Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
1065f18eeb2aaa1a05d478aeadb8e1a6_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1065f18eeb2aaa1a05d478aeadb8e1a6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
1065f18eeb2aaa1a05d478aeadb8e1a6_JaffaCakes118.html
-
Size
786B
-
MD5
1065f18eeb2aaa1a05d478aeadb8e1a6
-
SHA1
609bd95734de0eafc00eacdd8599a317fcdf8c46
-
SHA256
20d6fce1b23436c6d266bb4ed6991f5d5011cb0cbd89a38c61b578b3fe6fbb7b
-
SHA512
b6eb18604802f6475215cdc9ca82a40548504f64a2bc832159690d95715ddc133404defcb14acac564f923f8811e9ae9a722b033fee3c1a214a09d2b71e1fd40
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000001b4c65e65876af70997978fce04c1aeec2a13c8f3de31f0ca057be3f2c2b2b59000000000e8000000002000020000000b03ea23ef862e23cf909ab026f85c4eed5b3cc69fa07bc2cc6fede44f4ef2e2820000000c905f3ef3a1f69b21f69b537931a568f9b58fc772b33561e269aa0970fca648e4000000031c531ca0d4845c6ac926f8603b3e606c4571e0799db9787d716c8858da295315fc37f322365cdbe92ccd09c6bd92cd9537cb1647586b6021ae6610a3b948a95 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420897279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ab73674c9dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b50a2c0188baf7bb71fc6d8ddbb327dc62d5d1bab6940c8a12f03c393bd5ecbf000000000e80000000020000200000006ed2aa828453c40218419bee5b5808f1c7553dc3383f6a1641d1534e228980c290000000030e8ef9b4a067945996364a70d4fb5c708af9a4931b94e8c5b6da72ca3971d67a633616ce72ac51289bf73a3fcce86fa06c6bb1de72913acfb249d55f94548ab1fcd2cb7adaeac13684cdfda05412286030bd3c76405391a53d0f3f72b93112120f6f93212882f030d71e883ae8bdeb08d27cb35b2ad00f1959fbac893bed89001ee2958429c2f5bc7a6620c700a98040000000118341e41478b3cacd7245e598d05399203c1dc48fa0d67a49f3f68f277523f4455d3884ad7feb067e6c7a25c526032a277fa8b911e218ebf0e5abc35016ce3c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92D02981-093F-11EF-8CD1-FA3492730900} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2192 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2192 iexplore.exe 2192 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 1680 2192 iexplore.exe 28 PID 2192 wrote to memory of 1680 2192 iexplore.exe 28 PID 2192 wrote to memory of 1680 2192 iexplore.exe 28 PID 2192 wrote to memory of 1680 2192 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1065f18eeb2aaa1a05d478aeadb8e1a6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3a089ad03a20921fc8f005b48c1f0be
SHA1b8c5a6ab66afe6bfafd40e030f17492fde5883b9
SHA2566bd8bb0c90a084ec036ce3affe87578689f5c59299c1d9886c12cf0f005b3c70
SHA512175e505b5190628664303fccb81d111fdffcfdc8770ca53f67e5ca06c82a938a7759af6e8353fe72efd41ff9391e8a00cae941d4c36aa1db5c0b0cd8c2402c7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b90f6f4dd0f2ea20c4d834fb061bd4cb
SHA1c808587d5572fe429eb0bfa336466fb319750378
SHA256ae7d34e5f6712871ee3bf35346a1003215890acae265d804ebfa0396f2143694
