Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
125953bb6ee19565bcf2a7ceb08a8246_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
125953bb6ee19565bcf2a7ceb08a8246_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
125953bb6ee19565bcf2a7ceb08a8246_JaffaCakes118.html
-
Size
4KB
-
MD5
125953bb6ee19565bcf2a7ceb08a8246
-
SHA1
027dbb2bcbdb23b7a3b5e0a61bb5cf4802fa4e5a
-
SHA256
69f5b75236a02b6596cd8e6e8b992f667c31e9e231cc34a451e2fb05a4e5bd6c
-
SHA512
1ca43c99f84034f4b4df59dba72a9f4fd1a8ec40ee84ed112a522c64b47756e46ba6713ba09e084fca1ac7dd508711890e055f22d7d7640c8b6bfebc63469895
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oJkRp4d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F2B6D01-0A02-11EF-8E7B-D20227E6D795} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5097af430f9eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420980972" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003333442e051803cb1fff4f5c5308d3dc9e3d04f68e49ede70b9d345582b74222000000000e80000000020000200000001759769420947f326e53a74e08b07288e9728d04c296943fad4d110303ebe920200000005a8597da46bb5e84a65c5234dee40d0c288f88e9cf80c24a0e40f592470674db40000000a7d2ef2ace13cf64728eedede026e048440cc0f0300a819725e6537ecbffbdb67e98e54eab93921171b57037e5029264439d320a20edf6ec23cfa5f63b2ccaaa iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a4316e7e80f8af6779890e6e36cf1072828b4891144a3e159d7211de8e9da95e000000000e80000000020000200000007ca734511fd1d1055838dda640787b740267ed9ba475d1f6451000d8f5aec98e900000002986aea612dfaf1bb2625ec68f39aea77ce71eecbb8bbf90c8919481da4fb2aad31bdb1f476417abe5ea375db643ee9bd5fea297023179c2ec991ce598709dadc19ef91184192a6ef247f956a2e0111d0e0723e980150106bcf324a0824d46a79f0e04078a09dd1baf9aa8a391e65fd72830c5fa1f8efb5455fe6b41a6f6de5dbbabf3124ad3dbbb00d4be9698d311c1400000004b53d8cf30c898e33bbaf299c0b4a22e26706cfcf5f60b594f6d01dca7413316cb05a313985d7a041c8a27eaf9e89b4dfda8c11dbfb7fd137d2d58893b8ebbc5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2112 2240 iexplore.exe 28 PID 2240 wrote to memory of 2112 2240 iexplore.exe 28 PID 2240 wrote to memory of 2112 2240 iexplore.exe 28 PID 2240 wrote to memory of 2112 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\125953bb6ee19565bcf2a7ceb08a8246_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521b3826919f250850d7a097c0030be48
SHA116bb4fcbbaea40fe78df49c4082221986a66cab3
SHA256ef9a29a156d74c832e230763f2c1b58134d5483d622f081f7fdb3b389059be20
SHA512942654c5cc94b73f9eef4c696512df4cd234caf28d65a863f33205b02906c582370ae806fee893e57af6edbd5ca731b58d3a551ba28e03d14103df8c3cd15889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae794c93f19c2a2c9679e8e2edf7a303
SHA19dbb5ce21098db25e65fb75ce3957c25cec4612a
SHA256ca8986539a89eb2333374dd47324a9e4d985d06d8fbe553358c1e4417b813ef8
SHA512d33b2e0aa3a23041bf9554e0994ae5b4c7b8bab58916814ab9404ea368500d92665f921e2cd6e22fa45e9030bb496972143aa155f8aae55de1979e58578637b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdcdb802c45aa01d750b9ce117ded28b
SHA1d885cb35bd4f2c64a43101f91527e73f5e139420
SHA2567d1a2ac788c700faa34c00378e0363097e10249a2274b9d8bf2c8c3b0f619bcf
SHA5124e5ee7c7134f9847687b913a7d2b20135de23a9bd491718d93d191956635e3cb75297b88d37dff81a29e58a1e1c8725ce6513069add0808ef1bb6a76e8e1ff8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538774d91e2292043a578d6201b3ace1e
SHA124e3b45f0aa3baaf9f7138e422272bb977a1c435
SHA2569c07f190e20b81f97ce135400e0e08dbfb70acba7927f4d270a4b56fd66dd36e
SHA512f879dee6bc7ed9fc3dad72dbee3a28c50d214d0805557cc5e9b9eafcf851683b7edd4c7bc604f69bcb5d31ccc9b94e670d0863dd8dbac5d5ba717649492ee946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5ee8aa74712b24ecd928d1a423c697f
SHA19752f06251ec5520fe69682545b53eb4ee3ff1c3
SHA2565ab4db3a899f4552dc244358929b37326fea1725cb0a31ca1c782e6e9902dfae
SHA5126ed4fad7421a954a46dae809244360f43594e0f6050a40e455066fb5693e6e4225cad274c8899a064de6ef5468a0212e513f2b4935f7339733a29d2cb1cabf69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53670c429a9cc572030567782c9732df2
SHA1636739ffa40a8537ee76cacf117320b023f51cfc
SHA25634d6714871684c26ec8b76b2b9f6a151027d180460f0acfb39599b256e6c4e41
