Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html
-
Size
17KB
-
MD5
11510fc7513c59ffe19aa653fe8acb61
-
SHA1
8834a0622a0cdce5e23aca7655d596911c48dc06
-
SHA256
5b67ef34993978ae79820e1217ce51805f225c434de8e9a4c34028ae1ec31b67
-
SHA512
f5b0c2f7b87267900dd07e9441a4b5e74dcb44a044498bbc6bc6d6c5806dd1752e0b25864d12788179272f3d7361e01aa8b8785b74f9f527e7fcdde66ce8b8fd
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI844zUnjBhUO82qDB8:SIMd0I5nvH9svU9xDB8
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA0553E1-09C2-11EF-BE0C-E2E647A5CFB6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420953583" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f4129ccf9dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000077a3ef6176d863616c12e2e15c48fefbfbbb3d3e07509fcfb99e1a1100b1a03f000000000e8000000002000020000000894954e17c015ea2d9269646dd68c69e3bb4a3e50b1b86db15bfb0af813ca51f20000000f7781c9768c3e7fc68a04f02b3a2bd6fec569f6dc7d1a4fc4e0734c79ef2b2a140000000cb0c3e920b0ea321d54457feb5259c1ed9d00ae4f395bebe75245a5a6651945040a83fa15f44d4bcecc8c49a0735bbc69b81b037a83884b95e70fa409ad4ae71 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ab8f15316e84c2ffb577d199355e67ac82c2bed6003bf353b776808d189ff944000000000e800000000200002000000091be7ff9662a7fc650599c3f25f5ef3706b4b69d127f9a9398f3399b8e28241990000000358a5d721643ab7df85c3593acd1670866b340552ad757cc912c129511306c9290f95d7ec94c150b98df4413c266ee62ea29311a617083689c9b941641409a9e2715814271553ccf6401f8cd1c4a3926740227f3faa39c76dd6c06dcf6c4be4690f3ac46f4f75f423941057baac9b8801ab25a8cee36cf18e2cd9fc723e96e2c22cd35bacd53bfce80e239dd298db74c400000007fbf24cabd5d318905ee8575fd37cfe92f52d1e0a8de9892373bfcaa483e84bf8244605c1e436cf35db0afddc4d065c95a11b4d8a314b241a00af4d45d2efcb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2564 2932 iexplore.exe 28 PID 2932 wrote to memory of 2564 2932 iexplore.exe 28 PID 2932 wrote to memory of 2564 2932 iexplore.exe 28 PID 2932 wrote to memory of 2564 2932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5493f728407d16aa9f8d8a8b4acf10877
SHA187b00f6d68ce109ae46c44c0f6f563801d22f3f1
SHA256846d3c37a2996bdd53a5f37f6bee8222baf44a9dc45aef4db385ef855d57db6a
SHA5127c0c67effae2375b0a19c1db7da55a3e915e43bc1fc7fb721cc95b354f1ee7acd3677f906d0e871573e391e90dee1407c129f3cb30606478ed3f5e18e299f37d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5219ae3bcc471341b5a257a6602d2e052
SHA1db1db3847820ba24e387787cae12396a96c56c0a
SHA256e61d1a7f68698f1b8249d6b54d34dd93dd7c8006af7f3ee44a02ddfe3ffc9e05
SHA51233a8c2652ced3b7cc5406aa4f5d62dd34f2889d7594ef205bb3ad63dcf2d80b81378af8ac203200d0e8410d3f83f0d76232ead9f55b01e7a8b9ac46daf25c722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554370fc16a611f80fde7c4c059b5fcf8
SHA17e1fe6b6bd9cc9532aebb2bb0e277b442a569f8b
SHA25667071919f8b03b8b58b16c6fc08a9a40957ae539844fdb7cbf469679849c49d8
SHA51206d38fe91088f715e462f2a856baabc43b3eb7fc58194dfb302edb47b78ebaaa5f790ce5fb902ca8901486cf4059fb413623ad4efea0cc3234bc8e262d40ae0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519d6862447beaf436f8ac38b4dc915b7
SHA134069b20c16c9f9e4a46859c37fce27f3d6be989
SHA256688014475438493375c2309f00721c80e39b469e594268fe27f552f5c748f364
SHA5128a454ba70366ba13074516c4203bdd155e767b3ff2a3b772b59d7e5c577ca7727de4d17c2c1854d8b46255550deea9306f5ef049876ec8dcab6cc57e06e8de66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1ac823b0725b6381ebde614683a9375
SHA1223449eb599663a12032696697089ba0cdf4687e
SHA256bb6dae866f4b248c454b4275302c2edf477bf16566047c45cf2cec392caf44f7
SHA512970e51b838e7c117b662c263fc25603d60f1608fd11f00c9957ce0c121818dace279b6e074ae4ef6dcd3b49c016cea19736667b1c8970d467c36bda84da8e516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1faa1a0033a5a8522108b1d5b6c5d39
SHA1d69bf67d8615ee0d0b39527a44445a2b5bc18a89
SHA25674e314a2cd656608c8ccf4f65578f437676cebcd18e362538464231fd6fdf7f1
SHA512e479c8cb4f6cb33ab8fa1efc29e11ed1aa440b3c229ec9b7e2d9449ee317d9c1332fdc7bf084ed0bc55431311ea39969c6cd66a4c46bd90666c8710c807d1fe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5076bf5b68e64d422518a787746ffd09b