SHA5120d4b0f95eb6b85b89f03d911dc7af1022e8f4ea70d48e9ce87241e22656765604df3855192d530dc955de6ad18809727e3bbb38cb722ab5a6b5258d6761a5d62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5022908bce8662ceddee19ec9a545cd04
SHA11d0000d625fea1d74def1d7a58a41d57aeb637c8
SHA256b30de6955c680772e2843c007dbe4b5854022c4cb7f6b8da46203643c0972638
SHA51213eba39c74876986e0c99e21cff2b4a51737be8fa89fb0af882fa39b78ae1f5372491906d82cd6eb08296ca4e70a825ec6525a4d68a6692621e7ccb40f2f3380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f08d1d534f488e7343d82a31e83a6a89
SHA188ceb06746637266d2b34250a6e0c4ee81d16d33
SHA25647e603a42bef805e33dbcd34246ec6811cfff38f9b75cf951a4fa9b44b508ce7
SHA5123f84dc5957e512347dfdfcfdc07fb2f32cc0fe44d3649c8a5035340a28a6217594c5011c728e7033a6a8778106c787a482ae9c965edcd5b0ba2e3f7ccb26bdf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522cd0cf10158445b52496c2f3226fec8
SHA13230cfb70759fd2f3d74e69b2a914300f65d080e
SHA256833b8b962eae91ecd122868e5cee8681033501d9e39d639e51edbcb06f285920
SHA51289b0653d818082c00cb74887910cbbe76e77e5f4b631d2a97a1b3a0771c934da1fc7ba577f9c6d56680cc995cd7911db6089718cec6189bb8bb1e57302f0925f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f163d19fcf17f63d3c94829b6da83a41
SHA1898cd5ef0bc2728f6f9483f6d57697effca6c6ab
SHA2565905e36e565cb8620fc33e488ce0ca244c187af7a29e88b6525b69b49459b073
SHA512816d040458dc3072120588056b9a53835b63f13474477d7877157b0ed7648205ccc8febe65aa0619dbe8abac261317a67508ebd52a9cbc21a3d34889197debd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5add2b4ef8bdace25eb27be1f72000dab
SHA19fedd47e597d835bf4379db90ba7daebd19a64ae
SHA256956541d0b9b4b622ddeeec676e979da4937664fb3c1b0668394bd25a1c56dbc3
SHA512fa01fa97b17d540cdf6534d666319d94330c4ffae9753827c9ef2263c04458bab5756d5f19834a7b9533af5fd3091672d59e9dddcfa2aae71178892756930b85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556ed5af548777ba7521151a214add5c5
SHA18a475fa8ed2304d70f1ceb627dd970944648ce48
SHA256a38572a7da2d265d99999e153a4ba73a250a6adf107bfe9a2fb1fcc04d7ae918
SHA512fcdc844edf304b6924bc0791373077a7769c3dcb8d840c0bfeef53b3ff890cfb4abde82f9d66caf73e3560472a88cd0bfbf0a9013c917ed371813491d3a3ddff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58242c92ea86fec7280506311dda9497e
SHA1e6f48210bf32b7fc35febaacf4803930754abcdc
SHA256acc371566344479887e064685d3ff2d40f59052a2f3ff9c881b7ff6b1ad09685
SHA512098ca8d87fcfd461540722681893b5d731e2518446e4406668139c04613178f7b21fd3e1859a7d137a488096911231740a8d43c665a322d0a2c3f6ac429217d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b63f7e0528e3c00b85099c9d9459655
SHA1d2bd0bdc35b1c1f37fb335b13a9753126d3d539b
SHA256ec99aa11e2fa8dd01d21e469d506a9ac34ede154a11e7a8ec068396efdb4022d
SHA512753bd5c94fc7de30addffb74b92631d446cb216358620342e634ff4cf80686acaa922a0c5bb2ed8dba0fd433ed380c87c6cf5027fd720c017aab76c126d5b589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1a65d5411e051baa9915bd2a6da5746
SHA121f51761220048f85d761aaa12c1d4819ebc2653
