Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
104929b0c6c6eebeca1f97cfe2977d79_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
104929b0c6c6eebeca1f97cfe2977d79_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
104929b0c6c6eebeca1f97cfe2977d79_JaffaCakes118.html
-
Size
461KB
-
MD5
104929b0c6c6eebeca1f97cfe2977d79
-
SHA1
bb8d6cc4a384673f60195e3f0c29f08f779f06c6
-
SHA256
d792b5fdf95d03c9b77370401077a1f57ff50aa90eaafd7bbe03a9dc30203670
-
SHA512
70c7703051413e35fdc290d957b64101f11410737cae1b1c808e170a2f0eefb25fca7ca006896b430c890288e5f47fda3e307dbdf19e465e23a55f7f84fc4073
-
SSDEEP
6144:S5sMYod+X3oI+YGsMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X3e5d+X3Y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002fb0fc71f9a8480f28b44831bf7f7cdea3b530dc4c893ed350d9576d9d0b5666000000000e8000000002000020000000eddaba03815882face0c94058cd9111c46d51f442eea3f444310c04dfdce82fa90000000dd3e02966bd4a6851218752a17a3acfe8863ed6349843f1005f9e0ce1aa0efc4f1b5169acb74c78b41a03013226db7a343db1b345d0b45124c9b9c3345e78203448953030c43474d008cd6fca2c70a183f2c57a2f2254233f07e44983ea4ff1fd6bea254af0d5a213e51417a0320d4bd4f4ff4b4b1f78a7bb600fa0076e02366042d465fb474c411595052f7dd5f9d694000000006790ab2cdad93f1f47a7fcb34bd5a68ea1e61c98b97b18eb4628edd8686d01ea0879f735d1ebc1c7628897e548bddf4834fdc28b08d144cc43b5dc1a9aeb47f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420893583" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F728AA01-0936-11EF-BF06-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f6c2e3e7822f5a9ab36b240ed3157d044ddcc5d42cac55d9c736d0cc238f466d000000000e8000000002000020000000b6a55b59e3872a9babf7d571e5d7a83ae7daf921012d35f4b07c995e035ed036200000002cc5d7b6957333d99c2102655879f39387737940b9a60539a087be5d9be2761a4000000020da63abe642db4f0782c336dd67789527e42aef68510a27bc6eeee255b01d53560393f004f57bd83777eb9d1720e94d413f035c845543c2b51d517a31a4e6a7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fbb9d0439dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2060 2020 iexplore.exe 28 PID 2020 wrote to memory of 2060 2020 iexplore.exe 28 PID 2020 wrote to memory of 2060 2020 iexplore.exe 28 PID 2020 wrote to memory of 2060 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\104929b0c6c6eebeca1f97cfe2977d79_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf2146af972be2027958f0666127d951
SHA170e5d11841df9d2d0c2e1b11c975768cd3cea768
SHA25618a9d6b5b3edf8f5052ad2808937f36acc8adb5127a21711c663cde69a61681e
SHA51254cd571950af3b82406d337b96cbccabed4cdfef2471ac07d5bdd2c2dd85731389b0825768cc8d7dda7466c3c53c87b1ac2d560708f21bbd29b0712c4b117824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5850a8a264abaff834b415d3e1a4f26e7
SHA16d91cab96cb8ba2208a11eaa045a30da9b8386fd
SHA25618ba8a5edc4df060e82addcb5fca95a006a421c1700c7211a68b48717fe829aa
SHA51248f5313509a146a7db8e398f865f106880c46966aca034aca208b35fbb30abdcaf258a2f1763e15638147d28883132f2006e1fa1cf05518d6fbcc49e2b6faa85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58adc8d5202339f4190bbb7cf73229605
SHA144ce912fa691976753a2e1cb1c8b2dc3b6830288
SHA256491ed53af7727d2ea97e129b157046263b3eb74257bb3f6199c5e0977029baf9
SHA512b1d4f1ac9807e73b80b7b080a38de953aa4041b23c90689e00d500e148b7594f3ef90f236dd051852758e42e1920d15fb5b9cba8d696c857040a0e1a58197f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c99d1426ae3e7b5a1624e33b7192587
SHA1fa697fcbafbe642f87c6fb9b6f976715bed7d665
SHA256edb2667451955f5492dbcda99dc25a4261e0e78b023f302f5ed11212febcec53
SHA512e23f23907b0fa5552025392cfb4d10843d886711e9f813399ff76cfc123043011a1dd63c01cea3b159516ec663ad4ab0c6d94cea628b2fbfa6c24be2b33f1aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f183536e43b938f8aa3ef3279fb55ce7
SHA174b20af350a0e5ac5cce0d1fbae946a927739e99
SHA256d7e5661ee9bda7dd0051829683527940ec0505ca921f38aac79c922bd46eb5a0
SHA512b454682f17e262d0bd614c5d3adf30c2b1f4cc13b385617605c6960024aba624d15094d37bc36b9676229bfd8a94afe7d924f11d2b24371deb354f3aa41120ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591dabe94622b9be5897f232943fd1bfa
SHA15c435e19e97e2bc574dffa1c53d5fed685f6f0b5
SHA256197034551933092f59de16934fe2ef03266eff1b770c856e9f0fb4bf112c3c77
