Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
07f4f34eb8a06974398688b61b3a5e9d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07f4f34eb8a06974398688b61b3a5e9d_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
07f4f34eb8a06974398688b61b3a5e9d_JaffaCakes118.html
-
Size
25KB
-
MD5
07f4f34eb8a06974398688b61b3a5e9d
-
SHA1
690ed8bf0d2091bd052cdf96174963a7ef75d773
-
SHA256
f3fac1d1d3ec5c492b1645390b484e0258b3d2ed431ff82396442be00bd54993
-
SHA512
7a3b9ab0b59d5470128f0575239dfdfc860c0e117ff58b2b85b6f724b261a04e76af03a2148359ffbdabffe7d606793efe7f9e31ef247a796baab3fcb24bf0f8
-
SSDEEP
768:60eEej6vexDyF0eMcWcccIcncXcUcHccjAW5cA6VcQ0:heEeKe9y2eqW96T0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b9f59a0ae5a983f612259daacea1950f5d2bb425235f04b1135b7fcf985e04cb000000000e80000000020000200000001824809725f47b28f6a02f5ffa130718ba6b7b9ae53c12e7654ea7de40f0c7e020000000a8c18f6fecb84f2903d0aa4054da9a6d6a93a5182dfcae4c52d97cd8e2cddd7d4000000084b4e1ab8c2118bcceaf4987a9925ac4be3c21b1463342afb2c9b4166d146fc0ff9dd3292c7731abb5f18bea111cf7a21dfec46c82ee1023371213301eb7e085 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c088cfd3479ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420565387" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a541cf5a048b0410ff415b62c895281fa601747a264b942e6a791372f689a4c2000000000e8000000002000020000000b8741a1b88ed1b69d7277830a290600c59b2028a5ef1624c6cbcf6746dd5080390000000d0081e3e5da2b37b8b5a72a59b1629d777bb8dd52fe983fe634dc42eec032940d484556f61a473136ccc23018671a59998198d5451a2f411112ad1f7b86874d5dee1933da51f51d1771430c990e775e6b0989c3bfc19cdfe648e3956df083ccbd8a7420076920e264a91ae2bda16e866cf16dd1026e0682ddb45e8f77a2ed5561a20483ecec3cd4ab7d02b4704ea96ad40000000910cef3e06ec5a3fd8c5ba471c1dabf2940b05aaa4bd9542b1aad4a198fbb75c416f6d03a36222782b13242d65abffe5d78145cc49a4bee0cc4a836b156e0baa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D32DC261-063A-11EF-AB14-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2332 1976 iexplore.exe 28 PID 1976 wrote to memory of 2332 1976 iexplore.exe 28 PID 1976 wrote to memory of 2332 1976 iexplore.exe 28 PID 1976 wrote to memory of 2332 1976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07f4f34eb8a06974398688b61b3a5e9d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfa92c8c7c1a7261979aa50b04d973b5
SHA17d8335130da4908b4c0fe16a5b72bc8ffc1bd1df
SHA256d8f1f911cfb0f64b8725326ae9809f63ded19207a43f79670f6e931535ee7450
SHA5127492ab9d30d605236384a854435879f7cf3b01f4ca3a17dca2baf43fc902046ed24550b1ce3d23e16dde622474b1d2b6310f40f22632ff8372d36fc2bef20e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9b37c5f8ab15527c661a4aa87fdaa38
SHA1c9f6480658e982528e3cb90e1c7dac5e69bb3c09
SHA256c5158efde65b7fce51d968e074c6bbdee3f90b09a7c84d2d9be676115d2a5039
SHA512faaeaa83ab71e90b99f722b30535a0b0a65ffcb514280f29b54966375fcb4da669cde7c9bc4deaead4b5f1ea43000cd03fd5590d74fcbe7cfa6266d46db9a015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e53192ef0a51f91ce44e132f5a1321f4
SHA1d8ae75784a710d9d62105e30cea9e743b34bc28f
SHA2565a583e78b50a50fcce6c2d2b848e09283b9cfab7a8e9cce16d70045477f38b5e
SHA512d8268de3db34f0e8d9fa02db7c525d0295ceffb0ddf12f9be83816dd8e73eab0eab817344a5ade66e33936ab251073f5f12131e2d5961336d221d4d8d7dfbb1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abc147a2e040884dd0fe3c61c614c436
SHA171b961ddabfd47ba46481c0a361ac4d585a33b51
SHA256a5e6187eb1eae1569dda1170a5dea81e9ffe165d990acb2efaec554be78329b5
SHA512ffb2ac48af14cd746abe286129a4197121356393535f52e9f4ef6ed6ef1d7816128f983e173d20276438a59ccfd3c1aa8c2a703a7f353da68df7fabf9295e3d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c95c6a8d8eec89c7587a4ac161ea49c9
SHA11be4eadb5bef73ffae4120f1a527c3602a95d1bc
SHA256e153e0a709f35b751135dd159825779feb433ab700a55a4b5aefc86f59cd4a1b
SHA512378535d9221f3d4b8bf87eb9a8bca03aa6713729eb766153ab4c97ff2faef6324d94c6e7573f06ea94ffe45d7c40bfad656a150acf62b561e4f4692df99ce080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5f62e3cdaf754151c41df262517953f
SHA130a3fe05b9342632d5bab836f1053b4f35bc6ce4
SHA256d6dc02a3cf1ac798075b9e0fb9049b82d304b43e77b5c521c905eaa06a00828a
