Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
073b978a3d28ba21a173e47e4fe01b1b_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
073b978a3d28ba21a173e47e4fe01b1b_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
073b978a3d28ba21a173e47e4fe01b1b_JaffaCakes118.html
-
Size
25KB
-
MD5
073b978a3d28ba21a173e47e4fe01b1b
-
SHA1
fc00aaed2eaf70bf56291ea83bd39a305b3ee81b
-
SHA256
f920e7765ae98b96dc7a0251ddec9e57b2dc983c76218fff172a72751f9d3742
-
SHA512
707728e11eff4f6112a31f6b3df2d50276e898d03ec972df7ef2e5de52459b5a4c7b8e4826a5c76da91b09d240f9df436ced2a47b9a517e11e0e6d51cb532102
-
SSDEEP
768:VDB1CYX0drb4uJWFqw4q9lxga/guPm3zTpc:ZB19X0BEYqYt3ztc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008f3aee98ca974df605d0fa82fa1bd0306c4ef5753cb3504c2f70b6123aecc4b0000000000e80000000020000200000009bdf2b9e6938e7cffb01b50618f9d0bbd9dc30fe44366bbaa7b503ff060e0a1f2000000046a6e4eaec9ffb7197892df8320092be66e0413343dc30c97743d2d8db765a034000000093a30a61181960a1d4af62b6b8c0663353b01988f76199691bc849a0a2ff2df8660d3045167025fdacd8d6f06dffd322e8cd0bcc2b1df13dc006645d49168c13 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000bbcfc3b77acc460578e0b56cd069177711a0baaa350058bd7ce3f49798ea5755000000000e8000000002000020000000fe187434183e2873c8a2579c5f2666a0a0afaf7676154d0e642be2dffc051a679000000025b754e2cb616cde56bd5110f5e4123b08f2f3e25583791c1744c1ed62c15f5a49f8fc702e32932fd6f2dd2f8dd4bfa9230e237ef864bf4d49912b9f33ade10a00555cb20f2f9c897daa328a3b17250f4104aa228cdbe452be217e5617f6ec39f88a90bb1b1c232f3dfafa63cb6329d288db7210a40e298228bbf26ace33e02ccf5c8f1403496723bb2bd646892bfac0400000002ce5fed4dc47710c3d215a3713e16d3cb3e31eaee300fb08258eaab20743dd2a392dca243aab96a5bfa495fbcd7879cacbc82b06b3a801c823011eea3db0870a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACF085C1-0602-11EF-BE0C-E2E647A5CFB6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08c83810f9ada01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420541271" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2956 2916 iexplore.exe 28 PID 2916 wrote to memory of 2956 2916 iexplore.exe 28 PID 2916 wrote to memory of 2956 2916 iexplore.exe 28 PID 2916 wrote to memory of 2956 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\073b978a3d28ba21a173e47e4fe01b1b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6ab20b06bd5bc855dedb6e94d365dff
SHA1d50edee491a6b7d87a337743e4bad6705af0df38
SHA25660e22b51293d90c6fcbaba147a55f2aa243a0344fd8124a2d20a447806db6622
SHA512483f0cfae906befb7f6e3fbda604920e7532b64a76f4132082db7dc0d32448fc2d92567216bb366ac6d7df8ed9096fc9263e58d222239c089f84b30eaaa8b3b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cb65277f3515a9a924805d8bdae9d38
SHA155e6fcef223d5d85fa27196a6af25e3b1c398552
SHA25607f14151cc005a0449b2fc4ee79d4fab7107e0c5b51d2a05412230024d1469f4
SHA512d1d02000eca2c09ba8bf378ad9cf542905ce298996b5b17df9bb3e413714d79b8f7c81c6ec7c9fbe89eea561759a367dd2b81259396eafe1898fd42a84a936c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59af61b03774435b02cfe96b1f6b27e25
SHA166bd7bc5356a363b8aa09a07a745452598d0876d
SHA256f2a3e5fb086bd6b416c961e2caf0ca8ccd12ef43757be8a9580f906a14b2a43c
SHA51222683e6f8cdf79aaea000d4b3af36d84ca5095f6f5fdc53a216b686d806ec5879e67878ca1861844b0a27dc844312f02577368ed0e4d5796e3f05afb3abd9e40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb5a383ee45c75fed6b622fede17a827
SHA1469836a9d08a18966278482c9f7b2a738c2e836c
SHA256193032da294320f98a402ac31ace3c50f87fb4838e029efcd3f3b1d092752083
SHA512fd258f1e2dc0a170451c120d402c47fbf1f01c1869e10322cc9bdb850f3a25c3e2cb685c10f868d6b242885eaba43fcd5af388c0948e1936c8a7206642eef479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d6e5667291ef760596addce699d8347
SHA145a1c03bf868d9771277f2f8207a66f6f0c910e2
SHA256d673de5051a090759bae4a905f41ffb4fdfb441987e230f167371d5aaeb508f6
SHA5126e47c048a5d23e019d4c59b640bfcc308499a7d00bc5cafdf5a37cc13c5242cc7bf51de913d44b02cf5c23ba5adb34390643afaddc57d9c54c01a682e4887dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5838e429215b2a393cdebf50a368689a8
SHA181ed22e7fff6ddfa7d5a6d5b062491efc5d20ed4
SHA256740f2a04bc2e49d1400937b63c8430b3f68bac049f15ed299c0ecce4e2b10d02
