Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
-
Size
213KB
-
MD5
1184460dab9c98390d2206fe8a075861
-
SHA1
8a29e36b8bac3c9a0ad44af8fde9ec304d0b26b0
-
SHA256
87e1bedf9a140402a802ee7ae1bf6bd8c30b73f50f57ca74e167d5eca1943431
-
SHA512
3499d7a30d65142ea6b237d2892125dbb42a47b09d8914aac05920f154a58060e14297806fd5a7c1c753821371ad0780519373ed093341abbb8104dccc4aae97
-
SSDEEP
3072:SHqBZkfe7IF0VutyfkMY+BES09JXAnyrZalI+YQ:SHoE4sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59075111-09D0-11EF-A0EE-F2EF6E19F123} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420959460" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1568 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1568 iexplore.exe 1568 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1568 wrote to memory of 2976 1568 iexplore.exe 28 PID 1568 wrote to memory of 2976 1568 iexplore.exe 28 PID 1568 wrote to memory of 2976 1568 iexplore.exe 28 PID 1568 wrote to memory of 2976 1568 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1184460dab9c98390d2206fe8a075861_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b152a4a98ee4c5edca9187a6ce58532
SHA1cd976ed39c1ec5de8a0dcc71f3d067a1b78a9990
SHA25625fa8bb36499b7ee6538faafdb1ac6bb0f4719cc26698e3369f36a5724c6d740
SHA512f2cafb7f4128597fe8ddf9afe9c4937569140a4de430c80c7658e41f58e6944287e69c3e1fc4ce50d7be20033100806400095f57eef8b474b6aacfc8c8963be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510356941911602e6411ee2ec8c828f77
SHA117da582f9514ca4b795f6c76626db4c71059f428
SHA256f6d172ae0c44e18ef1c5496c02152c167450afa9e6a2c5e9c3fe521da6ace854
SHA5125feaac67fa5868c8bc7c5480c1d5a8464e96291caa660d656b25e33d597c128f6a49f89a8ec7f2bd54d5acb66957451d7000c05e2bb69851a692fcb35d130cca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dd79da90b957210c1a5a73228004072
SHA122f69ecc7c36dfe6398ee020660cb2427c3f8167
SHA256f4a33155e27add2d56d5a89d3377eeb403afe98dec6ebf7f99bbd4b8fa7b68ee
SHA5120cc362f49cc765cdf054985f135731702e7b47a24ed161f8737a8abf1b4ba69bb8b640bf93d1be967a1b661799d7474f9a1e653f3588194a350e6294f20a21a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b762d7b1c8954b71da4e7bfc3e8b273
SHA136152d65d237dc9637707b530a00f5473d839eb2
SHA256551280d5d0099c6be2cddf3ea4ff774558ce7974aef22dda82acb61976e498d3
SHA51244131d4c7f1fe49ab7ee02a98c94cb3f086d8c5b63a1b46406225184fda17587656be95444723b2a1eac6f4a23637fef3863d2ff88c53b98b66a514519ac147a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a61c30fadcbb3394fbe25608e126367b
SHA1f52a9dd5be371b01c0a21d822288253adadc93a8
SHA256769a2de8c8a37e1ec16deef5bb5fb8547a7baa88bcf7dc3f15c1d17b07fba226
SHA51240215512de79891091d0cb2db51c301f58aae6056b81794ffc9bfd2a75bbc8f3fb43213abba2b14f8ede69058f4be1776654eb387faf1f1aa7bc5d8837a51844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d672cb0a0492b6c22d5ac5a69f162d4
SHA170413104249e8a576924c2117627724750c51b91
SHA256dddb68a1ad36ac0e3bff39d812dbb1755e3599ae1938c569de964dbbb8a7ca9d
SHA5128893fefe22d317a19c6f4d5ab7a3072e38720f5ccf3f6b5a8222512ad1cec41470c5aeeea1b4ea02f0d847bd73174ebead8a3f2a4b987332496021501606c42e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d31c2705cb6e8153f9bb12a0a4a2ebb
SHA1d6ee39288263bc40416063d7ab818ceef5cf97f7
SHA2569a12c61b4de99886af8bd351adef84bfe462a54ad6a0b17c642540af5396d39b
SHA51275d53c05c9cd86ff80823e373290bd359468093db17e3e97295dd73960c8a0603812b3256251e51d29a0e63a0adc7d311d0fd0de90ae65eb83c05e19945b430b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba79ef2d0df7923c07c5da216d3491d2
SHA149cafc9d2c8c570c22382984641f195e2ecb477c
SHA25658928f4d20dc2fb5a4ea14c15b3296260647cff06b9d7186a178fc76ffe2cc60
SHA5120d2e5484d7fe60604f117a413bcdae272ea05a1b619e52d451ffeb404eb870d4a7a84bb918599cc712832b3cb78875bc870790b9dfd03483b0e50de83ac47f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1f975468c7ac72358da07bf7c89abc5
