Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
1531580c9a7b3d279b567582b85b4316_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1531580c9a7b3d279b567582b85b4316_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1531580c9a7b3d279b567582b85b4316_JaffaCakes118.html
-
Size
461KB
-
MD5
1531580c9a7b3d279b567582b85b4316
-
SHA1
f642df2610e1467f4699c06177dc88f79e375c86
-
SHA256
355d1f16705906d3924a7b78a0ee2c96dc073bd1e9207af4c8c22ef15511529e
-
SHA512
d818c67d42376210d9752341bbb09190d78746dfecc91d29f99c605deec07e26ae9aee9b53d15ca3f0db8f5bc097180a0f44388f82eb783458e52b6b93800a12
-
SSDEEP
6144:SSsMYod+X3oI+YqsMYod+X3oI+YxPsMYod+X3oI+YLsMYod+X3oI+YQ:75d+X3S5d+X3T5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305dd8b8849eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004bde2916452c833f88cf036de13742df9d33c7a3cfb4a499fb04064d0d7312fb000000000e80000000020000200000004ce5c0134e79009b048fe22404ad8bcd2cae53b49f9ad6c023c89fe3bc3669e920000000b38060cae1c8afe07b261221352fde99dc986440c65d25306f366a1390e0611d4000000022c7fe04db928d8117be402b3da8a21e8913b57945b61a439eba2098685c25ed43f4aadfc22a39f034f5e3bd5b6683246f425d43bc77f903fb8041850f202c0e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421031412" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003765c5dc0486c0e1a63581e7a9d0b5243dd95f2288d6e280ced9c6f61b66569f000000000e800000000200002000000056a41d8bfdc511a6df9412ada8edca5452f5e9fc5febe3afd37851d39c35aaf9900000008abf0b97d3c2904eb2cf7d6e202fa5e67e8cae2766dda17f9618050dbe933b8002b144f16f5a0f20b41af703264894623988a16ac145c85300e2b00348e042074ed143a166869e8b175ca91df62b966bd44e6a6ae499ffda41e096e1e4e13dfc1d6dd6fc45bd027152d1dc2aaad88d53bd8183e45adce74526c5c52a7a6edb93314e3eac640a705516f00b9a5880b27440000000d0ac60f91e0dcb36537764651c8124f037396134459758e375947bb897776449fbe244b7ef462ada05d6083b8c40086f000c880ff6d5be3a50da35870ce67123 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0546521-0A77-11EF-A2CF-6EE901CCE9B5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2692 2316 iexplore.exe 28 PID 2316 wrote to memory of 2692 2316 iexplore.exe 28 PID 2316 wrote to memory of 2692 2316 iexplore.exe 28 PID 2316 wrote to memory of 2692 2316 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1531580c9a7b3d279b567582b85b4316_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a061b0b85cdb04b210d8b7e98d6f3fb
SHA14ea697824cfbf90c97e99261f812750b3d2c2d5f
SHA256ce1f52e2779422db4a03e4612b027e45b66c1e309fd08da5fe04c12b65a76c2f
SHA512064982cdc216f55a03b9e9409af8647239b6fe808b189b99f31b76fc2e47fc9489d311701f5c86c816799f335337c0223ecc4d2cdad2fe6b57ad1d8fb8381989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dac21e2178865bbe29caae23190318d4
SHA1edd722c30431f198f88c3030360c8d87beabe182
SHA25681c5384ee03189ad41aa8df301bbaba818148de3098b96549e894eb4b2fc6617
SHA512db86e7c054090747263a6641219a30a667291dca97bb2f93c226a414c390071fb24bb785675fcbc0a5fb07a6d191286175c7aac0542525f42d5181b15f0f68b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f36757ed69daea2d70c4a72c2174929f
SHA1617f9c7f7462458f7aa54fcbe8040666a75b2267
SHA2568c834c4844aaefe25ad581fc0a0b7d05d6c83194162636fe7e3120a22456fff0
SHA5121a5bd34eb59e580980dcb1706388980ac2e912ebf8725467c713c7fe24a0aff603122b4627afd49741af6c495057c35251e74bf3ddef127d98e6062add2654a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52acd65a9c8a1b889239f26cf1dd848b7
SHA107c02ebdb3dc83ba3d00e8ee5dcc11ce941822e4
SHA2569da26bbf3ac71c0ea8c36b7a40452bfe59ee445945d4e0ef69aab64279769a3a
SHA5127952d71e86e4df22764ca054756dd5c23d6a043ded2230acf6bc1c8e769632d409e2675033b9e0ab579e8df26d666960860b539ef3a067f91a627df97498b0f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f695fa6bddd93fb1e207b3d05574d3ca
SHA149527054895374ab5f719e13dc5e79945bbaf278
SHA256f84cb149b918d0a84d4eb23425fb81cd9e34fd8d0bbeb2201f00496974a3f477
SHA512c86b71340a6c6a314b6fb0ea7bd36cefc46c5345bb3aae818cbd0054906109ffb4d63c1bd4861fab36d3c96bab058c0fe19e7585dcf5a0b6b5619983c77f177c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf5eb9d0d789eba492252dc860a52c1
SHA1cabfbfc5ffd96eea7474dd5d556484abe7519fcc
SHA256872fd31513f4e4d0c9a8a687e0dde51fb6b74ca43ef7122eff63f1a6ce6a5c97