SHA51204ffb6da4e0a46c59d25b1bfdbcb5f8d15328bde6959ca63b7d79e7cfee4d5f92631ac2144ab87c8d7262412722fb3e888ecfea7d6eb744b210944c99ba6e4e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edd251c4270a931cde9a294470520106
SHA111fde9a657ac9d006a0ec496b3e4ddc27e7c3381
SHA25604769a8af3c22d77e44157992c51175705afc9f33da8c3580c2d41b1c0361167
SHA5121b9119ff5a5ecaf432d1e6f1a1018599a33282b50d137402d430ac4bd923ca31fb1f235b9b7930628a6505b086d835f7f050230e1faab5a900fbf1202c96047c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517d512935964668b34cc3b79a20bd447
SHA1ec9bf744797f17ccb37b2dbdd18b1ff421203edc
SHA25665f573ba4ae33e79bfaff914156d4df1cc0d8a2606eeb4c730fa2aed5ad45edd
SHA5124ae8c86958a43a2e9c8f0bf805810da23d408e3cd6b8da18c08b20351e06a27acbc7c38a8658613a5f9f4dbe87c20879d78f8c524716e1752a776ce7bd07018d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acdb8d0707c7624ded30216047022018
SHA1685a38baa8be026b25065953a3254318680df760
SHA256140533c212b86ab26b06ee65d8d2e166ffdbff71bf8d330ec9d246315e61fcc2
SHA5127e0e4f58315f43387f457bd8236701935ff64ba7a1618f3875bda07497154bc7ad105461d630dfbbef9f454751326cb4a2668cbdfbef11f2f481ca94afa9a488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cd798a22c5c0fb1440ecfa760c8bdea
SHA143df93560bd2a33158efbbf23dcbdb453609ecf5
SHA256fb5692d9c4adafd62e64bc5a62704af3d484b82256a32007d50798b3c9ae0255
SHA512592f67909a513512a86c5e075b338897ba84781759272ca985e744c55b86370d713ed6d5f317cedc44f59487dd182360fdfc9f231df2c3c3382d3f1907fd8869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a35c519cca785fe7d43c9100da1f955
SHA1ce9a95a416aeadafe356ca7f1e1607fc8719911d
SHA25671bd15c787b7ce1b10e2c1f8f602d4af99d83b8c366ab24840aa2d1865a9c275
SHA512f4239b8c4fa7e468d64decb776ec575cc78b5876af1e2097b2cd7994332ec15227e4954be331dc30ff251d5e7bc6eff22a1f8f9a1b7bfb916bcd66cfce09768a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3995e8da01fe541768ce7c911745613
SHA101c2ec32a45167e712dcd0c7b98a04dbc09cc9ea
SHA256ae65b1f293e7826dba7cd49ab0b74c4d697a2bbe21f68642d3b456c6041ae544
SHA51237f1cf81fdd3b098264c66f578bf4a4bc4a9bbe8ed2c87ea902cfabaad88afeffa750a27f5f322f1bd3e92e13fecbcdff819e90da759b48495865622fa826e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53030ca031dcf78f26c1f3466648835b8
SHA16dea3c46edac6980eb11b11ad8a500c64190e5fb
SHA256e355b525f0aa5b137984165b915ae35d9908c9002c851575c79e6f2c6118c567
SHA512dc7d5dbd235f768655ddb8052612c88ad41191d50e1c6de970722f705e63c52efbeed00274048a99d52c5fe466fc24f97a065fbbc04125a423c16a1c9f6cf6fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f413d47844ab30632d408056b6050bd7
SHA1eeed8a95a5011a11d30118385aa9d764432536bb
SHA2561bea412e9b624ee1c4bcc499041368984fab2a8d74ed848db3b436d743af9d64
SHA512734c494683992b50576a0f3bd434d810f977c66742367cf9e2426e14415933bcd0292342603efcfe2d66a5d096c430b24ee3a0f9070dbb3ed0d6b1781602a9bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfad47575189e57e89f801dab273febc
SHA1137a07eca83c94fc72f7b7d0742fe1e52c8c6b0e
SHA256c97e983ccb3b1cc706bc95443fab89fe3592bf8871a6ac36e4f55d129a89214a
SHA51249bc9eea5cb28396e907855cefa3b1a1aa811a14eaa78bc8780fbfa1bbf34761d6a9bde31adcd8b3e29f1a2a786cd4eeafaa61e0d2b5805c587224daf2f59d99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e23ab8d39276b2b857038f15eab99d6d
SHA1b4a9936adfce95d8c0261b5b704cbfa6b612cde1
SHA2560c0feb984791cbf494244e22196232f17554f5c5fee26cace2fde69d99db3df6
SHA512397483d87a12f095ed42d7e343fdd69bf674e9547b71d490a507d1048059f654220672a0f7b8c103205c586693dd8c81d5b2115b3a4ae8b9163c3d424b8bf65a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e73656b61bb645a84aedcfe1500d003
SHA156f08ef7fa2ef05c6c1d8d29942239845fa55029
SHA2568f144d8f96f16110a6d7af90f7741f4dceda11b6e4919201603f4613708ba8b5
SHA51206e73ca18b2b6b578b182119cef74183136041c93458870edac5b8092fb473c86327a03ac018e7eeb606121b3a42b7f149f6abd9dfca85ac88ce72838e01f46c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514a18032e3d8c1a6cd84038b80d48ee1
SHA1854f3b13c7b34f058f9fb2e416995ab836d59835
SHA256de598ad06548d299e7225752b0352a5b1fec73d54ad1983b625b7228aed8913f
SHA51264c5e3b71f6004f76d9b7c1aef04990c5e034ba8d1a2525dd9f86c00f0757c558bd4e52fcaac006a8dd805d8367330c267f120af133fe7798296cedd91572d47
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a