SHA512920aeae48f64bba82031b1f1d7238ff9f088adaba0d5677eb8066c19cddcb11661e4da2974be24572ed5cc211cf90f9d286f0e0674b9341c6e87508b434df3cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5025e3d6193c2078615028f07a91947c8
SHA147f1bdc672d901665dd0c9c2987dc9dde57187fd
SHA2567ed565b204ed3c0c54fa668a137dbc6feb89bef72ebf8441ae97fe685f388f69
SHA512550690af4a334bd1dc14e6411c90c13669d834bf52ff5114281b51aae5c814ab1b3c10fb33677da4465c3f0d0c53dcf5b9152dc44d5df00bba1eb0cd0d753295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a98b932a672524b9f8cd03b8fa932a01
SHA1e90a05660fa7385aac0834b7fbc330592f6e1d61
SHA256c8f0c934ec28b12dc06e76390b8a93dafd6212c4ceafaf5af3987b30b6f4e977
SHA512d213e25d3f6d18f334385ba4249cb8ab2c0fa2fd1652df89fb2d07b95755d57011411be4d08ac857631002d693bee88ee5c7a4bb49c821bff2930d599b5b23c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b59fc08a0cbd7a76cc15b5f3bd87fd6
SHA1858e138cfe61aee4036df268b0c0e52e8caddc39
SHA2569fd042e493b0ce33b4c01050e80011e7fc75a8c5d973f9ba1e68a1d4dea3ee25
SHA51257a396166d4e3011d802ce10cdca6e60315ace7fe285e83cd14f44486473dc8df110206cf8028cb895ee0cbad74de6b0d949903b5b1edefd33806c47fe6dfcf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a70c5ed4dc64bda8eb283fa6a66e09c
SHA104e7866ea4ce9d257e0db9ff57d443b7e8025b4b
SHA256f6981f7ab97ccf35c6a41b5e52c88934192f71292a1235860621acb7e5c1baf0
SHA512f16f6c66f192cb1bfe0815dea6f2382fa7ebc479fb6c000efc9f2887e49c3250095969e5c05ddec165f14ab519289af0bb9c33a4e81de2db6d51e629acae5caf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5360d5d0799011d3eb831ed20dee5babf
SHA1d2869980a43c3c5ffea08368725ec9f962c3033b
SHA256de34efaf31e12c6069bee5782b75184ca241a258750510ee03d4e2d81e4cac85
SHA51293a8c8ce542e7846b1f2aaf2e98e85435cc0c043562552a1745618bd0dcf411295c4c975054633906cc08f2e78cf013ccb7a59464bbaacd3020e0e8d72ed1880
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8bece95d4cfa73d2eddb0d0e1e6a35b
SHA109ed121e34f77c408878067dfa84529f0871cbe3
SHA256f4205d7b8a76fc6740b26893c78c715ddfe1e2e5620b575257e0b7cca24fffda
SHA512a167380f23fe2b152b92e97b902648a2e58897409834da8c800f78b602f0c7611bbd8d5f72a0ccf2e6859e932e4c91ef4a4fe1aec67992385c1032c31c3004fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b428ea91ebc378c18e678b5163fdea0
SHA1c4f30c73a11af7501513365ba3a8f8aab1277b27
SHA256eff367472521308d3f32e5526a35de2d7ad8b17b1cb9703c0d41b01852a7f0ef
SHA5124b47ee9be82b97468ee73e3d202d3a843f1492604db6ad0961105af017276914fec8be1c927f671d91a1972fa0c05dd23428e981fc9090d38d34064890e14903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaa51977083854143804e4cb37eeff05
SHA1518d5b203954f6a525cf46f5347805bd57e5a9d8
SHA25699f5174cdad436de59d29c15c9680921224770baa2229fa3876ad65871e2384c
SHA512cddcb5d619a27ef6ffd349dacb042e0939371c1149e3a1da6db325820e27b043cd094b1578667cb170f80a74d436a9cfbfa8bbc435458f8c650c485b250aa3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3aecd7ecb33b3cbd93bb7d7ed7a7710
SHA1698455085ebc043d47404c829872dbf18347a30b
SHA25623cbe8d87345dfda970cfb97235c8c24ee8f7f2de158634fed44e1d57bf86802
SHA512fa42c009bc8d0f674d77955f5532417ca3990d1c35d6cf8de8e92f9f713b895696d767278528395451058e06e420ddf3e6ae3ee199c8e1a4ad7f5da6cec78ea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595b705f4ec489fd58b20bf572a87e161
SHA1278efe49b9296baa09f5ed1603a9fdee6640e04e
SHA256ea4cabd2c771916530e2cf642081764ffbf14cb38e994539da1b73e1de4aaf34
SHA512dd49b64bf61ad51bab7ab5042196b73a94eb92208d474286ed17d40f6145571e0acd62d02f73841f2746eb604588d031d5bfd91b26739e32d692a4de21ed0881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ccd81a5f86f1fff03096827ca48d3be
SHA1126b18ea7477cc122e0039ad8dd07d4696ceb008
SHA256835f103cd0a919a28d5abc083b7fd858887045e33001da74abab4d1732b3c9ff
SHA512653d0b5d109bfef8e176aeb2b5e525e094814c358c7e2a61dc121951d962dc0c04d3e454c5b29a7e179299d34348b2701f040affd64ff4dd8a367f350a66cc53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f42db8c660b0f2475ab1c78b82ce1d84
SHA1561fcab46eabe92d8efbd8dcdfebe165a074e3b4
SHA25648d4a6cf535c7c92c9bfc8b6cc02b1456445806a8b7a848edb5d487e8e484814
SHA512b310fd0bf8f143964920213a41c998b47bc15e552295bceb6ffad3670096488e2b1ed6a7c7e3053023b337a735f40287cbcd43fdfca8087ed539c2ce7bf89f29
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a