Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
088f6790dddf7267291e3a798dd15753_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
088f6790dddf7267291e3a798dd15753_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
088f6790dddf7267291e3a798dd15753_JaffaCakes118.html
-
Size
41KB
-
MD5
088f6790dddf7267291e3a798dd15753
-
SHA1
3f4de9506ec877434cb130396d1f4317085c009f
-
SHA256
b157786adf8e4d81ea7619e3f1e52faecf3b2d40ce34ad9da8f39b0fb44c2150
-
SHA512
2720f57d441ab2479fb5e3ce8e7866886f4cf8c1075cfcbf5711d41aa744a186b6969c98349adcb358b518eee16dbd525ea9dcf8e863215a139126f5257966c1
-
SSDEEP
768:A+Ab45oXnu0QQv1dAuSUFKyo0HvzCk0zuUBckrLkuE7crndOc+sc9M7WVcZ:t+XupTvUFKyoyCk0zuU2uL5EcsyZ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{892BE111-0685-11EF-A635-D2EFD46A7D0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420597475" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508ee75d929ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a2240fd9bad732612fe205bd2c88cb73bdc1884a3fa9ca8d9baadf5f5f0c442e000000000e8000000002000020000000b7cda8bb2b505a1a27536bdc2c55160811a18ca9f06eafcf195c86a4da104a5290000000487c993eb6a4c4d2faf71f54ae12c4ab45852508d2047b9e9af69aed7f03a348bb3862f26c4fc5b64a21fccb5d16d904ac2552f93f314f9cffd01b0391d2a0e02c6c868358a2284d1b7ab7768cc7e6fc3fc72032b1542bd15c0648edb7bcdedad1d0ac3a8184f0b76932732343d66472434be2f923bbce265e1f8f2d3d5293a06557f145bc322da3222341217e0c62a840000000dcb5d0f34c3b5d959e40f5669b342f805ba05a9c073066dd8c2ea349b4deeb7ea19f995e700e71b0076619fbe10d1ba832444c021ed6b305f78720ae8069942a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009438994d5b465b571c2161c2d545b00bf97b5439b08cef57224af61c9809a712000000000e8000000002000020000000b1e255892afa9006be975b03786ff69e6d534e63e514dd9439b7245ebebb50ac20000000783b7a1f6a92cd18c113db2bf7e0d0d5eaccbc852867f9c5cb4f7683d932b36140000000f97e3f440b5d4628fa7baa8d778415de8c36e54b4ca9b3060fba0d0941a0b00529dcc19180e0ca3595b5bc9d2204c76dbfce2d146127cc8d47d3a13bb73c1cd3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2956 2296 iexplore.exe 28 PID 2296 wrote to memory of 2956 2296 iexplore.exe 28 PID 2296 wrote to memory of 2956 2296 iexplore.exe 28 PID 2296 wrote to memory of 2956 2296 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\088f6790dddf7267291e3a798dd15753_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fb50733c7c7e97410b191cf214c505a
SHA13e1fd58868d950a98a845cd8ede3168a5e27faa8
SHA256c2e82b8676f5a81bf1cccba2ea4640b82984654ab39fcb69637a4bc937201274
SHA5122049bae248344051f565851fc3f48b2f014f94685e671d8f18580ba706dc405beb6029bc6cbe9810a0fc1097feb81364daa9d059c2b52ab9ed2c1de3445b2175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9255539bc6af71c01f047d128f7fac9
SHA185bd139505b4e4da4fe52ba72f7f316992574ad3
SHA256f7ddc052f86f5a61f3a56d08f5721ece16b69065cfe26707bd42fdbbe6e8589a
SHA512c1b2b047202ab664acdeeb7746ab4d2c4d14a3b0b8fc97121b1499018f44c796c4ff1cae427dc7766ce948fd7e8844b93b7f3c35e2b648bee285823b4d5a67f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5844dee4b6b0f527f219daa8d557d8e2a
SHA11cb4678a2269258c8442289c87c609d20e654adc
SHA2566d6c94c17cd90d6d34936ba67db9310e06c9dd368e401e185bdb215340a1b99a
SHA51209b3ef58f3c3677b4661ecff5725490f0600456a85e0ae9042e07d15852d556d7307d64f5436f31ed42ddf998f35b6151199fb7d7f8158e539c6b446918ff072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e558974d962e45ef3509c939711fcb56
SHA1fe1c1a471de940c9e794a4912c979d3ea8433b94
SHA256f181660d3793888db3a22114d3c67d88092913929ad7f6c6a2bb6a55ed186bff
SHA51208b5650458eb801ad04573868bfe721e59331152fadab5f1b4d23006bf1124989ba8adbed70a7f2aa04022b54f2679884f0e7237797cfd703440528d08437e13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59899efd0bcf2ddc2631d166f30e9756a
SHA10e595edd0ee045400ee6f6ddf7e39fe218cf8a98
SHA256fbedbb2d287b907b54f1012b2f4c8672909f05c0d8a74e2ce927596ab7c4a760
SHA51230577128fcc7dc2a20c45e430f600532e5f777ec345fc5c6607249a2ad7e15f10d10a7e631c60333b350862b34d5a5aeffb9c3ab912f72465aec0861ec08bc23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a569b0c92878e9e7124c226133c2d40
