fbe9812761ca79b1d79e5dd63a90db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bba197fd97da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C32190F1-03F0-11EF-9F07-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2500 2012 iexplore.exe 28 PID 2012 wrote to memory of 2500 2012 iexplore.exe 28 PID 2012 wrote to memory of 2500 2012 iexplore.exe 28 PID 2012 wrote to memory of 2500 2012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0143a537d2b5673d2f9b907664c1b568_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a36a441892895a0961a3b6e9e70bfd
SHA1d08c313e2851fc9dec0bd139a28882b5fe2d4ac7
SHA256fbc2310469a27c33a40824cc92b430ddb7762bf92f916d1b00a580c5e569baff
SHA512ed0474588718dfa9ae7276820edb0dd7346f4a5ac78cb5b97a6b06d8c512790f6ef4f3424c7ee7d8546b9904a96deb4426b62ab0ca6c1613e898085176e64560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a9d46dc00b5c7c6e08efcda0df5cc7f
SHA1a621464767f5794dbd73310a5f51124e79df18c8
SHA256a9c89cccbf11887bf79795eb837ec89dd12ee0a7db601a48957a12d6bab802fb
SHA5126fdcb99c920d002acd74857567cb437d0f2be412dad67f0447131a78e5488d545cba87ba2856682e47e47a101377f3ceb6e2059c612311fd1fc2327681cbbeb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5818811181555004469547d3f0257231c
SHA19b6655d961e31d492d72eb2ac99d859037dac991
SHA256669d6942e1ff355f1ccb2ebb96e3767cc3cd2f1174c3e0549bba3b27e434dbe7
SHA512d6519fa4bbd36285f7d47cad43447a5c65c7447b2013c2d42bd076f63ffa74c65c0501f5897216eb23af6b2c2c3109952873fd0a41d14a18b91196a8f3c0874c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eea456e7485643d31b899a343b652f55
SHA12047d5daad95d3448561bef48e75cbef18af2520
SHA256b7df3f52ce705bbf655deb456cdec85837c625563296fa15753ee181bbe11e6d
SHA5129735627fca7e48ec407fa291226f7f01a0cf8bbc4476c524dc15fa3832f1433e088b65716997e24bbd4134d2a0b6fcc269b23a3ff0c3e2d1b3fe80d45c9c3725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5004e97bf27e64b3f8214c632c8dadf9a
SHA17476326679ffbd94bf8592d092bde246403ed5be
SHA2560478dd15b71440581b5a7dc27e536b4b763daf360cc07d4bbbd343766369696f
SHA512daabb8b64f9bbd03dd55b18f9740222d242e2212aa64565869efc28eb11a650e03863ffb515fbc9c3872c0eaa0e453629dbc2b9fe44fa00ab3b2d76a5ee1092c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588568ce7773d8a8f1a0ae852b5e33de6
SHA1073fddfd48065da8b9fb75d5d939933fa32cf53a
SHA25643ab8e06762c239ec6be794fe93353e0bcb0bf01b79a40713f22ba59d24e62db
SHA51254a75af71558f4c607291a9f39316df15fdebfb094ad8a06668bb4c33d9b969909ca86ca9d732bedf015b24df98b2e0046ef351dbba77cc2a8fe2cc5afffbbe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d5e112d1d1ba22bb7bdef00a8849560
SHA161adcbeedabb12b575c74024145c740fcfb8da1e
SHA256c7ed53f2f4367960225c77ca768432dca73ef99de1676762f3060f2d8e5b1c1e
SHA512aaa6bea88e7b65a4aa6423ab11b4be8ce001eb79cdf732b56b288842a20a4822ea61f466ea416e0d22005f2fd23d7ef2c199bb511612461665498bf85d3cdef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd94ff3fc268f98337d9b672b3f4dff
SHA1229112c22c148adfbd032897e15da139f057bb5c
SHA25624947d77e6fefaac646342dff2405edc3ced440de785ed491bb77d64af8480a4
