Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
-
Size
139KB
-
MD5
09a9cce74a2f9fa60a2f8e848d244286
-
SHA1
cee49720ac00e3bced62b13208dec788c2510000
-
SHA256
0fa0d2fbc11eb6cbb0188c00f5cc2428ae277503801fc39ad8ab332c284101c9
-
SHA512
fc1fc79671e8c025200416ca6d84c543cdd1b2604db562ba3c65798d5993c62a787741b44895399fa53a83ea81acd18a22be30449ca8f72b3a9a6a72b53df242
-
SSDEEP
1536:SHNjI3/9lqOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SHK3dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a9df847092b6204f9bea47851789ceaf000000000200000000001066000000010000200000007265f5fd1b72bae300b55a77a20698a86d3d8b1d0246879950400c2fa2249507000000000e8000000002000020000000d123f5a71b4151c210e5442b63a433f70e40a349edc0e3213771a705fd689d00200000000b9ccca17ccc2f9c08bcad76d413ecba433845e0c78a69d451e97681cfbb2c55400000009da47c97505ba272b43a2c954109e54f3b17598390ef94515991d611b5c87b69661be724bd2a53e3312c071009af6c829ef23ffa1b3329456de5d89d3b75a507 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A647711-06E3-11EF-8D15-FA7CD17678B7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420637826" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a9df847092b6204f9bea47851789ceaf000000000200000000001066000000010000200000006b8b1676972785867a6fddcf4961620e189d2d40fd514a6a86cfc3ec0a688de3000000000e80000000020000200000005bd17c96bae8c79ba65fff47bdc9bbc93f5b83856ea57e695a9bd63972cddb36900000001e41267744a7554b760004e7ac82a2b1b29aae9d053509287ac7d84532b7546c5f774ea3a1d46b06a49798b2fcb4a7f5fc189eca1aecadfd18704cd643e2342c05065b553cf5911e8446b6609910aa4c08febca36d447ed83dd09f903d1b9db048468836a609ea6a8da0f71ae66a1c765b36e75cb920e0f2c5262f6c79158810ca94f5b08b41875b7a7301c2596ac1914000000080dc48cde77606716f00f56eff0c8267bb50ba9cb4ac8da56753eac977669c0ead6a515fcb578669355f277fce554c93991fcb567fc2e66ef46898a3633722b0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c5b390f09ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2340 iexplore.exe 2340 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2176 2340 iexplore.exe 28 PID 2340 wrote to memory of 2176 2340 iexplore.exe 28 PID 2340 wrote to memory of 2176 2340 iexplore.exe 28 PID 2340 wrote to memory of 2176 2340 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52d142d268ce0764f722b135db501db1d
SHA1c159c859231e1eb706da42313379d1301cb32eb4
SHA25609d08731d5068d9b95f698f2c2cb17c01548cdd51d8eb8577f15f78c0f279889
SHA512e12c6a76a683bd32a3b89ea2f9bff0cb5c8c9da3b763448c3cc63961a3bff05b652bc984786c02927693f7eeff310bfc89ed61919b3e1aba4a192064a1c31465
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0f9dd9248473a4e7673553586cf5317
SHA1950f3e26921ecdfee4c0a7e1205b8652a139ea65
SHA2568ddd1f42cbd1102e813297d261f79987c72a65b1d70815704d5c4995b897bbe6
SHA512214b0574a2ee10b58b43a3190f023bffb32e6c9152d5d79da5697c22282ab141c618ed6b85760087914a32a6d1856260dc323dd753f5d0538f12d94afc95a199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b676dc96eb948b2b17e07250227eaeb0
SHA1a19c43099401dd176ee9007285967b17139a1cb3
