Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 13:25
Static task
static1
Behavioral task
behavioral1
Sample
07c45ec550986fb3036a8a886e28bf58_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07c45ec550986fb3036a8a886e28bf58_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
07c45ec550986fb3036a8a886e28bf58_JaffaCakes118.html
-
Size
1KB
-
MD5
07c45ec550986fb3036a8a886e28bf58
-
SHA1
15d0a0442ac9ad2803649e147ae88a1d0d4477d2
-
SHA256
735c2661dd259b4e7ce0b3a21bd685a6fbf41b4673bc43b0f036d451a53d859a
-
SHA512
38d8e1f824f13d1af1ffd2d1d9247b6d7aa12d066297687cf028b97e78b8ff2d2b628981f395429c7568fd1aafe27fbbff7dc41fc41b981877b941b7e4efdb39
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000418f43fed82eec13c5eb7029b454d745536bc9d125cffce40cfa2c38a185f5fc000000000e80000000020000200000000bbf3029dc1754e0d00f3d4d3ed1a05cda791394e9657dcf36565c8cd255f27f20000000d01ec26e68a34f0c028e3e9e525d06550a3916140f09dd8bae9473bf4bf2416440000000419407060578abd921fe2a40f3daa8fe9e2777b43d10e9ba69d2f22f1de02a08d4375a3f0b7b989feda0f1ec51d9fa70314fdae1d34aaedac7354b67a06aa344 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAB71491-062B-11EF-8745-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00214dbf389ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420558983" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000714fa9f42dda7735e8ab81e5f291fdd3800d0f96c0374542f9d4b04a88090f88000000000e80000000020000200000005962f11ece8fcf3f64046ac121d850172adb3e4d9b44c6807df68597d4e0297890000000023b3d55d8e1f791e93730748703eb3b56587b7efc369c9ae6dcd5a15dca8af08176b1f282a05979eab5976ec6cc63d4e9a136b1bcb9b65201dd6932e9374729eeedf6121a172d97244ae7148ad8d97cff757212d7b438ad7996cc3f21437181502787e17a4529c7d025bbfaaa5f459e0908e3b1e5f226ecd12cbda88dcee784255d49cc0d7c6d6b8a765c293108280140000000ea85df63391e0a3cecdd2122bda4bce8e44f5151915589aab3bd2e13ea45afa19d130997300b073a5756b9c0fb95dc7de8833a214ec1e7993f1a0bd63da5d9a4 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2216 2156 iexplore.exe 28 PID 2156 wrote to memory of 2216 2156 iexplore.exe 28 PID 2156 wrote to memory of 2216 2156 iexplore.exe 28 PID 2156 wrote to memory of 2216 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07c45ec550986fb3036a8a886e28bf58_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ebae5911c21d0dcdedf1e5bca1f510a
SHA1ba08bdb6c4159a8ceb426cead6faab2ee1459b39
SHA2565677009b827fcd20fbc9d884efb8b2e0ce66b96eec07be9ac17365379013ed6b
SHA512903e03a995a7834894ca27c310ed6f4c4051ebad28683b9ad7fab2807b0f238ee373e1bcf7ab92e6504d67b257b71a59fe07b0f975b59b7f3a7788ae48fb3770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b38126d501782f38bee53daabbb7d34
SHA1ced839ba8caaf47957893ae29ebb0094e5e0176b
SHA2567a1c8361e96f2082fc14e7c84ecefa89286656b0c59cc55ab4ae4a8051f53141
SHA51215ed19ca03166dbf6df805ffb79914df66ff194d619a5debf5eb796d25b1c7da8092f70f50f51a378e9a038109f30c963f42e291744d1d10bb186d1c426a709e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5681a8686bac6cc03d4037b00bca61e62
