Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
1075704a3c5fd3f723b665d4ee9b9847_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1075704a3c5fd3f723b665d4ee9b9847_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1075704a3c5fd3f723b665d4ee9b9847_JaffaCakes118.html
-
Size
767B
-
MD5
1075704a3c5fd3f723b665d4ee9b9847
-
SHA1
ec5bf2d3b984ca8dcc50cebb9c5d2942e351c69b
-
SHA256
ff23c88be33619e864deb78afcb577db8d4a219cdcdfe515ab70ee391b61486a
-
SHA512
12ea0efe469d0bf673b4e51d4530007d42b408452262f9dd1188d7a8106eebbc06a7c7941bf7026408539dc28cf7d60870b56b2d3233a056ee656facadffe09d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b3c50dca8bb44521d0f417949eca48c16c9a38ef39163c215ff0a47f6f330518000000000e80000000020000200000005986780241b870158d176ef6151f5e8790ce7f5ec92f271a6c7ce766e53e1d3920000000b90ef0770c3f4b72b7eaaf1e90a44a4f13d2c78aafdfa19cd25386055e1cb4574000000005bfd6eb1ae1128b8ecd355001881bebdc10612329a78a289f272725fae5ed36ab8da513635dc00e07c5f4591ecea53de8bba144760116770388651685ae5184 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420899246" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000020d0532459b9d2d8ba4fc7f20969c9095ca037fd6918d14fb6f7a674d73ee3c2000000000e800000000200002000000099207d54fc152c199c87f4981c084d95c80e22f65724927b5cc51247f31e4b59900000007feaae8878db08e9b8c6c4f936e2ee4d7c243c104d7c1df973e73afc783d01248590ce29f832cf8bd0b14219d313b185d654e074e3139354394d71a163bbdc735deafb7a6ee7226ddb268bba140cc46a3dd9feffdf1f660e1014de3f99ae37b13548c17abe2c9de801ac2d7dab4cd17025c1fbb84ef01ff0da0348f505c426234b31cff487a7d626d42ced67ac67174d40000000f62938d4787932307e8a759ae1befab991cd28e64d02ba49efb350c9a20525ef3005695788bce496b62246e8caeffe183738beec98d37f95cdeb3a159184a828 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406ac6fb509dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2746ACC1-0944-11EF-805C-EAAAC4CFEF2E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2504 1908 iexplore.exe 28 PID 1908 wrote to memory of 2504 1908 iexplore.exe 28 PID 1908 wrote to memory of 2504 1908 iexplore.exe 28 PID 1908 wrote to memory of 2504 1908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1075704a3c5fd3f723b665d4ee9b9847_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dec50413a4b79c18e289e79bb58aceb
SHA1c327c799319fcaf094eecd7a63ddfaf9b370814c
SHA25628da1f6c799a6d547766606542aa89f52eed256b0babbc25535c68d7c8e9abd1
SHA5129ee8679e31eee9c65b20b10a02c321684efdc7a85a6004b16b2e7faa4274d13a4bea11cd72945126d0df97c6310ff454748c93201dfee45c80c123c3abfa4f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a32fac9dd1a8e291033ec48a75f951d9
SHA10590d1768d937edef35904c95d17d94177a041d2
SHA2562317a48a1452e96a105e2a44c929775656de3aa2503fcef8dfaaa0ee0bca2520
SHA512a6720acf00a3871f5b699759b87d84093a94db21a2bbd483383ea257c7c557939cbb9a916df1b9d8f100c6618dbe08180a69e4b8ae4e37d45862ad859adeba94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d5c24108916c447177b92e4e6808dfc
