Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
12251684a80ed2358f5fb83e9f5f1446_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12251684a80ed2358f5fb83e9f5f1446_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
12251684a80ed2358f5fb83e9f5f1446_JaffaCakes118.html
-
Size
68KB
-
MD5
12251684a80ed2358f5fb83e9f5f1446
-
SHA1
0ab5d6a8296fdf5e95cfed62fc499371d1627444
-
SHA256
b7268d8898eecb40d14a3738e919d2776c3bb05ec3177a97084e387b74db3521
-
SHA512
d1897e459089e6d998439a8ff565071eff8308a5e4bf7d49cf17b93ba4af2609fe562deb511d79f05a3d983d8eb6b726e4d447cbecc23f22178251b6fdc9a5eb
-
SSDEEP
768:Ji1BgcMiR3sI2PDDnX0g6UrykfzuXAoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JA6hhfzuXdTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000a71069195e50b791a0fa18685994600ee81b33a18c1cd25d6eaa567ba06a10a000000000e800000000200002000000020a0d25d30f1f372151d405a5064dfa9649de793be5f2821f9698fff9608e6e79000000077ede9e923b6f0b3c0ee1f0418b6011f94180bf3c6ebb230a966193665f306ef57e2116b7e1216763408910d573285c11b0fcc66267f3b3285db2757e2eb218f86e930bfec8bc461ae2e7ce46246f15423fc7f8f16cc0abde42144e2c0ed14caa80a226f7d92397e1b93643473366c8ed50109223a2e21c491d13e49c71f30f69b958ca302c17827a2b678057ad0ef2240000000d3e17bb7c34800a5dbb8f05574a4c79ee39a9228790a1cdb667a71c506e8d7dfe598f2673871ae0533b8b4ae2717eabc7e9c03b032d6730ca2fb86b07fb9cc27 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A619221-09FA-11EF-8DE7-EEF45767FDFF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420977528" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d9f53e079eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c01cf76b618bfa59b6986205f1eae5d70c918bbb14e548fd80a3bf8fc6e41cbd000000000e800000000200002000000074383162756b6554833a471fa5104a96441d93f1306559fee1ec5e36561f824f200000009369ba2cd04bfefcb5adc3e29967a265c97bdc9c39c6546b2c3b4d8019af3e3c40000000c494fec2a1c74f7f7de9d0ea5789921cf10c28f89fc67cff20be196b0486e6c6337c915a12f7d6048a260aacd98983f0128f5b1365aed35b641c384fcd0470be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 3016 2184 iexplore.exe 28 PID 2184 wrote to memory of 3016 2184 iexplore.exe 28 PID 2184 wrote to memory of 3016 2184 iexplore.exe 28 PID 2184 wrote to memory of 3016 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12251684a80ed2358f5fb83e9f5f1446_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8ae9b16773e1642ea0874fb0b25c53a
SHA10a919ed69ea82a8b89c5421b19a77c452c7c680f
SHA256cfa0ae75afc2dd0d795a9916ae668160e86126a06392e9c7044f1bd62ad284b2
SHA5124da81a624a547e0bb7281efa5de28c32dbff43c85a929fbad9c49fd84416eb4f4d61b8618367571d2504eae921eddf27f831033fe486b3bc20d90c09696628fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dc1b7111af61950c600bfb224fbf52b
SHA1e28ad7c259c2bf5f8da5f69a159af4be56434ec6
SHA256dcb3c065e02b9494c313b226075efeaeef5f8ef2d1352ef134f5fad006d17882
SHA512bf144d560bc9b4483b76b28a5bd23a6863991e3a99769498e17fc9d32c1a7bb9e54233954472387136a36274d2bf2681eaa230fe71f962c49ae2750f842e0d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb39daf64610b18d54198ddcffb4ae2c
SHA1acba1dabd24484628d82ada80e8853bcbe14ce50
SHA25647096dd6767da2fc27580d94415099b6faeb22693f41a1b32146f5ac30bfd3f4
SHA512e822ca151c7e6b54c47f433f0ae9ca7af8bbffe2b017d0745e064514f31958e8d86e30c859098bb1dea9eec6a3e99c3afba5486cc313778f0c4c5eaf941cb507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555d9ccfac75ed3cdafbf1bac61355e76
SHA1b6716bb458bfa1e59cb7899efe2ff23d57d71206
SHA256e2fa0b89e3c15d52649dd78b9f473d8bfc441914acffa250f79ea5dffd2e1107
SHA51276896b6bfa691b7bf2c9aa38b2419f5cdc8d879209b49b254d0ce999199366a254f34ccc657717b58fc955bdd5d1b5faf4468fe3468adc5ace207003f08f7746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db10541366468071a2b5ab6745a58a69
SHA16b21e85003e372eae7ade7abbf8ea0eab82bc8f8
SHA256f6d859bb83bee9d69ceef1f7612517de6947b25bd2478a78b94904f0b667e77f
SHA512101546bdd5ec172f0c46caf9a911da1ff777004d7f7d7699ccee80b91f5224b4474dd96a956eb5d12120d948773e5c8e41ce8d470e4f4795c85a275e39960f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535542aae36e2d4f630b351c4ec854d27