SHA1549e6b2edb2fcc38948931db4aafb3dd910c016d
SHA2564e827662928459a7d810fb822981b46823f512830df019535f22508440487d7f
SHA51251b65d5453489acf0440a53e9e4113f36d483a87d2d4c1f374742d92ae63f8c19c9c883c23ad8eb383e06afed747bb478b4ba85226cc4b88208ec1b79837438e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512493670b7e411f531783b06b3e9a1c7
SHA121aa0d7df94e0a6180c474b36f26ce885d285b1a
SHA256b7ab43e46d752b52fb6a6d1c16d09dba424de910b46d737040546af82f38e42d
SHA512cf7a391c31a5c094386fe7f07fcc254de76e13465524e0b26af57c42634d7a2c84b18fbda357d2fbac56500c8aa56a63fcc79fe39eaf8f608bce8b87be722ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8947d0e9ad22eced33d36d85e98ea6a
SHA1ae5caf12734a537eed72a076f26a6d72950fae63
SHA256c6a4928c80f88a2f9d6adef88ab0699dd614e0b793e6c3b0c49911d30e0931dd
SHA5123cb610b05dac4a924f7ab7632883da0e03d08bcf33f45b32a364f850cc862111b06e91326344fba9d46215740af1e853cef75843c2d1fa3a70dd63eec0432170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596467abc372d79a5244ca3b24d6cb60d
SHA128db7002ee157ccb28a482e850f8abe74f5e63df
SHA256def17ce1bc30caef5e34378c351ca29a700744acb92b1953d10b92e7214cfd91
SHA5127e82be5dafbb8b71c6fa83c998726b8e9dc9bf52efdd56f9dcbb4263ece79bfd98eecf5080d78d16a50af16e053e168daf6cd57f7c076d65f34c6e3281a7a0d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50afcb5d67b169fad78c25dfaf396bcbe
SHA1c335d77f06c634ceca72548882f24be1aa0b9452
SHA256aac51e545f3bd2c45bac6133d1ea60d5fb2a38a0dacbdfa5a0df990a6c14e571
SHA512ba527a0675d3f452b1d1ae35c8ce89ed60752fe37b2cbb375b25dfa0d39b4c7d091a23d76a817be4f7a634b0241562abae9173e1b6b1577dd416e41f75319de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba4274a4c27002911988d3cd41067b2f
SHA11bab1ea17408d86ef37c34c48ef65781926c7e46
SHA2560129dbca420c987073bd6489365e69ebdd0383faa69f1660e9a708445ec2e907
SHA512bc66d415c2656dff8465bc09bcb1a875f1be07a42316d771a0336fb031640013046917190d2525dc597a3bfb8b434a76bc73b286aecbfbb3e6d5cf8e23730622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539f41631287ab82b3f26d7fabfe1f58e
SHA1a8a0b5c3c0500124df376987c587ce55ff274d2e
SHA2563525155005182c87952e8a5ed73c9c8611bb25c127a567e11f33c31429321bd2
SHA5124b9f26283c840826481facebac13166666f772a47b21ed0b49c5c4cc7496a5a879363d94b5d3f0e588c550e920d3cdc82857acac2ffee23db36098db910f90f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c12a0fe3b8f7b82ba5e18ebf800611b8
SHA1c5409bd8d3737d812ca9d88e2b6901e15681c7c6
SHA25618537a1ed1979f2f3feb34a7482083d1424448c33df97171c56f9a06884ce789
SHA512a6b3645c068c8aab54044ead3ae188a203f380f64b6308f08aeaee968f5dfdf7e9c5c853f2883db46b1bc10de7368f6216c92d2d16462361508a8b22c40abf59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c145dd9880d12b67e32c71bc78b392cc
SHA1bf2782ddf7fba40c2a53dfa271ee2e4e31f5f506
SHA25665df245fae2f72be9fbf1f3f20a16eda6e1d2414abc702d85840d90e6e145125