SHA51297cca2a821c5a513f2792ff91d3595eca43802d6ab179933822712edb4e703aee99274200a78344032557af979b45c66e9e8939f542913861b5974e0ada4b9c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567ca557fa7ffbc03091e3985e39daaf1
SHA1d9f818057407f5f3b643ad6fce4b80dda82da406
SHA256d2ecfd0f8caebc1e0285b17b9aef528a5e7e8c54613a848fc07f2f9a4b0036b2
SHA512cef53fbfd35e13667515d2fb57110fb0b204b6c5f0c883cc36c9d2aa8740244bef311b3545628470d8a95fa476e44bf7238685ac489eb2313f44c9463604ebca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f175537e48eb7fcfea4ea2df70f656ff
SHA1d65c23fc1ba8033817a7d5ae6e7857a62f1a804f
SHA2560d5345fdd5eb82b55134c981d2c6b163cc85da4d4f2d8c431759c5b4dd2c1118
SHA512eaf025827d610d50e3ea55af70ac7ae7c922e226a36a10eaa4910bc75b66e3db886debdd4b63561af5e75988c03141ada9096d15dd7bfb9b4376cf404ac38a7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e6e27e4d47aaed05ffbb5b30095a7be
SHA16e8bcc93d977445b5c2c8d06543218861dd2e500
SHA256159e8ef93d6cdfa4e28c448a7b249bf8c5c1a95e5ffd240d085cf20bf2517629
SHA512d31f0c770c73a9ba4047c1fd4f0f0f3916c59ab82c8ba425b914b33360be32ea0283725772689d2759c1e8ff9f64ed150fc65d6ee0e426cd0a0cce3ad6d0125c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5348402b2d06610236e4961098055e4f0
SHA18b07f6ace0d8c19f3a36268646945dd8f7e4ea82
SHA25642d16f16e624c960e9a392be0f20a6466d8235da0b6e34dc4962caf20f4acb47
SHA5126446ca947de30d588dba6f498fcbae5bf0eb675b1a1c4ab7a1de2c14b9aa22ed53477f8a0c761295bb0b89aa9c5b6411b0e0c30fdd21fb371692c79727955f47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf590e68431fa82515eb32b9e96ed44d
SHA1cad87e1469e593de22fd6e477669ea8f0618652a
SHA256309c2bdade513709895f48d36c42315448933a36d18a045dc347050abc3393c4
SHA512a07ed08a3d1d5268e5d0e956ba7c609625db381c4df5b913f384110d32202e2b5ce2077cbae6422b7cfe2ba0ab3182c4f6f61181aba848596a5e6ef0b5f564e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d82b1f0f9e4f564c8976823e5f61490a
SHA1c0a828632e811d8a1fae23d38d69178a77313dcf
SHA256cc033ebe7e466c7e5777b3fc6a1d26de8686179b54b127275b72789d41f4dee0
SHA512f574fa2d97f8e30090c034121a03597cb132ba86e665b6c19604cc0a2f22fc9add2ec5ff17dd9ce54fca41fb4a4334f4b83fd8be147df5f17a44a41bb2f2fd04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a658baca183291919d9cac8ea6579065
SHA171c0be4e8b4277ca08d29b0bf005bf948ea45a2e
SHA256f15da1538fb2b8a951dcdbd27d127f647b09cb5fae77b568aba0130e969ed203
SHA5121c6b0cc4e1b89cd3b5bec0988cdc2c3f94786dd7877d8afa7e66f2d06333db9f43a62bab37b4b9f202693327301be79947a07ff52c430520b452a8eff5c8b8d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5043f3eff7fb5288ad8110a79422d5b0a
SHA13bc86fda0fe80289a25f5e5c11a1c63709210b10
SHA256613436f39c7ceaeda02eba0e0ffa15d09adf4e83daf1cfbf019c111959f917e2
SHA5129fd010e919d7609c9c527e7be4db094cc638b353cdeda98e69591602e18cc70dfca6e62c7bff5070ddb8da9e6fdd30aa0d4dc66157c47553e0611210c9db1406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586897ac3928714bd3f9bf0d7b4fb076e
SHA1f150f5fda8ec600c10eb35f8859a0f05e69db88e
SHA2569ce36cc2ee9c9a3c7246cab5ff7ed1b7040503f5d5e1c976bd02a9b7d4bfaf1c
SHA51227ca75888209faad3a7c5106b3378243ea700d2fa7021b415c144669c4d3b43a85409a5a291bc5c582a1940535ece392fd03577b08de9e0f81f2b8a173d89997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2cfeb8f58d03dd6a607be08d0ce16dd
SHA117d929fe9ba684040810b3a4f44d885f87a2f7cb
SHA256958b5330edd7194059108c45d48bfa729fa10e61187ce61ca0f44e2a47e20c19
SHA51247b4a26d50dcf4e481ffa285d930b3316bed07f1c463d07f007fbcf744a5d50dcaf174ab3899817ff5fc1bbb2895cb842ce80ccd4fcf831eeefe21b67000e69f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeb3bb6d5549484307d901d3988e1569
SHA148c8439bf375832395179d594885adf998110d81
SHA256b0cf1c22b1983f6f1d52bbd78b3f4c2109b1b6f4c8177fe1d39d959a020067b7
SHA512392c0b7577c84a1b872c9c461b72a258cd5aed5ab8dec951e3b9ef8ed39168558f169a46b001f11299d2a7eb9ca7cdbe13f4962dedbd38b05386799216560a03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af963f1637e6fac62d3ce885cbf2515
SHA18ae2417c95749141553d35f44beab99714129ffd
SHA2567d952e79a1b146f079c72c19718c17e004fa48bb9a5598f972e93235bab5a4dc
SHA512a3161848cbaa1229c816eb01b63f8ecb5f19c5f84c5ae0c2910cb3abc0da09be978e2958cc0327701832c48bdaf9f74baa9ac59d6c3d6cea500f58d072ebf65a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a