Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
0e416f2d06e62890aeb3e7f8fc6cadf4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e416f2d06e62890aeb3e7f8fc6cadf4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0e416f2d06e62890aeb3e7f8fc6cadf4_JaffaCakes118.html
-
Size
51KB
-
MD5
0e416f2d06e62890aeb3e7f8fc6cadf4
-
SHA1
73365821eaf6b5be2c8e9dfe8d109ae04a2fff63
-
SHA256
84871856c9e2f8b086f4bc5c27d2d663444e9ea79b88e0e96dbf09b16b3f95b6
-
SHA512
c25776e69124416272e08b63044ca5c7a8cc19b19ea7c6b5d2238e26b3e48930c3f438ca27f879561a0af1624b12aa77e72b2b45a3d30051bedbdc9c1101c4b5
-
SSDEEP
768:SnYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:Snl9bfisxu8kmu4eSPfiM6uwjg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1034762d7c9cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009fcecf045bff21ee6fbbd88a9883f7f3784b584c214b587baf716927c4ac1ad6000000000e80000000020000200000001628d381d972fcb2951a5b97230eb300ba6b475722d1ff1c8ba5b36dd8fbd94590000000cb3cbc59e27c9b20f8ca7c5a57efea0250e9aec8a7b24510706d24d9da8cb0cbe61134fd19923afacc3c719a7b19ba9510551ee98b6a67176eed0804fe3c173009f686ef21e1577ae0b3d88d71d7a7c5f407a34663d19c26652229f366e41e0499716c0708c40309757c7d26cff8738c288985beb0a7fd8e1e6b4dc891743068b8aa17ef58cd0628d253dee6600c3a25400000008ce29247364ac14c7bd5a54a184e440b166a111952577e331f7a7ed3e920eeb3250ff9f0e60a849785b500e608a4edd7de4e528f5401c439b62db0ce8dfc0320 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{586E2BF1-086F-11EF-9FA2-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420807847" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001733d2e67112a23535ce55aa493780d5a572920dfaf7d730f31b9ffe8359fc3c000000000e8000000002000020000000158241a61661274642fcac7d0f50a366b92af655c387a8459e1693b1752cdbd820000000231bf54bc3cc6813bfdaf260f73efb46c4a32c001ed6c59179dfdb8e59d35466400000003f2086e4a1e53d2b98d04275b0ba4f552c8404e77ac5d6ff1eb90ceff61e35c8328db1af89986e28c4596cd3edb758f607cb13a0946497d55d8770fd9a7706f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2192 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2192 iexplore.exe 2192 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2504 2192 iexplore.exe 28 PID 2192 wrote to memory of 2504 2192 iexplore.exe 28 PID 2192 wrote to memory of 2504 2192 iexplore.exe 28 PID 2192 wrote to memory of 2504 2192 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e416f2d06e62890aeb3e7f8fc6cadf4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c9943cdae2097c20b7d38eb7791c2b3
SHA148c79ef4e10b1904a97b9356d79273ac0fbc9460
SHA2568cf4fd1b5d2342e8afd8b6dbf765ad47abf463616d3e559e1b3bb0cf56141ad4
SHA512602fbfdf32ddabce723304c2d93e8898b42491fa10eb7f34a88cc4394ba059204a496421a6dd7f2c8b1d160c5328e534d793539b65ff13228e46c8a72f049e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f11d885dec9c9b28b26d799211688aa5
SHA1fa49be9ada5e16fe8dbe7142a8ffd8aed448d4e4
SHA256ed6560c6f16a09759acdfc6470645a4cdf8d81c4c9a8a6c566040e43a54167a3
SHA5127402cb9a097996a6f2f2b537253c6de197435d6d7c791ef43578215768e8f00166806064c32b471795c5347ea2ec8322f84cd3ec21802cc7c69444c66c005dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c89f8b5e2ab2375832229140d8f3a19f
SHA1d5b9a0680404c8b71784d1accf70d254031058d0
SHA256f3b4fb8eeb49f08c35b4c85dcd797d076c393cd794034f14d6f4f275cf8bb344
SHA51261ea9f4dd629467747c778bcbdcd91e4631064781b4a4df699720ef3e0154ed1e81c922d8d0bbdb6565225d4fe029e1e80fd370c5e4413608344ca3548adf1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56229693891a881a85d34d199d5a230b0
SHA12070fbf10bb1a3da49be3d78da8a44291636d333
SHA2565145be68195e17886033887fe49566cee843aab9e590d7c5a831109d9eef6829
SHA5120eee955ece434c65051f872a7aa1350e85daae2300b027db23908d54089da3d594272cf57753ad93eacbe2c59646e48c9b21af0e3291c83d453b9f67c57066e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2644abaf0e6d791537ffcdc8db83619
SHA15b26b471740e8de6b5c9cae9147f14eb2692ac65
SHA2561779851d98d3fe5edf172a0e4278c41e1b5ba4c550f2e55b819b86ce8619c792
SHA512dd59cc688711ad44ba87712ca33fb9bed99f1c05d294dbed5daa0f3a8dfe2a259ca822d5db80c23203ea1602bd0efd876e1131e538e153075c1dc497c7d9948c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f313c57a30549c1d10341c53a100c919