SHA12946c8d5c8fd95ee510a6826f2b6b73f5b67d621
SHA256433a10b9a7cb7d3c491bb9535dd748390b7efc0e4c2970f7b583dd3ff8a11e9d
SHA51213433c450e4b6a0f2dd30763282eee3776d22b79b9c110382153dbaeafee67639284038132e4ef132e7b838c29472e9c85ab0b30ea1fe9a2cba7eee7dcb71653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c6155c401a1ff5c4e801a4c2edf0d36
SHA1d2f184fb56ae342f5952e5d614872ef92caf624e
SHA256cc1358989be6160c4d602a874a6a463658ed123ccbd0adac6e09bcdeda64f109
SHA5124f8bd5a3e89a5ae04bf00816c88f63974cf583b3bb60040817fbf84d1f69b1b0bc0a9827c1383d0ced200c15d30248ac00c3b45655fae2935a624af0cc625795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cce65f6a99981358e2b0f90d3d9df8b6
SHA12d11b6a0fec2ce3599ef81ab1e7c9e59207df4f6
SHA256e7b7e6a677e81a4a12969467d30d3984ef19ae67a00cd7d2bd1fc985967d9b0f
SHA512e44f60334c5e9795951c1502e6fdd441e9ba4eecb3cae6a31d354e4ffb551825069adcc485242266e67fc54e28cdb191af2d964bfc60744f88b5887d2f075a24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a51234a178a04c3690bff9742b566635
SHA1706e1e28bbf5b2077eb5e2247affa77a15abfede
SHA2569654d2b3cef4ef6c7b1183b0a61b02e45f25a99393e46e61e2a80f50813d5282
SHA512a6618007a7daa9efeb5855357e459bf532735b3fce844bff1c05592059aebc06f051803082eb55ecdacdd259b4c6386db43ce5027d3b6ae49df366cbddf23daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d84f128cabed96ead55301ff60c8366
SHA1f7b142a5a93a67ec5e9d4d4519d0131c51c8e333
SHA2565bece2d7d979bdc455dd436b4b4253fef05752717e6f7679c81f9223c1dc104b
SHA512bbee8b4e5f36b576a225279cf2de97f4ec0e567b1011bfb82a611883ea8af8cf83c187f68fb295e52afaa10fbec173763139d3dc4e335e6524edfbf4eecff22e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520fb10e9676cb858d9651a7b48b454ce
SHA1a15ac66ceb582a5356cd54a637c749a176ea55e5
SHA256f126e1b437dd2770c62781ebf17043de5048fe0ec07df36e88157313a2e7b77f
SHA5124519f04a1791bcc895cc74c9cf909ea2997400e2536dcfbe60b7f784454196eff796d6cb167b41df0e439ddd2930edded90d77eba5e4e263cd4b319b50707330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e99e1cb85770cf051f2f964210f6bba
SHA1f7c11097080830bdabd933627c2635c176cdceff
SHA256ee0c95274ecf3d6b8731266ead7abb5ab3bc336641b8cda1d625c6ea734b1d0a
SHA51233827010f6e5ad538aa7d4835c138f3d96468d8b122451cde1130ed89b155966071ce6b6f94724b8fe4583f5430ad8150ce4085b31aa3440bec0c25d8322296d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5728c577f950393b3aa1b09b7bffad294
SHA1337851bf8f4a4ca8cb8f8ca11bb49b852389c4a3
SHA256787d2ed6449e3c0949b469cddb4aca22d585a9be204f5ae16d556d765c7179ff
SHA512a4a8d3d9d3212e26fe4558d17bc88fd07db4fc9cfa6cabd33169f2dc0139d7e4dba4dca1e449719b8e68fad9bae740c21480db4986bb12ac52f21814f1e1e17a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c27e2aabc242efc0ff183afeb1989611
SHA12b0e56d3479cbacbcf34292da02918baf0e378ab
SHA256a043aa35844f1471ea0d6dac62df041a3f7443e5a4a508cd832f6b177a6edb53
SHA512413cd9dc9b6a6c5eaa25b343c73910c09537f64a775679c7f74b3a244848d013614a82c864cc1dc0d9de44ac57d304454127f91dde74096faca29dc87e65876b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5717d62f85bb23f7f17f691cbfd6d1d3f
SHA1dc433dc9ff803e6964a8723c59d322f6e7e3e7cf
SHA2564dad96954c5edd6153da76ddda9f38ca3b81c14397583f3c328a9f766fb11c63
SHA51259f57d6f921d57ddf21d82429c77b44dff5619d10727d2400bb050c7b44a3347fa8916cdf3667174e829e661019ade5a6a61e9e6164e298b2c8629150bb4163a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5954b8bc734f127e05cf9c0ef4ffd1a2f
SHA1c3eaec996a72ea2c0ac210e840a5c86baaf6043f
SHA256b9f50887c624c47c6dbeb1d84882467ed61acf9c783103462e1629a58d1a745c
SHA512d964796cacdd404b6e5525772ba5631b66426cbebfc9555885f060698dcc3fde453aec8d4d33d664687afa58f28a3422bef66abdac5f2119f4f16a43ed1f5ad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4810188092f427db2e58a6ef2d416c5
SHA1385c8e70b11507a9434247464c9f63565179d1cc
SHA256dae274c47fc399c6f3e05bf910180d38330974922d0cfc1024b8c8c8915a28f2
SHA512d9d23a5c81ddc719ab627944f06f68e52e7dd7c881f0090424794f2c12ae45108fb8aed50f3ee787a3fad9bd1b7279dc388263922a8b88d6255a85f46fdfbf73
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a