SHA256baf6747d7d9cf7923b11e8b665bcabe995150a1ee6ff5a53ccc41f52c0e1f978
SHA512a649e8fbf21822c1b28ddb4b0c8a831001be9637b73db9825207d59aecdffe84c8fa3a7436f3aff15efb364cd8c73a143815ef4383dd694036d7b876008a11f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b7522425ce51e861447bc3d50bc9baf
SHA1ce9b38e94237a14d3e6c7c1a37814d285b8035f3
SHA256713871d2433211fb9a4ad19395dc6dda4a50c33b271e85e3046913e3d966b411
SHA512e4ebd504c5c70175c8f49157b5e6f67df9a712a4d6dbdb95be8bd9a22048c5b3ab6b21154b420c3c58ac00fdb7862e4a27b5ddc8d8d5472cc8ce7553a66e48bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544c0fb9cb01bd44e9780e67e03abb9ec
SHA104ce1844c3e03d3360a702991a8ad26907e6f45e
SHA2561becf44005be7c7e84339de3a2b532a3b9d39578bd3d036fa83e23560a99c672
SHA512919f3bc20cf91a59008ceb9dba7f1bea4c9f4ca5131f5fdc0ba6948f7cdf2515a68a9c039f251506fdfdff9c716f57f5144b9fcf97e0f8929971031951db4459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daa0fbd3d53b5a6da166aa9400d3ef42
SHA136751c166da5e52b3ead7de72b81ca594b016529
SHA256d3fbaf08806ebedb9da4c97586f4d4a99736222d373cafd5b6cbef535309d8f4
SHA5123819364b614aa993b912c8a3460b73f7fd83b393daee338f6980c58d1681d6a74db4f48aecdf4ee1000657d21c72843484ef6de07a4a73e9b05d4aba2495c7e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5390f10f824ab4b3a5d8ffbfa1b5a74f2
SHA12e1edb790bacbc80ace051337ad0348d39c456ce
SHA25627a4e79566b4dd0d15ea2433f1af7a4575bd0a720db518d0b5a177f6d0501931
SHA512a3796e9280ee1b61c161f526fd180cc6554039e3d55c6d3077f95cd59f3e0b98b75ae64f87b1c1a7eb3895ebf8eaa786baf5aab3ac512da7b1552730e346b7ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5216d54883281d24f69139cbf19c4bc80
SHA17bf36af90872d2e8a37b9d3ad5be47a5e96f3e3d
SHA25662fa096ed3343186383f7cb9a7aeffdef8cbb883675eb24e2df548af323429fe
SHA512cdab8e0639f6de3ff3d1865671c98a7244bae1a737b637c5448932bd7d1ddf6598fe03d3b25aff242a4e197bbdedb8df5ca8f96eccbd966c13efab2c919f8ea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fdb493edf14dc3286f03bac12919c71
SHA1cd8afb792a306a25d9da1aa7feeb4d85a2a550aa
SHA2569c839c8a4a118b23de35bc77a825fe77d13768bbab0b145623df3b7a6e39de5e
SHA512eb7fba8c6dad59075531d0478c792f7965aa6170d4c4ca60b7a821316c89b576880f2fd55aa827a0edf56b78bd0be90d7a074c6f53502f7c75fa9e3f440be14c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef817a21ddb3a07dabd702168186ddd3
SHA14c5ea725ec1ef04b8cffb00ad0fed5058401574d
SHA25699e3a84ca0659bed2c4f38d1181673e841b19efad84c39e2efaf750653bbbad4
SHA512bf111e6a140cf1ba4889742ecb83f5f58f7134ea4ef017f332a2e8afb8d6ebe14fb7b487997f8c88dea697fa4dba43ff50870c85155b8aa644902201e9486610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5dc9f9bf8ef555f123cfc7e1f681eab02
SHA1ca922719c0821b3d42c8637c8178a71d7336592c
SHA25668677f8111c69f712cad17d712bfc8932c86fbd0b03910b0577448f31a70e983
SHA51284e8376db567494c41eb929ce4c589018ea4a7d387c85ef52ecc9a92db6c85572754995cd11ba03fb9c7ea4f0eac0c19eaeff6b2494180486f01ec30efcb69f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a