Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
11f7a6f257bc15782a2a539e32def777_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
11f7a6f257bc15782a2a539e32def777_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
11f7a6f257bc15782a2a539e32def777_JaffaCakes118.html
-
Size
460KB
-
MD5
11f7a6f257bc15782a2a539e32def777
-
SHA1
62bc1497147cd755e68e219df567e7570643f531
-
SHA256
77556cb67f0cd64369cbbdda823564420de00fec5e77034d3af3d81c2e3ff128
-
SHA512
8e12c52e83f73c0a76fa95822c39721a2803aa3eba7ccb0c127794351cd7a560d1e77117910b4cd1ad33b4bb962ead360715ace7fcc58700da5b3b45409b953e
-
SSDEEP
6144:S8sMYod+X3oI+YpsMYod+X3oI+YPsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3n5d+X3t5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420974494" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b552736dd02a089365ea71301f995a045495fb7c54788c8a10567358a40a2cdb000000000e8000000002000020000000ad3473ccf40fef36324aca801d36eabcac70d7f63855c679538542f20625827f2000000050b7e51c3ef987189db6fe07d085b1761939de4e3f66d578f860f641d005bdce400000007168cf1a5300068cf458a23488ae4fa4443e176a58a2ef5d5ab267c010ba341cfe470ab1609e53ee66d31c49e91e2ac6db5ea0e4766d5968887d3f2d520771dd iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{595E9381-09F3-11EF-9B89-EA263619F6CB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d9e231009eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000dae2262c4053597979de62f8b5ac0f02ebd8feb56d095df8ad38c31175a0e5b5000000000e8000000002000020000000037c1a07e9cfe5ac98b9a8faf779ec638bbac0d8b5a120979701431293e23e8a900000002dfff7d45b5066918bb42c510a706cfd5be63e4a0a771679672cfb8ea47098359ae737ecde6815b73b71103576770ce4abb7613ffd583887aa47cef0009e1894ef63667b795e51260df6e6f007c6b528865e484c7d811865cadf888bb70021d4680569c5735aac249a31e15df3b289b72f983373807ae1403690a558e6fe6de0bd3d7f8b74585bc80c0565c72cb1cc64400000004e9fcec72a6638a91c083bca1b1614e983caeeaab6e3948308f81b768270b73aabbbe61f1ea5368dc946f0f713c822506558b92b8bd6c6dc4e33db0abb6bf132 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2740 2868 iexplore.exe 28 PID 2868 wrote to memory of 2740 2868 iexplore.exe 28 PID 2868 wrote to memory of 2740 2868 iexplore.exe 28 PID 2868 wrote to memory of 2740 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11f7a6f257bc15782a2a539e32def777_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599af9cc581693e49584f2560e807f17b
SHA1dcb14395063879e37635dcd65e633332852833a6
SHA25660345ff38522a8d2f9df08b92f8524ac7f966bc5928167c517f42ef751fd6087
SHA5125b52fd955b0acdfafea0010369fdfb763317e6af883dae8c48304e4869498e7b637a4c07ca3e6e9260914d02cebbc8dd85e113b2c788717282b9ab13b819c1c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5357af069e93c7c0ef7867cfbd4213749
SHA16e5b5d37ac31365b3a851abd731686ff28e2ce9c
SHA2564a97d29062f9ced4fd0aec33219bb838bf752b0b5d69101f889c02a88366458b
SHA5127cbb2c47cdf12caa2a3b2fbe485dd199c2b44d414b82ae4d4afa7333e67faab9b2e659f193004e9b3964941f9e10d91116bb45ff0fbb0bf0a1af04b903e6b30f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab9c2b4fe0139459204cef561d228b4d
SHA17cc24cbef38209261dc574f5077e6d192131495e
SHA256968db91aac2cece084c06672017d866aa7e15a0de05e7b1b7a4ad2fdfc5c1073
SHA512f1d60665c0558a5db65b4885a0da9ba14301ad80244aff63ac8fc64c527df8b62dc4448ae971db6ecd4123c8cfce3baa8e945958f542fe91e4c1ab69436b6795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52779a72a9d1777c773c34b75df8a5f25
SHA1d1e1dd65294ad66bf48b5f91a474d0c74534329b
SHA256750bf453a50e9740d23082f862200abdae8e46fa82101014857faedf70d9a5f1
SHA5125a9d72306888fcf0a72872077fca127d0035a6300022661edb439b47e64bdcc9cfdf7cc2fb523ca01efb335b18f03ed077a03bff011728f3effea891d3f56d29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ac15e582c86cb868abf21462200bff4
SHA18eae0aab79ec70182cfe7223dc054c9c05249267
SHA2565c69372cb18bc476e8ab312303e8a6151310832260a07fb3af30da988616af61
SHA512fbfb88831258c28214239a6c084419a8f8a06240102c224752a9c84fee22027a4ad0a558a7e03bc2edcc3513623a4f82567a641819a90b1a9aabf98dc97bcbcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b811ee4acfca6075afd478a87fa8ea0
SHA16f886b78974fcc36254c6f019987d7f8f23308ea
SHA2565e4c3ee1ba2f00374cea2d7230dc617cfa01167564a27ae3ed081ecff8eeef64