SHA10f2983ee097896108ceaa403ca48b61be7ea731c
SHA256043d545a21f0169ff3af9d0acb54fbbbc5b4802e319c2ffa9c1b2c76e4d8214b
SHA5127567a12e7e9a9404e3acbda5cbde88b0faf21f0c9cc49318ee463d23ed136ed0605abd48ec108ae53f2388bfd40efa914da198ff740cae5e5acb0a3c715a2f06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3e4f98810d2d9a91dea7cbe03d23745
SHA109144b27539aea59e64b893bf5f49a477a0173da
SHA2562597f66e0e16c193ba13f7cc736da2dc29d28ade59e2ea3bd8fafee7e0ed22a7
SHA512238f581ce1c6dd8d53eb4ca7f9b5ec73f119ac58cfdb634e2810ba987d72450c39256b16b6adf5c4e9c5ee98d787bcf35d6738ae7c1e4c9d21d66c6fccce3b04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b3710f288c3a60a6d5ce614c31933f7
SHA12a58b88ba1f2f628895b6a1e6ebb7070d1ef90e3
SHA256f7656b679dd3ec45ba2140817e4c4839f62d8bc99bc5906ab3048f65c62d228c
SHA51253bc7787a341dd6fd9527e14791c1807a53e6ec2be6045d0fd2534c75137f3f0dd1194e70b39192c752a829360337846c3a9a9ad8a8bd39e79c21faae715b4ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570090f8f5178c4e0be0a88b54c910639
SHA14756cc49d913b14981bb9c3e34bc6b324e2938b7
SHA256d7737e67ed8a4126f5a8f1c4802fe4a89f266b25beb91a88f94573d90d076118
SHA5129156b39f61ce263ef0959258cfbe2b16ad4ff011ea76fe5c7960afb6e0a618a72c9bd5e7ac891c4bcb318f04af83a253ed0cc1046f7c9b10c1c83ec226c3b069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535ece7b5585feae29109964b706dc3d4
SHA121a0418f4f65bbbdab4e9aabea22bf600195788c
SHA25664a2605765fe38eb1de66542893221ba79d775165e20197c0043b850b0f9b0ac
SHA51232ea277f8f6a47281530832f289a582dca141ce6e3782d324c1d2442666ec8ea5fea8bb20879bb9536b51b0ed29a7854acb95c192099117d0cd87536c8cda802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad76655284956cb7d277c4db2418cd09
SHA11f5b0a3a26e50584a7b5b44dafbc743e95295bcb
SHA25666dfbca155c5825fefea7e6838d498dd662f944bc1cab99f63d23d9b0db17198
SHA5122a6790076020003d6216d80471ab875e7399001bb609163870efb966f3c9f44bc013a11bb0524fbc34924b8891271da5ff50d4fe02f86725390cbfaa68d72ea9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5f93e33355e55592bdbbd4c3d2dc796
SHA1f6be4d14ec578354d5d456854aba3c0d8c4ae51a
SHA256b52e555eace25cdc5be3e38a3546d4463068fc4ac107cf3d9f47a4e154dd9e92
SHA512c9233bf652bd709dfd4fe0d30558ed1f50e32b17b5b34b2fc6753c3ea3840311e8cb579cc1feac61763f9ec3a6562b6719e7f1c6798fc0bdb487425366e89868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fbf1f04b4070c4a60f884be0a9a65c4
SHA1f053375edb67ce68cadfb8bf88bd820c3c59dc82
SHA2567f6c82b6206d99b56974aad8ed29ca77097887d0e048bf6e8d2bccb539bb993e
SHA512ac4acfcb8bb1110de932c89ffdafb53bad730f8cb8cd1f9da6cee9805f296d8598fb5e8ac69b78c3d42b7cd013e5e32b7551ab9b88d9d436f816d20996a21a2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5821493507b1c41e6db224ec837107b0b
SHA15ce22587798bae1811df5c5b9d6b465df307244c
SHA2561f5114a4be989283fb70eecf8faeee02dd0934f8cafaa9575e6ef94416dc003d