SHA5123ed53c6330f14b7c67a3727de12e90c5de3a0e8ca58c8376c5e5c8fc8f58d27622f1d992cd7e68c4bb0b247cb3bff934e99e7ec678671a9213f3e07d912bb122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc85410de40030de6da58d5c88c1a64d
SHA1ae2102142974f996ef8397ba115b11cb75d865e8
SHA256b1f784001d2793cb73a0a4a8e77a2b28ba60dca04077ff60649851d8157c96f6
SHA512860d5dfcf694e123d33bde701432f778013a185e0504646b4f446243be12c33eaeab4e02b6999a538011d05615f3cb488521c2fcb0257877f559293b88457700
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2131d06553cddefc85051d315f536ad
SHA14f9c6689c8087b0c6942d0d1ce8e030406561f25
SHA2563023331ae082d60a9b33aa14e678ee27416aee46a8f2f95c496a9d85b2c18c97
SHA512cbeffb5fa89beefdc096dd7ce70409b9fc7062bea0241c250cc68ea15d9918cf9eb6688f4b79e2434a586d3659e4f9f7468d0facbdf449204686cc471fb17e53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c09e1e33a74c074baf84c52171d40433
SHA1365cdb9a09cc0cf71af19748736baf9da173e8d7
SHA2562443db0e809e54ccb923389b4e243bca28114e1b98a441c0398c46afbbd2f537
SHA512b9201c7f208586c1edb2983d1bfc8e347ce4fdd6f6c61bfda168775b1782fcb83558776c11b41efa6b7f9f48ca944e91048c93b4fa4b8c130d3679d0d2a0ca97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581f67cf44e02929f32d25f6484ba7b99
SHA1f770e43a858b9b309c6394d5e862897528b2615c
SHA256b51d8ae0c5c895004969cf075c7b8ec98c8c22ab61f2709a8b5ab257e4b3e26d
SHA5123b0250ec8caafa914c92a30b9c1b09618a3554c35237005d41336a9fd1333fa6ec0879ae43baf4102780d405138908235b90a7a609c712e89b69ea1750b62bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc99b93e169906de9e14533141e0d54f
SHA14642d283277dde29367e1ca4182ea0280a7d077b
SHA25610d8d101edc768bcd3a406c940daae1e0b2c145778615aa34a412806c253b82a
SHA5127b7fabcba0655c481f56a0e88f8e9e9260d2bd9b9e0a8044efa72bc79245e9fc75a7abac4474cd5c4fec7cffb05c3fa166e9c5b7431eb1ec29d17f7f5ff25590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584cffeff15eb048b20f263ec397b270e
SHA1b514c2ebe96698d636217b952892afae8144a11c
SHA256c60b0cc7ebbfaef5528522d70819e08f7c4c4027b533c802b1021e0ea4d550d6
SHA512d37d7297181e5c72296601f347d10e1ae45df066f1556b292405fe64a62c6998add1a906f66a643a95629421edcaf8736b0e5696b7748877407db0f4c76f3368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7064583bf6a31a567cd56b6eb978fff
SHA1281385c333844e6529870ea49a6edd6e5390ecf3
SHA256217200f651f35a2a6741e634777077b19cc09f9315e3630ec580f790e0dd31c5
SHA512ec6f7246a4e9fe999f20189bd120d523f6a2d2f1240ba2f9554b1aa2e2bba158fd8e77bad9ad4e85c54e0b4baf9d87d7f677d80ad60d94ece587f1aab11e8fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d0d45a19dd27a60f3e6e7d58780f177
SHA179a40086dd98605938b23163f5f7559acf518926
SHA256eb1fabf65556cc2eba71d6e1410e5c8afd10f077bc62291082e59c7946e26124
SHA5120177cfec498563f08b58d4774eb9a31d472442e63c9046e446b96c128b68e9574b326cd35e77433b634ad6d91508e92c987b95ae03e857fd908ab9731c64d611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b8c6f2077be0b2c4ac88b46070a3d17
SHA1a0c39a2765c307f24dcb432de692ca64840bec88
SHA256ab69c66d2996ae3d0267fe452b50911dc0e49ab4fa613fb2bca42d4e68a5ab55
SHA512dedeff25b0b169f7d267f952efc38d0eff6d079060107da5eef8d5ed5bc2715e053719b34a95916308143b1e411307194f334716b5449e0b1f776969e061bcef
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a