SHA51271831fc2e5779ad7c8b095fcf45a40922771e4e8dfe2829b8e4909a1a1366c0c9e9777514123bb87435088185e35a3639b3985fb36b7242e161247435e4ee383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55677aaf7d2e615fd0714cc7d50a19900
SHA151e2ef49533f6fa0dc13eb85ff6f2063f413edca
SHA256e20c4f4f43f356250bb8bbff60cc0ec24abb86bab972ca5f12d8313a7895c178
SHA512a458c04f24a96982287efde86c14f0e93c118ce4464ab58578031fd197ffe90b3322397b8484c41b8cbfaa96e02d179d16e0a3a61aca227143789382f9c402f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599376e7f9e6e3c13e09d9cef4ea2c032
SHA1785423822e367ff5ef203d0bde23865164bc48ea
SHA2568cc4767dce7fcdca94e30a25d53a3dea621fd2e7a92d40e70dcbddb468641e03
SHA512cb7729744cb9a1e013f2d480918a54f1c8c32f1bae6e79ea5378d4cbadcd5797c6829c4e8dc990292ea88f7cbbb7fbef27f98d3ddfb0d36be5bf6186717f3e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0907894d391a52a884fde9df1136bef
SHA12891fa1c8e37d3d7e0e6aa7f6230488373240202
SHA2563fe3377f117910531e61df872845b97116f6e70f7a2f353a3c052b88cdf6d985
SHA5122eeef70ea526a93a28e3ecb17dcdc59f6fa4f7a2469b986cb59cc2665f1fa3f605776768bf76bdc37a97fcbd41f2588f45b6bd29c5b708ca784a2757854dfb44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a9d1afe60e5eb65fc33d755987007cc
SHA123983e5554b8ae3aae2b4e648e655109ea058c0a
SHA256b1d933ffbc0b85df89702997e80fd2913f154d6254dbfee6ce2da83cba9f3b3c
SHA512dcfa92ae0adf2e343bdfe32b2911298ee9a993a3343786e8430eb0b75343794b2fb44d02e277985bccbb9c79783872da51c3caecb7c920ac57ffe37fa02401b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542522b3ef53c6b5f2e495b546db6dca2
SHA1e42b665da647437a7065f5e1a98a3ae01c0e0f15
SHA2569cf987e6b03206b76b8cb16369b698e29f7346eb53915065afaf587b72a60979
SHA5121b28e9da2c4ae3814dd78d63a1b4f081d8eafb03971fd6f688ee4f0bd11f11e3c95c5b6381050de933fa8fcd74080a7678ed1f1467e317e5d19dcc18ccb480c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59394843cc688d313eb0d75e7cfec3aed
SHA172dae53513a77226bce65cd9000cd02b27ad26d6
SHA256593fedb6b2ccd81a30a4475569742c6d29c1eaecca5e3dce3e2cf985a44866d6
SHA512d20a8c19c45f5f1187e3a2bce5b87c3b561145b4b280cb69171bf82a40d56409b1bdb0305e9db1191b8d6b5a765b2df1baa8dc98840d0d8a1bd82f6445d7197f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d468fee69b71dd9ee8d00f6fac10724
SHA137dd909952fc8b17b7d7359324d3cf03d4dd13e8
SHA256d2ab00a4108977cda17f60d1a5dab45975949ab9f369a8567b8ba0356fc33c80
SHA5127a081e55dbe934d98e9afb5c910acb5a08bf3326dfcb1d833d19d6ea71d53a807d1c2193fe8ac0482aa6552b6cc52a3a004f9266fbdc4b4aa1d5fb11bb9b4120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538f6b894e17f7915d635a7a8c83489ca
SHA1128b16a12a056bd0f6bf73aa4be8fa6a8ca1008f
SHA2568eeedd1916c71a217dcf295587d56a7dfe6c852630537a00d92d2c389647912a
SHA512c61a4399a303e52c619cf5cac530e4e3fb64b3d7429eb831a7ae14852eac9f36fe17af792ca8a1a71068dec2a8dc4ed6274273304f81c574ee66ebe51aab6e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5747f18d7e3175d32f88e73ee0598919a
SHA1d1bd46e54965e5f6acacb1d8d22c1db8fa069ea3
SHA256a5da2467f35b16fc6320fb151ea1a60ce06bcc7b2557494e0e2a416b1149646b
SHA5120c5538cd02b8db3e6d5e0690a4980d0aa23a4d4751bc96c4a6d4e1cd725d97808ebc72c86c0f2d6c461c246435f6f96ce818948b1296ee04883d79796728a63a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592cd041ec83fc2138746dc372c9b9b62
SHA16aab2368fb73a5d842c3b91bc5b7c674d4413825
SHA25634647ecbb2baf6ad97899553c445a95f5ea3cf4562fd6f8dd966cf88a9f34760
SHA5123c840169d04a8f29dd36e90fa45737a168d41ccf4c1b41fdc93fd99c2d18c3b1a80e0252b36f8861f3b116822dd7c7287cc3611ada88a9954e0a9bb107a96f9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afc3bd23f36e9e0e1d8dfd15a47d68d3
SHA19045022907113d8231270c01553266968407c543
SHA256d589375a8ee0fe33151de4040c9fd74b8fe7c9bfa922217ef7c4c93a930eecee
SHA512615062a86396a5a991db698c6eae4dd1faad1e94fe45adc5ea0bcc96018e50369a1f9b79eb4fab22e864ba8ddf882dc9abe00543837681dce5c295816f66672e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558c57a65c1aecb10e3444705b76406c2
SHA1b625c88035a7ec1ba813fbe349a3ab83703385b7
SHA2569660d2fe8eea772cf1eac6f3d14928b7804058cd1d0c403f19de960ebef22634
SHA51287893a2f4956a67a7a7250ae289dfeb193b414d37163c970d3da5680db70da102fb73d213c36f094b8a15c16aec0d94a430d667e397e12f5299d9e4a5910208a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a