SHA512e6ce619d6902209cce1aaddad2c32647aa3659cb22bc1fc93bdf83b61cb0c507ea7844111e7003d34b8600917a2a44cebfa5527629bdacdee49975061ce237ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59544b5774aa9cdbbb09d524203404cb9
SHA101d18564b811aa440f168bdaf1cfeef864b4a028
SHA2561e896b3e1d3eabac527417502c5537b3dc0dbeab562fe2772712d1ca08a070f2
SHA5120b9c8e86716c84aa64ae5a5130d6e47cee06e677a990c1f7922e272de873e1571bb6f4f8cb6d2edcdf71943395f6e578a2fb0d6318ce58c503764eac2113e421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e1b5a92565c3aa2dc255700a285382e
SHA11a62f8b2a5f839569de1e5dc22351bde7acca9ae
SHA256c9942ab979d8b67fecb9e9ffa8d0ddc6fe52df5f0d2fb14e17961a4277ec8d79
SHA51221e50509039bca3d1fe8dda659eebe9192ec9eb4c92829d73ea69148c4b1efb785f705db7085b812945a6cb6c37d21ff0b0e795bc80b5f9008bd8e2bdd3161fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51355cc5df6c4d391942c3bc670199612
SHA1df2603d5633744bee00e52c781f2d9084af19d7d
SHA2567d8822c7bbe44f8c73447c9508de092d9feec34b0251c36b237a310dc0f3d1bc
SHA51245a8b60cfa27d970ff5c8eb35a38ebabf42d5496b4a0b2fe84ddc3aaecd9324567a20462903e77cfcee908842a40f93c964171ba1fb0427d16120d5d9a4fc177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f6c4ebd41718f4f5a0a49ca2de5b507
SHA15329211442b38936f0cd95f6565c1a855324639f
SHA256dd4dde59ad098ca5131e6c95e545d19d7cefb4c4b13377859ea2217f94f01556
SHA5122910ba69d7cc27bd4a0b403819dc4f03f351116406f3133fdcbf83fb8e6ba867850691019c21b5e9c4371c6736ac8cc874c766de236180c41461038dc1c378ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546c1cb242bf6a2bab416fbca95db48f2
SHA10e52381ae612e126d48d76a91e6400bc8f3c76a4
SHA256bed3c158ebc3f88b69c68c6a08e101713b6e112ba0078101dbe00fe5eec61dbc
SHA512997b669d454084cba154b9a0745ef0f051678f5559eca1cb94bd7973bf71ddcf26eae23d07eb5a80980e493f7abe50f13e1adc3f373744cbae6f5e230403989f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567a811eb2dc5508f659adcaefc2bf97e
SHA1076bf9451161aa401af38f276033bb1c2f9fb458
SHA256672096ab244d1740de1c886a9df96b53cd3813d73131ea89eaaa45fb38a07c24
SHA51201075837b9cf32994744c5551cd8349d2f18ec5e936390f349f5fe59ccc709540b8057035c9b296bbca62ff3ced29f6dbfe94523daa12fbe93eaac1f8154ad47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e487ddfa38f1b722903b6bee7ab639ac
SHA14ff6a028bbfc96680580cd11656a542923b04490
SHA256e4efed789d3d0db18a59f0419b190b58302053f37a08dcc5ed4cd16ad527eb5e
SHA512f9e3b0d6b2cdbe2859ac197dbb39072901a7cb92bc95df6d3d16daf5db4275a976de54c37df77f5e069474a8fb39d37baf80f255a1077b8022c12df917e81b62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5003a905266ac81fb2ec59c164648f6c2
SHA115680211ac20442940fec470abd0413ce91452ca
SHA256b618ac7ffa222740ef4445478cc4e38d0299bd8938ce39885a99ad0ee9928234
SHA512ad5e5fcb2e411272c48b586f97b8fc2a323df4994b40b422375d0e209acb9816a1eb43abd0550353536d6710abe26fa76d61b58a7a4df4856356ec7fb735d603
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a