SHA1f02724ab8dc00458481007a575aaf9c1ba20b1b1
SHA25651c3accbccbb12f340bbbfb01d5aebc0b99576790c6f1d0fc3dd9424b645ab2f
SHA5128bf28ee7bcb52d229efdf0b255dd8a71a28f8d813fa559d7ef5025f5d400f22bffd72e71d01fbfa13e362016b726b9cb493721fa51d35e2f05c73d6d35467a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad46835e7bfa5f492e0aa60ba49cf4d
SHA14b22090b50c0b37bc553f2389708f7e42195ef41
SHA256657f4b9c0afc57b8f5a809035f0b9d37c9cab18fcd67d63509ad1d5e575356fa
SHA5126cd7d37752b1955ac36fa204d071bfb9e7f89d9479743a492175917e88c4a67ce27135fa3055d5f9102be42f8a2d723d3313055e6786761d216fb387bf83cd46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57db5e09390d440c1c9adaa037f8c36b2
SHA1bcd20e16d74926ee5b7b466ed6dd98a552be0e52
SHA256b28c5308eb8c545e5e11e090cecdfa0c529390cf10dff60b1e4a88b07aa9f6a5
SHA51286fb68f90547b7d5948e3acfa0ab4584aa96d7f9a985b75a1d7a54f5e5e675109ec9bdf1ba81e03f81e8446ab5d295ff6dc63bb2afcf404c97e7266511f38562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576905467692bd691e3c1d56538f9d362
SHA1d7780d7d8972533edd845218fccb26e7c4533f8f
SHA256b84a04a55e2f6ff9ad3072eb9218934b4f9396f34cbb6ff70aeef93ef5e5269b
SHA5120e2d84e6fb961c63f9c5f7915040461b81fd1eb189c36c03b945f11d3215f5e758cec0d12bd86d15ccdd7cbe6b2aeb9ab63c16c0c3ca35978cc4dce90a17ab0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51857f139d1acba435154de1e9f60c874
SHA1e604e841a0c6e8862bc2bfb2f8eb16931d6d95dd
SHA2565f8d3093d555635ef2564b6c72fdeb24bb7dfbfed3b9d35a5b207fe92924feda
SHA512a6081b886c10b3f0eb93f3f75dbd61d72df74f97725a07a702efa7050d34969890a81c6294389838f0d790bdb05efa494e6904f79340391449558695413cd8b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52403b281d0e56b0ac56d5127a403bc6a
SHA1d48a0f66e5b152c72592711f7f6a97be583803da
SHA25615a753912ef17e00ebca7a8a8bdbdc2cbf3d4bec6350ff6705e955ebf5b04255
SHA5123afa70bf893c025206d3eb6096b2466ce70e6ac44d7de637c2e407f1a2e67e6619eeddbb1ca9c9b2cbd75d0d583f804d35fe6617e16f82d74ac829f248810bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ba557912ea003312ce787bf613fd145
SHA1b0fd2a381719bd834fe5dd729646cf0bf3b82fdb
SHA256c1105c83a66227766a4521fc766fa14c328100fc57f805ebb69aa39508573a1a
SHA512c9c16aa5800985b6884e7569c238edb47e81271edc0ad28a2f016a43b15c85939ac2d65d54c77cdd29cdebd3eea31b9a1775f1b1c54cb212961aea6bac8412e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577b74b95f648cb3ba2dd4d4aba23c432
SHA18781efa796700043a30a28e6d9d120c37196b887
SHA256af6b6925ef5ecd690eb8a8c481bb876ca65b4306c14c60e09bd5920fab4c056e
SHA512a4c59400d2f978534eda98002e588e71301f86e670353b7406aa438002eaf9bb49be37e2fd594f32a75e726bf95849a231932c1f88380431b3f1abfacb32d47a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb1f0c3c5f124c423656a16bd03c7fbf
SHA15b134c587d0a49597706d5e42cc736c4fd9a6383
SHA2568cb79c5060ac1880e1feed17eb26b02211aa5349b1bf85b1da52c21cd92ab5e9
SHA5122b89a3f1cb99e2d54dc04395aad77033b0ea3466b33fa2930ea25c355bc553f9b061b56d9c7e74609d4d9339ec7342341cdc9499637306054aea684382e5b578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4fcf0cb2251f02c06d183850fc9c794
SHA13728502b138b4b3d7f5fb73664865fb2db411478
SHA256de30ab6caee8a2bb568c124f830706be9386f338a966eadb0a1034ee5e35fdcd
SHA512660e36dc4b249924ecd0e259e82be426cbea55e7158aa9d350a000903c1a6451e1c2feefbb25653edeb77948dd51acdd2fb5f9f2db81f6393984aa0aaa8cf0a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545970a89a15614e0e0350d134f12a7ca
SHA1388d4cb37088f5cdb91e742eb64e880fe8a4f461
SHA256a89bf418a05317d7eb54c542e3f02c01048e4cca707cf4607a6f557f88948453
SHA5126c30ca8055aaa23d45cbe74c6ee226aa3509befef611c215e48ae3a794b7602a45c9bb6101c5dcfd0adbe7e2e0e0f19df5b448f0854896ba56b646e2021b853f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a