SHA5121ad31cf6d625abb067b575134ba516f048c0a8e763a1b5be46e7018d0ccf621cfcac00f5196565771e6c921c4b2f4bbf13812c875c79292a397ad85247aacb89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559d90a9f87af79ed2b01d0cb7e586324
SHA1c195489c0e68ffcd32df574936b1ec23009fc710
SHA256bf3e8d33af6badba838ee54cec1ce45f1f9cf0b172bdd59815672c6a0802a8d9
SHA512db5048c492f6941063bafa7226cfd388eb455ebb180c771b7cad212f087eb737cbb9e6714577a594a17db11102027cadeb585e1e224d34b186d616c18195cccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5749e4a1218ca63f86bc00651d7159173
SHA1c8203e6b937c421097e3bd9782d7cda1c9037c2f
SHA256e46c6ab361de29e517dc1645da326068b2fe73cf88f99755df6065d84ebf397d
SHA512af96b5f25cc0b1fe65ef359ffc396bfc61e822b6f8bebad8e2e449fe992207cb62a5b60ed629f18e63330d17f0c8f8d9534fbee57cd23729f488c66257aafea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55045c6643c84f2d0bf7103c75f348365
SHA1ce94aed34c8c5f9943577328dce0af423924e1cd
SHA25649b48e61c0c4b79eeb2fcffb30d93e9ac2921676801edb0232af2783718c19d5
SHA51252494334e16b1e78dc2d0a928a904b2bbd016fbff1f8fe2f77cd5a2647e26c4475e0f2ed4a644db4d793c38370ab032f9e81bdf327d3350f214d970efd96f163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fe36cc0564a8830d4a28a7ca36cb74f
SHA152fdccd6a16303d90cc2510895b387d64ed7b4d6
SHA256539482ef6acb67f6d2a8cb4aa2685ba7c160177d3791bae2a2c52e4f3f6b6f75
SHA512a1c14d80d969c1d1fcb4d0b64aafea722fe6d608fb676348569eed5f1499f7e35158d3c53b473e070933b88db449e2ffcdb135848c4f61270cc312c1f472d0a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51338677464f5d6e75d2ab86ce73c4b83
SHA178aa43633fddf25ee5416b9e712aec0349acdf26
SHA256a7ad34a4af55f76f2e633045da01f046f3fd93bcd26d90eb37cadc795fac77a2
SHA5125452c5a607313e458a1fabf3544d7f389f27bc3f9422de89d9f6b8c2706f20bdb00cef4fcb91920474b14a058f40dd159f4af7a341ca2a3ee6e97a76799f38de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d98f6d214dcea1b09f3d736259813485
SHA139d84f538784add781f8f0f54af84aa9984ef21c
SHA256f9095cbe452568aa79878fcb5368c304611ff0abe101b828f50f6c33c2f45cd3
SHA51236466038a7a89943801a6651f098a97c3e55c942f75a87ab9e11527eaca0b8c6377a864281710bc63a46ddd70f45ece08f635a8aa7396a8011a78af05b19a650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518c36e0dbcb0fb9a252fa0b977e14787
SHA17ef8ad14eb7b9c5e550a9598fe0431ed44626d1d
SHA25626a38b33020e13aa5f918a9858b88ea2e053453d6a9b70f3194605431e669008
SHA512c1fa3cb1ebcbb475b3b6026270605593d79c757cd23b9425cebcaf7b7d4e6eba6b42e9afedf3ab520a50f1ee466e99632a45d5fe4f6153ddc05117cd6e84ae9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52641a8aba94be80ab7417e9978be4a09
SHA1a7212509f202340870fb126d3e5c51b1d2a12997
SHA2564c98bf6c6e69ce72fe22c747a0e5f48a6ae76991904f09a0f2944c64b69082ce
SHA5121f1adf6431af9ff6f092329f6e2cc863a9788a09279c177ec09b312d5c3b93b20fddf9c6272ebb9a27d68e5005bb819bcec7714e053a3a6937e12dd53dce134d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a