SHA17ad43fee08395fd68e5464ab8384b2e8a798b7c2
SHA256c82bc3a32de8cfdc90aba5f232599a1ae15376a319705d8955169202b5903c87
SHA512a5eea1d11becb3b72ced4361e294ce2e0bd32b82883f583b98b5e22fb63912a0b605a5fad6e69c88b6148e97c6134fe34d6f24210134383d851b8a0dbd7298e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dd3911278946209dbf2ae1597310124
SHA17dded5663c94971ea2ef715459f4aa232f04fe9b
SHA256b046ac13b6173a33ee0ead411f6fb736b2da8fb818c6a2244f30239db61e21a3
SHA5123b16a2ecd2b2f8a43ad55ef62c2d5ac8fa806c0b4ab46eda54eb0c7ddf91222828e77363349917810316a557ba36b937a99c0622b3a1a13624c17c0d5dea1b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598d6a4809b4189ec9b805a5868770609
SHA1fb7c033717d1df46a96c1c2d259310cc34282608
SHA256ae5c7dec73d099fe79520af8cc65b90fd67ecdc53947d73e5804a76aa08f6d96
SHA512a1e335795c0688f44f11f4ff758d62493d1a6fec7894627b0da9224b3725a43de0b83b746d3be7f3becde466cb8b2495fdc1ccb3658308a3df6c46bd026a79a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc415858fa71a9e14ccb0e150db37c6b
SHA1d60c84075cc817d280e002155f60b30f5cabfbf1
SHA256292b62427a56a908692730a6a2b9b13c5a9d9cc5581ba8302b49b4282955b5c2
SHA5128c1223d77d8307f6bf924936bdd58085d789561cf10526782f9d909a7506f1e80b2a8a1fb4d41395bada7a27f40096afb79eb9bc3d7dc72f970cd44b92051ba5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5957b18500eb490e055edbf401668daeb
SHA1d6c5b0d2879f3e3b2948c10fef32c1b5486bde97
SHA25677ae7416b5b3dd720508753833d9e411533c53d792207ed49e120bebfc4d5ed1
SHA51259a2eb48bc02e911d071408a73ccf3abcd319a3a134143d03007f17001e6bb358fea43b187b558694e762a30ea110017019565c49aa7f4fa35dc99f20e09023c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ede283a3e1491754cdfeca5a98fc83
SHA1109bf170ea5402eaedce0fea1cdd8bc7a06aaaef
SHA25625301eb2ba84ddc5e591c2ae038f4b4ceaf004c73a8f4405dd0632b8c664d75e
SHA51288dedffa1ced5a5be7635e392a215ebe8559354864f90c4c8127ab4ba89c86cd95110a0fbaa54be159043d0a7fdf4a17e356b644efc3f3830ec098afb9d83814
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59149747f761d9c9c120a13a1455d075a
SHA1fd6490412cbb4693e1f6620e50dfa36d20c00b7c
SHA256ec4a973e9e30aa6bdec95ea82bfa96fd7c617a0259b661e5fb56f8af4ccf485f
SHA512ca8ba9477a4488dc22be8bd0ded989b063e94c28e9b5b4562dd864a5501eff9c89e9df19a8244a2351f366b0e5579d25a2b2a6e73943cbe630e2d235d179d080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568cec5aac6419a460ca478061ec5df96
SHA1f8e4baff76fe542a770aa3205203f7fe567e72c4
SHA256be9c3044b069c9971b14bb0e5ca48277e0803c7879d1a4cfcbf0b922342f35b3
SHA512780a71bbbb665a0766316c4099d4b544e617cbc8a86a8b6d80efba583091ffddc434c924c52aed53da3ef276be5c7a8e8be0975abd83c85c11b05075e95a8e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56248b9387cfda1f26f570f920e4b17f9
SHA192c77d813d65f4e1516ef3568ddbdd2f638243bf
SHA2565127f6ebb69c33c968ba7717620abb7351d947bb5705482f5fe9a9cff0c5c732
SHA5129b1c724c9dd450ef3d80d3ee413c5f03b373afc02a62ebb73bdb823616119ccae9306a4100ee2bc0e06b025fda5123a383d252af21287aefc9fb1efae58a8c0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507e22e14315119ebfa2d9b304b11722a
SHA1cca67c2b4df43e32586c7a1d92d68ccffb15f51f
SHA2567437f68db5a805b8755cc18ddfc923979a284503958353f6142b34c8fbd7147e
SHA5125e41836bf76a4d3c11543da8bfdcda4de170bf1503df7f19dc922c9460296a4095c3074e380827878af15d6c679e84cdcf26044e53c21e6d928347e3218db349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1acba00b6dacfa79523e5ad44c076db
SHA1cecd46e5f61c39031529dceb6934242dadb9a406
SHA25692dd16dc983a1fdbc458f543135db2e7438f4a939e74a1ac95d110a7ec2ca053
SHA512d1ecd6f48f6846ce13ab6f6c390cf08c4c22dcaa6c28474895fa2f801f01a8af9404080098708592a5b72b99ea8a7757655b3b6da602e96f9799f84dcdb776bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd085176e5f68aa90a0f5df5f757018a
SHA1bf2dca599f01cc426f7da33f8c3dd8faff888a38
SHA256ecea453e382aa21c364a8646ced723c1b324f4998a7e972bef71d325c787924c
SHA51258518186f72bcf9b0102408cc98d40eb8d7f4851934f86889944e7e5a97973e53039cf318c410ce779a265873f6134b66a33b6c517faf73566e8718aec3a997c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a