Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
0310972af3ca78c60515ec5159769cd0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0310972af3ca78c60515ec5159769cd0_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0310972af3ca78c60515ec5159769cd0_JaffaCakes118.html
-
Size
214KB
-
MD5
0310972af3ca78c60515ec5159769cd0
-
SHA1
39905835245cf092306a2206062a11dd43810d87
-
SHA256
2dcfcae9e0c9938494b74d2d93db442e90240e467ec4d421c3ca1669996a812e
-
SHA512
46d12d171ff8a5ca8550a1129dc1578242914d5d51a48ed1cffb44f342a046f683a130b74e193b9ed687c3c121fd0e0d9cd85c8762b8a2bc7529520f35b06bbb
-
SSDEEP
3072:yrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJX:az9VxLY7iAVLTBQJlX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62B11A01-0482-11EF-BF06-56D57A935C49} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420376221" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 iexplore.exe 2032 iexplore.exe 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1904 2032 iexplore.exe 28 PID 2032 wrote to memory of 1904 2032 iexplore.exe 28 PID 2032 wrote to memory of 1904 2032 iexplore.exe 28 PID 2032 wrote to memory of 1904 2032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0310972af3ca78c60515ec5159769cd0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e8fdeca2e3e3b36d56ef985f6b9adcb
SHA10255f1218a2c3e8f4aa9f3f236677a2ce8ddf00f
SHA256177dccc211d1fce0931346ef3d791b533455142cbd7633fc795176223742837c
SHA51227a1e19a552f6b5a564102daed5afb981a6f1a0085f82678dc6b85123fac2f1efd2943f8bdf7481f476e54107b97b8c08936a00998e88a7cd8d952e87f580941
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bdba41255650c029287ee38e5c4fb09
SHA18524d5631d0688592ec58408776e01f9074fa98f
SHA2561b434f244d7c764fed57221be567185b7952438d9db97031399de8226f8d949d
SHA512362f75da0c268d61a6faec9b1f4fd297d2d7ef74cbee3f652cf4230106758cd0c9cdd8dac71e8e2beffdad68b13c9728241317d82496a58866bee1c597e8ebb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5324ba23a0b4c3a73e1d2d92de90bc288
SHA1b74e9e7de33be8a1a418737488966eeaf1ad5031
SHA256aa2a0b1000c9762b9be2aef239dd6598b5032f6bb254f0a98c009591873443d7
SHA512aa6a4b68e679752862afb2d2fdd281592f7470e3cc98dcc2577a147865734ba1f97019413e7ec07b3ccb41f3d2f55747c950fa61b8a8fb1921fe19621b2307d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6732b435627fa00f4b57dcf7c480e52
SHA183fbdc5250cec9eaef5a650a45ba1c1eb7763b78
SHA256d64751ee147d9aa6b0d583a4a8d56952a6069de30559f5db5a8601a2cae93082
SHA51281a7e168d38fb9c46b7b6584cc33ef99eb01ffccf51c71da6ab9326c81a9543fa1d875821f282e3f69f51ebdd3eafd88ed0883c9a471a152285bffb0c10bca44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae919f91da93b151953e5743bfd0dd0b
SHA1005e3e87aaa1cd24cf0bee0542894ed3367772a4
SHA256b3d0b3fac32eaafd5d680fe28cd69b963cdc52dd66d38d3b3758a1619be7c887
SHA512603d82563399a1d8e47d9b7d0eabc80e26c180f190bd718ef0c8002cb2f3480a36efc29cdf328568fbba093b5a0c1b177521412337e67b315ff3aa618d141a65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5041e0ee3806ddb1238a2dcc3dbacc185
SHA1a2e973b45e685e04ac7b829a2c1ed9869e62f49f
SHA256ad29becb8b722d3427b46cf1faca754f9b3d379383ccfe2f99f0ab7dd60dc756
SHA5126a02bfffaee28c3a4e42cd78960abd691869fa99fd4d70b81e4ccaaf5b80e2eaa24d260be76bea678d5c434beb5674c43e2237662920a30373669c42fa5f1d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5323826a3e051da4e2364dc2b8ed51ef8
SHA1baf8c4d6be71279f97f9fe334f0268ae04ac8226
SHA256f9daf20030f908e6daedddf0776ac3ec28a36b0752805d9dd40a7c1df4ff2b72
SHA5125bebe1c2ca5e7c2bed4ae9a475b1886100761a1596708e882d387555879d2369b7bb8c162f25bafbcbc9fa9ae002c0df87bc04d394e11348e8d2302e677104d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526ea95c346a2604e9e610586cbc13ed0
SHA10001e942f29c39e51c22566f9ee39711adda1daa
SHA2567f8fcd01defd91579a7e1c5e9f1d21a11dd145457aa3e95e56defe1be2959a1e
SHA512ce5bdcd2d4a81530a3f43f6eddfc81a4fdc1faad92c054266b8ef1dbcb8a9b67d488e0db5383469522fc71c7b9ed2d3c5fbe603ac8b5c0d3c81dbc7ed667380a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcc23e0a0e9910f4702429b6330992c0