SHA51205992609e798ddfd66ba5bdecce77f6ee984de769479c97b310a5df4963af0a0b1fb236f107e2946a2244e017e561a45d1b27a019a997a93d98c6029b597d331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab529123fea70e4af3c21216738a111e
SHA1e489354e6115d6419188340262fbb4e9e6bcb67d
SHA256b2bc5b5e6b772560756de3c18c8ef206b061ba7cb5b39361f67d11898acf568e
SHA51208fb9c9dab5cf0da00a2cf280ab59fcad71cc93619843d44b96b4decad7556d0b1dd2927aa33733cd0e79fc33c334c370838cadf6ecfe27d0847ad2f3c3583a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514181d968e8725e43d79245a3d99d172
SHA1ccc801d26179c4f19ae70837d75cfd77fb3123d6
SHA256f9d9b2f1e4d62d4cf97f1d0f17e87a825fedce577b838ae2983988c0bbe71545
SHA5123b209b01417d2a6a2721611708cb87ade4681f79315bd0f64d888a727c9653a151ae0bddc93622c43534ac2ed231200bd7b7114041a0a50b18883718d9a4e658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560a5ee4c209949e26de0f239eecae621
SHA14a3cb0d1062f7c141759a8f47d01601aef53d8cf
SHA256564764376104a4448ff1d40fe72e4c2e6c1d4b5d763dcfaf88c81e598cddde83
SHA51267e4c92ab99d31d6f3562dba74229a1b5ec9b716ca9fcb69a39a0214bf8e5c1ac8634233fb46d51c733dd7241435bce1e6df48c1a18ff9c227ab814ee412486b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57aca3b87464d08fa4fae31ae104e2ef1
SHA1f0bbb67b90f27e83e3c544b186abd7e517b76a06
SHA256e121e659edb471a429d2b26a4992824393b5c50839098976ec6f476cc1bdedbd
SHA5125bf2d17a041ba77c2bf99c578a16ceb0b262ddfe1d0c418ac6061b633c02e70bbdd1cb1d71846a66bbe816ac3ec293b5359709b131c4de6c9dfdcccf5714896e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5418e75bd19178f6fa4878972235bc710
SHA1f76c3d75e38e9cb3f30174da052138b6caa72a0e
SHA256312de41e8417daa6f7cef48863ea44c21b131614b2056b4c6650cc540f3852fb
SHA51280552ab5a7bd9f504961e167bdc7da085eca5b1f19e8e4292d48e48abd4b1c6fe1472dba9c0b73c5f66df5e625701821ee1a1f68daa3e479bceb0f57b49ac1b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3395161ed190775b80b97220e11b8cd
SHA114280cface88b87fd7dd07c537cdc69245686ffc
SHA2563c1a4db2df63bd9dba0fcbd1388a0d32cebe952f9935c21bf8a534cd1bc16f23
SHA512786f5cffac76ee3ede576aa71e5ba1168ff2ebfc9a96dc5f8afcbca1dda7cbdeca6f96da69e8ec7ad093b82e4188e50411f1d1aaa573d93167a4b5319ec015e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af121a3620266e63a32a8d343fce35c3
SHA1f6220d2aef1a5273d7a3ed3c2ea3a8fad8b671c0
SHA256c621fde5c94744a86e8466396edcfdfc56fe644b2e8fb45e6c17e61f652d2e15
SHA51281c5af178d3e9be060783ccee2f4c10bd6edcc99a2dedd26440864abe0ab88465391bcb167341a52b73f2932a56db222f266c1982f1c2a755fce647d7454b291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584915f8815bc000a63146756f2b1edf6
SHA1422f1e5b05b81619656e10e818f7ef5f28f016d6
SHA256cd79c3f0d3acf715c6d0b4c7422f140856ad8f16940043a8a646a996912e84d8
SHA512dfa4e3fdb5480b22f651bfd163649b6aa8434d1de384a2bbb3c704b6d53e04f907ba9e0a61debe6b0ab54a28c77bc3139672f99740266324d59c91a03664b08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d187014f2593dda78c19edb2b369f1af
SHA1f2d6ef122252875821122925f116df453ba7a861
SHA256e3235b70d2edee9d22fb773e4e3850e0f52fbd1f87964a6214443b1ff894805c
SHA512eb5e429f48cc1ad1d1ce65b7f78d5c647ad89ff14385a8977fc0579266f4068fa08cdc03947ebcb5cec22cc7470f538d15f8190a25a57b6eee631747df0744c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d4808fb61a34be91a219b3639a099a4
SHA1e7a78ee416ee18c97843b167155a5d7f16a807f4
SHA25628571c4e779ae1d950cf564a710dc6a8f8044935a1f192a79b0c37b47ea912c9
SHA51204fe0f10f1062a2e1f232296d1dc0029b0c5190fce30014aacc8348e23e6a222a9ce2b6c9fb4ee657913508ca33d2a654487fc0ee1088da7af68a217c8a3e423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cfe880abd25d0448f8768cc1cb2cb88
SHA1a01461b2fc940aa7a1813166a39ea9301dd5ee32
SHA256cafbf49a40e11a16191b2cbbcc2a7814965b9081e58e0187dbb4c5a47fe3f650
SHA51270319e8b78257895aa16eb4df551ae199a5bd891bd830097c6c0f1d35861127b95af7628518434ff475c9e2d11d2b6b29824383cc7aa2f24ace1e7eb6b929534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5324a66a0b4462baaccf04655cd3c264c
SHA1957d06383a5509ac19e980bde9776b2123863f20
SHA256e757aac63ffbbddb7bdcba81bb73108991d2a6731bf75be0a0835d7c2d6cda6e
SHA5125a53cc1359145f430fb4fe2022df3d63d171ef0b8c128d4cbbe9c392a4193e091e5a418b4eb38ed9c1a8378be1d1aabe9e53986c0f323fc9710a10f6a583e101
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a