SHA51211bbaec7b2e23920de00a650b226d28d64a990c4adadef7e9147d19c2879f9e02669a9e2c20689ecb64f95ec4f7615351405fde425becb536bc20f048f4df937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e52402523e542a8cde46f05baf266280
SHA1627d0a44ed472639c9933b2d101d87b23cd506de
SHA256ba6d64ca1f5fef3195dfb268c25b7ec285ee18dbdb41f39a41f5ab5fb959201e
SHA512ec5766a881c92121740e64cf6e4ebb01256d8c304a7990ff8fdcf292f98d32f59c87639f8cc31d9c15beaed40ee5bc1209b06295bbcc297dfa8410cbea101864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bafb587cb1bfa71491187ae8657f292
SHA16322eb16f7842065caceded4f56643681d29c665
SHA256d5df9d15d2971455e1a7b46f9eee953f8633e8d994d07d03d78da6a3b96abf38
SHA51289622d47a56d95542087a2ff1913c5b2a1e6cfee5944a41e0ea9fc30c0b4a62d7805aba53a390ca2c8b97d112baa988e321bd9b8ee5b0a23f9284194d18c32c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b95d52ddcce3a3cf4e6bdba9971c0e61
SHA165a9bc995056b4aecb04ad730795539d003de287
SHA256af15f6caf674f6c90aa669b74ba0a9245f6c7107da1addcbe775309f5aeee782
SHA512d5ee5616a9ff34e9d77fe56afc4eab9d1112e7ed0b15d29d45bcbebd3eaf6a8f326b88754168cabbdde22b3c3ebc42d7ea68ecdf222bbeeecad6d0402d97b00b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596cee31d8a0a2b992af6ac94dc3b94d4
SHA1c18b4672a73c6584ef7418063ed1cbe6a9c1d95c
SHA2561cc04d59b3f520a451d042bb8e17d4e86a0a7e3e5748acdc0d37d760b527a079
SHA512f8fa48a9e4dd0db3890fcc1695bc597b1ac179c91748bf8acb75d2dc6f520542d2da05163453622938773a7a912409b5955ad2b8dff113206c6334d39a9f70c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4c12adb92fdf2a4d12f2bd6685e5dae
SHA1eebc046fc7eedf5c2f60698fcf9a99c67169ee45
SHA2563ccb47438b15f87cae059f778a011de927a673d210ac5dfe74b643ffe504f350
SHA512ee10b2d3604e94adcc6db74d5b8185b26b680353d91b379ab4f5fb31ee2ed9dc8d7d6db04cc8bf33e0dda5e52f2cbf7e8e75ce4a6485cbdd710c46b3e633bde1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59331a1cdd2304a6db5ff6b69ff60581c
SHA1dd7eefbf8e9754f93ee75bc3a1dcc641994b4ea9
SHA256305b44f7f81b114042048c1669659bdd98055a734b0c1280da6590e189979478
SHA512aceef045f81f6558ce05a084fda8a478133fb2a8acd915efffd6c5fdc4e1372c465250f9a21f6de9a1d0d5bdc06e613b683d79914da62f2c94756ec73540c6fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d6eb8acbe59e140f8f4166fb6d637d1
SHA16100cdcd3109443b7109fdfbdda301a2afc1f4b4
SHA2565efc8d75fd8ceadd0c09fad0b7de1b2e6a307af39faaa4691b8004e519221f55
SHA5122c3ba29a1977db8d7c120a40a8e613a62a8050ca93d30a5c14fc59aa1ff162c3d8d421befcda6356adf844f06fb66f3a685c4023ed18f50e33d269271670be23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d548814b5ff5335cddacf2cc7f6e3dac
SHA1331d76c470e2f3d8122d34116055b9e0162b048e
SHA2560068e229f6ba3080b07324defe86d399d4ea9ff8b525e6efbda79972a4964570
SHA5120167735cc1566a186205facedc8b0a7966f372894d260c7111c7d836c7b977b8a2d9f78171d922cbd43b72a5d1e46b7c2b996aa08135f9d07241478ac03ed825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f43aaaf59055389aec2ca0d1d0e5481b
SHA11b84f6861c3e62a00f7af8bde76fabc5326b054f
SHA2565db57a27f4e083a2e65f6e87938171a6b34800e8475a54018efd5bcea7ea5de7
SHA512d233787c91a22b7a03ea48bdfda4faf55ce17ef10cc452b6f54d2816a990f6c269fbc2f7e4cd4955aa5df7bf0fce26bae02f7f83f9a43236935abbad60c839de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51934599a4389945d55c8e82095a8554e
SHA13de6e8348141c83f269133bb9f375db9696b1b52
SHA25681bb6a3d49cc8f9fa1a9d774b92bc78edaac0c2ad3e4dfd608a15707c61fd043
SHA51298cb16284a0bc7c3082fa8a4dbf031d90151fa86e5d8537c1b18439752e5053fc75ef6d2293785e0f31ae1d6de76b45726174f1255bef6f19ba00f8427690222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3f62c1e6feb22761f30c7219d95975c
SHA16a94897c1446c49d48ab483e4b367113594a08dd
SHA256ad37fb73d58ea786ff5da1c83a66bc343f884065ca3ff749418f4d53c430fab1
SHA5121e81ad312b1f3518b0697857f9dfa2e80bb0927d4086a3db5e775bfeabc73f39d820d2c7028be5ecbeda651733c90aa3cca5216937d852941ea806c365168aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5111cb0be2be7f77e07159d5340c44c66
SHA1f38012901357908d049e03b3f8f1d84ae2dc1230
SHA2569cf4b961953f65d10e94fd490b4fa9a0195cf0035b556f077f3c7e44c5105fae
SHA512eda0fef7ba3d131af011cef443c470f138f7c5a6aa73657472549f369199ad35e3845e2e4b6c45099ab093a45d17e793db6ea0ad8f70701cc748878976e2c37a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a