SHA2565cdde38f0765c437ca1e5aba42a315e91f81f463a05977701ad18fd42c1679d2
SHA5129a6577ba35e8857653f5aa21a5013f3cf21db7cfa95a43e52b8d7e92a856c0d0745cb9ed212088995f0100ed06043e105edf37668fc6f759b9a94b29810eb440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c24a051a7188e34cf123666d4af1285
SHA168cd1f59a65f7748759cd9d15e990921d6a7640e
SHA256b1187a1cb74b3c4722d7f6a959a3d26d63a8ad6ebec42861c17c1181104fd852
SHA5125525c57a928b8e458f666fa283c5b572ab2758c2358bfadf0216df01305d0ee1848cae09f4bb7b90022038f2dd121a4508f590aecc1bcc45e769d1fc4af05eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2bd889baa6eab0c3988b757130106ca
SHA11db32e9a91ccc233974725eff6f3e7086967a673
SHA256ab5c7b21973c1e26aa3d7123f77db840d81cce87d8628046ba5bb7438e5b5c53
SHA51214fd89e9e2f3042f99397bf3796669a0607c0cf9b4ab2ae4645c23485449269bedbc33103a88ba4cffd4f5146ddf7641aec31c2c4b7e50e325f10ae12ab7a001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8265438b7c50d5212b7916548c08f64
SHA1c4a476909784131f58723b0378dcca679ea23438
SHA25681bbf95a9b24333bfa8c42f49c7ba1e52b5840ae0d17cdcd06b4f1256cd7260e
SHA512e89a75e0d0c91e3996c5310c4b34bca1b284bfb81f301814b8f57d192baa7d3d934775e126834a3c0ede74828145a2e91880e4faa059f4e0e99b061f75ea08f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543f266d749d4e891b4091c9101818bbf
SHA1a15cb5be450ba8635713107502786c9771dc3454
SHA2569b3e8ab69e2e54e72b9abb902205de66d26d4d8a5e6847e4ed40fba70c0afaa5
SHA5120471a9b9d8a021d3a62bdefef38a5d916eed21a90e64479cc5e62f0353ad08fada7e4d954df6e7d6eccdfe48b9ea4631114e65689e199b4a79d6bff514b686b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541514be36076b14c1b42ae49e881b53e
SHA1e3c82cdd45eb421894ffcb4d5a5da9d43011f85f
SHA256cfac8b4f601e193b1cfa0294fc2dab61068a75954558dbdfeccf192f1d763ff0
SHA512932e743c0f17eac8894ef164902e26e8c02f2c6b7590e97067a2c737c50812726ce08b4769f2946b982e317a109c071d9dabce385c72141ab1a5dc58f7aa8b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5507cfe11add8eb9de97471f3ab7634a7
SHA112087955ea666e804058f0e1737495dd86baa1eb
SHA25618c574c7d7be263d8a07f23001ae984de949eb1d961ec974c84600d5965deb4f
SHA5129bd4bf4c0c42cde99de440b2c2666a0671cbb547103c2b0da54f6913439ebdef9fc5f7c733f31bd18ca59b0afcf5b6abc3e923758d978c56948b2d6785c7285e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a8e3e80489b68ed65f70ba419105239
SHA1c54d8b5a6af3a4ffd4a549a6847d2573e3273e8b
SHA256bcda533ba2eac7ce587b576d7a13a6ffba13aaed2f6260a05a2f98f59b8a8408
SHA5123b4dcb366e2fe8b3dff30fd8e282887f05155563ed2d63eecf20e192bcca08403603c8121e57cfbacdda2769ab5f3cedf967060968b1c3d8a6d0a2a03788a89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4176d7a9a5a6e194c0e9bfd05188f69
SHA129e128f46313ef2ff295bdeeed2e34dd612e2409
SHA2565e6f762d5b193a669c93710f093c7e8f715c5668a7340babdf6cc6fc99756250
SHA512d7f9d7dfb7f48ec6f02c709ddfff6961cb3d646eb33d5ff5c282541e835e31694748ea8ddd42476172fb053af71f80b3b1b8938d098887c3266997247d91c13e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a