SHA15de98aaea5809a2a13b53b87d30aacba7b776e83
SHA2568cdf37e5c218f6db2fa41c377c8ad7214ff757e31f8f27ae21b80b4afa4c8b57
SHA5123927ba093c1aa762ae1c2839af10dffd26003f4d7f2c32e789a33985e3450d46a8b5faa0e4dc850bf3c55dc2b37f8785e43f539773abf6e535ca58935422cfe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5517bc5b64f1dde0b037c8259097b3787
SHA1315c549a5e19dff1fe07e57438e8bbb684a1d2af
SHA25696d0f5f448533d9e748f6129761224aef183776d5e711c859d5192e343f990db
SHA512693150fc06c428d5d4e19f9570279a68190adb1232d7a54fd1cf8cefa9a70c6f8264496bb6c67e7dd4db0a7658a923e97382908066b2c333fc45855c9a023ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cae905b169851ce685d0ebb10d4e65a8
SHA181f0d83c60e37029b6d31213e75bcb17ba5905a6
SHA256e00bb289f05f10d8449696196a28e853b4a862dc553c8d01ce52455c1a8a3e95
SHA51280d12ab9c3b7585e49c215cd9f8ef14e81f02b2ad22c537086a5b80a0dfbd9d53a3a355e1c946c3ec5ed4ede25b76a5822a5dcbd15b78359681a945c4e67f939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a19b6030b6bc691b77e4aae52f454ec6
SHA15f5588d3cac16bf4f38e0c62aed442d64f7218a7
SHA25628c68a2d8245cad7358d3ef787a82fd907678ae4aaacd651ec65a51fac04d14b
SHA512393fb2202c6a6e3cd1c0ee97d8662a9ad3dd25f390d691e99addb822f5cbfe6b8b814fcfe280db256fdeddbbca1bec33b92dc44e6c52a3ebb3f107c79dab829b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab9c94fdf5b57905e6a9a2af1f6aac4e
SHA18bb93315a1d821739e0cee128b160d565e46a0b3
SHA25664a9de53fe0c5b9497c3cae6e5697daffc721ec2a8ed38c4626cd69cb53209f9
SHA51215e82dfd86cc4b56fa83402c89e570fae64b2bc97757a86d3dcf9731277c5e46eb35ce18d07846f384516ca7c2104ff2fd1a0b23c2a5811a8000c6b21088e9b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5641b7ed189053b8ef53438508c1bbc34
SHA1b83a4cbbb3e5630513a6814beb0f595e67e90e3d
SHA2562a71cfd6c1114771a0143f8d9f80cb4bfa229a142e4bd85c7408694c58fae699
SHA512a509aa466cfa55bd75090585eed5e5580b53561a2ef1940b57ae3afbcee3caaf8b13e38cd53ea8e3b2028e1241320e8ea81d29e366df68639a3f7f835bde3028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5300e31ea1b12eae4bbe08bb7cee1ab63
SHA14d7a4d43ca0a3e1a17f7e72339450380081ede9d
SHA256173fe5909ff2b60757cfc30e3d55a7691a7b66b4175cab6e502d930472d7a5fc
SHA512e1ccb35a6c7b768b272f02e7d0393d7e83316bd483bd53be099b9287f9b1abef269503065afc0f63d92ad23eccd41e75a5b4991cbd9fced1a3b038a5544981d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a7445c03f47421792e6f33bc0d89c0a
SHA16b4e2f68f99914f835779ff2c3c80c73df6a1bdf
SHA256d60787683ad9e5a27cdd94c292736fa68b9ef43c506ee435ff4464e5e6019c97
SHA512b86b20c244914e08b3b2e7cd4c36bd61801470dfe62d0ec5d9a2d9d4feabc2887c9dcc8fe7c415d733f67b407eaf7cf3d84bd8227b5eb6c4df68ffb223c7579e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53df0fde26b327d54e7efb5dd141360c2
SHA154c275e7a40d9ad316cdafa475ba64fca1b4f391
SHA256111285f7333daed83583d14951bec5d3a6fc11f81ad1a9fa34ff802993a1fc98
SHA51261b31d435e858f008bb563a391e25043cadee272a829bc9fc496e51eaac391419b268d843684e55935fd23fd35df38c77c659a34ccc820076a1a51fa10f13884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53785b48d867f359629d9738e20135d75
SHA1581446ac3303680b9bdd4724ab06d569dd7fdf70
SHA25696fadfceef94fc73d0ca988334d36598735618675688f5a18d81f688bb6fcb72
SHA5125c22d3f66efde16cdcb68136c22619a55f212026a345318ae320377140262073ed872ab55302efe4562cf781864f26054c3337b6b58267b19c64540dfb1a7742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ec09dbf014455fc866b3a7cea5b36e7
SHA17547c8065e08696152a80c652273691688b1ad83
SHA256f8b0ead74cc919f2c7cd3a7c2e031209fd7188d5c5d5798d2a3c8ad426553800
SHA512443ecc42d3a13dce3b8b17cb404d40ad5a069f92b540c4c2e4955af9f9a092c88bedb24f90c38fc77d1274efda74e040610e6597bdfdce5dbdb6be9bb64f933e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509b9296c528e6d7e7984b981961fa1dc
SHA1dd2e8768c99eef46ca637d178830eb6c075cbdc8
SHA25653e70d98bd7a090fe5441c6cd9e3581d9b0941213a39d9bdeaa8968db65cfbe5
SHA512195d749c2745ddc75419a1d017fb1145296b26c8f56cc8d7ee07a1d58aba85b8cd4428b67c6132b303291a7a3d6333684b68c19ad8e766e8a8f844d336f03ae0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a