SHA1a84488b39e2cfed764b4bbd5fb7a513e105fbd59
SHA25628cdd3a9ffb920d412011e4cbb49794662416402c1cafda2e09cac4da2b26913
SHA512cfb6abee511ecdf422517097ee231aafe8d702f8fe4f79d8dab95d3030b219735541e87ba3dfc2bcb30b3618d576394dbe58405daac499fdea0bada4da599442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1cec316c8f4598bdcaa3a925b05ff9
SHA14ba2fa552590cd00274ee4331c1166e560b3f149
SHA2561f7f0c9f01dfb31f4e39b4647e0c878bf4a52599937b559111ccb7adab250626
SHA51219306226be66410bb72c8b3d717f9b2a6e46a8db9e7dd7d2c4938560aa3b19d71147ab7490d76fbd7db5b07880f1eb087e305706ea252e82d28c3127a39d91a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58977182155718565768735ed0d5f9496
SHA1575500c6b4299d352e7e809ff8f444d8e5b93100
SHA256a11bc1b82f9ef5272ca3e1a03093612dd28d99b5450bc5abe0c648ffabac380e
SHA512f02f08bc0986975ca41a9cf6884bec3fd7afed3a93c97455e4979e015b46ab7b9b006ebfc766e077c449c146cdecf5f2d8d89bd176b1b7dcfe3c491b0ddd9312
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb4932a517a51d9261d8bb142de115e9
SHA136f0c4edc4ce7d800145bb60577cbfc4a952242f
SHA256a9845a4775c22bf88606684adcaa3e39e03810d336e7d25b157818ebe8f29948
SHA5120166d1889c642388b1e3d255298f3624164caecfd3f5ef8ae7dc35e6f4b07b3f066cedfaa99c97b4894e2801431f9d4056332e82e0ccbcd85b888e42c638e23f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523c58140a081e8fe4cc99182ed93e845
SHA1fb83e299acdfadaa61182ae4ffa4a6c07873ed65
SHA256f69a1ff3026ec8baba417a71bf9db08875fb40cfdb4e2b9a17b1219b43154d64
SHA512fc6c4feab6d8a967c98b5e84ca8dda40081eea420bbc4276955289f14dda22d670f0acfab91f88c7bd0ade4034cd11821e28b61858115c73a1e00e57a5f81e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4d5a8ced3d55393a3fcccc7443057e5
SHA10f9d28bd1806a5f486c742326561d04d3f994ac5
SHA256b42f2ee83fe3fd77105ea4233c3fa26dc6f9e4d70bd3fc21da2acbc6b3facc2f
SHA5128a96eb5df32fc2da373fdc7e883ae8f24dde7934af32df8635f5c88a2bcaba56ac3be7da5b3f63031aa2b556cd6019a839310e04b10a56992367f86e90ad8628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c1b06aac8212b01e46a068ed5a5aafd
SHA14a9e4163ce7a73f801b6c3b42bfcab9617fa322b
SHA2563de38821c73d6cd947577d290db2f0b20cd661d58884766d588eddf4707155e8
SHA5122aa8081287f500197030645d2e45fbe47c0f6c87770f748037ffa7a6d761f9174dfe189cad11a5c683522e58e50f74cb76ecac05dbbeb418f1694c0e6a209981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d0de6f3d337eb62ddc8e72cb6d7de91
SHA11ee1c71669d4483e4a3b0d04b34cf709f30cc88a
SHA256179599caa45605ba53afbfa6af4e7413da62bf81f55a6c032296c05fe627c4aa
SHA51288eb6fcde79c9fa3b12018d26fd235a1e3fca53d6d42b0ca47f7acac97100b109d0b80810101cbf31f12a10df1ef04bbac25d6827155bee0c2817db025931d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dabf65b42322f1a66a7563807fb97024
SHA1b4c5d9e1b4c3a7c10a44c75b91f1b1d105f1f40e
SHA2564daf8469f8aa94426a139a2de176d63ec18a8df058075e0fcd207e8ae878bde8
SHA512a8f6858627f5744dfc5339883a8c7e3a207f4bcd750b850cbd7d090906271bda4f94751601a8f82f405523ab5c7f9d1b8ea9d7810c2046998ae576dd2ab227a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de3a6785e4be428b1c00e16711d5185e
SHA1d54dee2f49e429d90ab03b829f005c902abc7fe4
SHA256128ca9ed7fbb419305b096a6015130d9cb79f0386b63b46cf54b62a9679f916f
SHA51237a844e9f4da932d7314f0e7fe05820a17697ad6aab985b1b3b9477f633b15b83e1ddda16e6d504e495111603de087e90302be0076f1d2cd51409a5a870c3bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e519c8b3cf4e28646b66a991a1c37f6
SHA17fb032f7633ef2f677cd564d03bfdffde511a184
SHA256ca6e94dd84ebf59e823ea72ec1a58eb0e0c19297bfc5b467832f8c1a3826e402
SHA512de8df0261c45d6714629d59110d2aab06d127f35925d22bd0a24303950ad3eec675936f0171a1d9987b15dbf9a9ecc3cae84862b0335e809c4fbe92ea834e185
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e591c2ad1df7914f09d725b10b37c156
SHA150d5770fed36b44ce5c5e2040fad0ae021e79dfd
SHA2568d27bc0b47b1685ff0c3a8f5d0fbe2cb05148746b8d1f5544f6bdbfd90f361d0
SHA5124c2dfadd1be67d6acc67900977c25d49ff7ba9878724654b62723ae668f453040194ced765ddaa489ad5bc7e7f0816645eef22c3e1952eddf25fcf8ed77e7a0d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a