SHA14ef9745e4624abd9857f777f70d920f5b449d4a7
SHA256b9e1fa409fa7c31ee87101662a927eecc29adc917c4f840b47aad5b373f61d3b
SHA512961d8e6f92dd10e64fd00014714c96f6c85cce266abe4f9f9560c3f3d714070178dcf20173d1ab8a7728f76dbae15bfadc73a5f686ca6b7da2c80ebc5a9b92a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5322e81f43c43fbe363210fe73b6a9a8a
SHA1f8f8f43c47e701429aa60f0ffcc5535348492c56
SHA256019ee6e4929d70c0d8b0f64be80d586eed9bd4c48da105701ceb04afc7f7dd75
SHA51217fe51075bc56cc49e0df3d74816c05229fef6f1ef1a811629782dcaf320f9125590b81280870ea38efa699291b031d1c57f91e010bb6316c5af7306d2aa4498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bef16200d6dfb7ee624e747838f1358c
SHA1ca08e423734702c958ad7084c5f2af59d521afab
SHA2566e569a72895d34f3bd9662f8f7b08861be818a377693159fb61b583cae30e9fb
SHA51228d89eb74cfd6d5530b4c70164e1791e82a94abadeab0933d8cbc01fc2ddebbeac60be891bdb50e87e5cb9b511599194774b6bf2e6616a75f39ab5a6307baf8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f86822153866e5ce12fe13d6e7b82db
SHA19d2f81a78c30d8856d9d1ff7c266f15d91911d80
SHA256826ee4486263195227d4837445258810e86bc778e246aa4cebef5bf7db417489
SHA5128a566b0c7754cfe2c29077d57541797e10acee0bfacc729abfccf3727b0a7eeec9f8010cd4bb6fccad511e1bffdb96e424772590402cc2cdb3400cd71d5d3b8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1b35dc11854401288c5448a3b201192
SHA1bfc24d972907cf458d8b99c883b51d4e260a650e
SHA25689da5e4c171ed17a7fc8a915d89513aa705da4877f2dcdf3f939e11832bba7ef
SHA512e480ea4d051e048e34df4300bf33076962fa12d6be3ccd4353062005b153ab4ecead8a12eb2578587b7e30e6da331ce741de60440669d1e98b4b3288491757f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c70c41738e41aa4b32b34b79890e1589
SHA12c5ba4a72cf6fb08747cae5a1f34c5ba42dc2d02
SHA2569be41421c49f3a2a8929a4512c5d4564831b1a21a326c5c8f9c92f6bee61cf81
SHA512af86e0842b621592ab0879cabc40ab19dae5c5b1e6b6a4d53bc47bcf97753c5e4852b9b229958c72e08103eb4f556e42c5cfc84a02a6062dd5a0503a2312fdcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51edb7aacc5bd6b8703468e0b22ab8a5b
SHA127fbbd56a6252362226278a3cb876bdf16983563
SHA25610166382c494c9c7685f3700d62de4a1b77d26ad7c8c9b12093c4eb1f960e7fc
SHA5124530eb3dbe5b7633fc7ba83d55a23d1ee95f181fceb369ec42bb39af56872c16a8b53dd33c34bb58ba3baec16222001cc29e3599fdc53998eac99a60bf5562ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569b529c238b5604ec8c9fec185a84ba4
SHA181eb7eef54d20960b2c234d38245e90df631155d
SHA256fadd3fa50c3b10b7e3e0e1454204afbe23026cd70ec8d5f3f4c945d9ebc819fa
SHA5123f7eaa94c7741ad58c28f10adacab0ec342b65af4d8956b13ee7d5218613aa7ca6a53c8cca3bad4005584326b83fd8a3ec5d641744d219d8d39b8cfe87d087a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fad805f7af1229421ce1759adc84f59
SHA15efb86de2e085781ee6d0ea5b2280a02b499761a
SHA256ea7948b47d39c70fd1a1c2af8120e8c358ee1c9e86f54d53b06c28eb152e9cbd
SHA512883a3025210f77d089f5b004fdb84a54a69eb2447aa7efd20b14a2577833d23304a524fce0a3870373f60fac02c16cf5b4d89ba96c345543d9c4608d94c97813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f707e97184efcef56b5c3457721dc76f
SHA1066157c66aa42cd218382f2ad30988212822fea4
SHA25605a3fbf8a0225550861a9f72099201d7b6a25aa978eb317dada65f4c4c494407
SHA512e7b68019ef392f8d977116475930043c383c165395e66a5e354c3a52d93ce15270420ad69c22a227d7004ccf6f1847a7fc201729bc94d5bf38ba7ab9e3b9fd58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50725ffc44a2c638b5136385d9611a03e
SHA14a6dc1de735fd2ede9a22500cc8d4067f341a679
SHA2566c70457a623138cf4bbc73e246065f20a452162bbf50b148a546ca523fec4a45
SHA512af19fa9a4fc97a85b81fdd5b392e4b620fa0e394cc07fe3bde6d15eea6e7b55392a81f6ad85ea8b0ceb7c089d615c0d3bfe3868f6d3d16455cdd92300a17a566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4572a1ffa851af2c8e040cc53d59c39
SHA14b9c5d395f80d47721966a9c16255f771fbb7114
SHA256ffbc23ef8dff3fd2da4fdb918867e6db1faac17b3a7a897e315fbd2f5abd56e2
SHA51215f27ce47ee3d5f8882b2b4e591fb9ae6dcf9a2f9f356e296a29bdcdac8ab6c5c214325005bed9cc185e7bfd6168533e40368a7377ff39d166c2b6c703e9cda7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a