Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
175b6ed620cf714e4b958787f6020b96_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
175b6ed620cf714e4b958787f6020b96_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
175b6ed620cf714e4b958787f6020b96_JaffaCakes118.html
-
Size
789B
-
MD5
175b6ed620cf714e4b958787f6020b96
-
SHA1
fd1c3e8b37cef3e4c21d5e8c791a0d1ec8bcaa20
-
SHA256
ad4021e40006fd485b651fd5913b6175c62c9de9864713005965141dda247399
-
SHA512
3c2b9dfeeecd46fe713418daa5b68f6627f52fc1deb84030a56a2ee0282c059548d4cff9ff3bf01f1cf1b58ff8f24cfaad414bdca6a363061ffd3b4ac25045bc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000861f024efc2e08f9b6cfd8c02eb451bb9c19326826676fe2ef1628abe35774e7000000000e8000000002000020000000db464470078ebe3e0b76500cd4ba87256cea89c958e40ba4a7ad027969be5d5f90000000f43f2fa52d846e99110aec9a227100629d20ac97e247f7ba7420e74c89f4244596b5c6d77a902d0895d9f2c1e9cd5dd8f7c073e00b20d0743986d6bf5cb513f1244baeb243cc4f2ca49d1023120ea614fa517ef68194cc27be1ca0f3b09e0b055f1db58462917dfa0041ad609223a1c6d56260f16c0224232e13bb177eb80f2dbd5e7d5852e8441d16cd8f8c505e3511400000009007af6572167c2ac316086ac60097ff0031b8d504a255b0d125c44378e02cbd8ba55726d894100cc9a9d100a202e0c64b82a1b58777264b8cbce526163b0bfa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5ABDCE41-0ACE-11EF-93CC-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8052541edb9eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421068555" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f9f3dfc01ea370f000471ff94ead4585140a2eb7143aa7fe40ab2349d825f89d000000000e80000000020000200000008b7b9214d8f7c9341ea827cf61b68127517ffcf825a0ceac517a575f0547d6ad200000001019c4ecec684c1f57a9ee2b24742e366138774d4b6258ec065cd2b003dee58e40000000c6de80d095713e7a614cf2850a88f862f2b96d002ebb18f547d73396a38907cf61888ee42e737e8b9ae102adc7848f9213318d4908e48b96c0519a8d84005a16 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1800 iexplore.exe 1800 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1720 1800 iexplore.exe 28 PID 1800 wrote to memory of 1720 1800 iexplore.exe 28 PID 1800 wrote to memory of 1720 1800 iexplore.exe 28 PID 1800 wrote to memory of 1720 1800 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\175b6ed620cf714e4b958787f6020b96_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df6873489b32ad6666299ed0051a0bf
SHA1a9575bfcb2bd0440ee32c6d196c01fb4a139f70a
SHA2564fb3cc8caf285cddb0c8fbc4633a1430e66ed9f5356ee08f7c617930fa74e2d5
SHA5121437d50366049f159e71345d09a3d0ca0c003dbc9c626ba9d19ce22bd37a461cc4b14ab9132dde93108f40bb0670ff414bc064ddf6fe506bc00c497aee044573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b14af20a53bee980b5933a174925410
SHA1d5dcff44ca7801723e279ed95fc66e7b0ffb932f
SHA2560fc116315a859f65e19ecc01c70b71d0fc404cb7df8685556d5fb93001dabb4c
SHA5129ed4c841e47efee4b56744b58e4a82d9adf9dce37812cadb98d9260e415d54950743813cd3f3591b396cce2b705fd1abb38c287d24f1398b6f4dfc6880abab60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f910b067398b99defc3d9bbc0251f072
SHA1ac73296abc84a57305e9c73a33c045a53879ed14
SHA256c23f545ef2db34481fa92632be570adbaeeb0ef793fb2295abcebf8a1f050858
SHA51288be90b3630546ecd5d910533ec59f1ec37013737c5bf3259b258d6dd691c68e6690177c5c016825b3596ff47e6b59fd82ff161869aef6f1081ede714afd0fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ba13bb4616ba73f86441a2103ec4693
SHA1ce87196dfedb0ec752f04ae7f4bfa22335b10dda
SHA256d1fe96f91669db389777016fbeb7c3527042df243f1ee7b4910be0f420ab89dd
SHA512021564b6ec888baf7eea77fa5740a4b966c3c334357e88a174058d16f5e0bdb7749a6e5ff4ff3b4db65d50b3f83d364368eacdec78c8135f82660ba05c40d984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513bcd6b9244a6bc13a847433fffd6f35
SHA1391dc2e40d9d732a8c347aadd2f9cc5d46f17185
SHA256d29eb3ab45b7a1bca2ca73cd87888c245ad085961a5d2d0effca2e010b44b293
SHA512eccfcee625787a1f2b87487fc2bd5c5e29b4c52fbb8c6797f5e825ae0f9b31e7fbb87fff81c132aaece32acb7bb2e7651b050fcb635b0c26cdebd3adac65a3eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536edc54ecdd79bfb1abb860614b75457
SHA1d281ba52bb571b4e81a6d011f2ff84a639cc5a6d
SHA256980021a0ca123fc2f0d3415ca7722f601cd2ac40f52dd497e428ea50a1da99b5
SHA5125048a42cf25e80eb2fbc0599a9b721953228ecd57bb6fdb3f92085316a74c7c784c9158b43cf0f31c19425f6b2bec3347d9b76da47d3f9ee7d74947667db3dec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ae43d4da250f71b24694f61662c86c3
SHA1845c8ea1d43e95f2f7279d89e1c3e431d704a992
SHA25628dad4cfb79f9005e85eae2a9b74dadabad5d6162a3b0e8687d4b38a2ce8a214
SHA5122fb30f6fe885f7450a7bb384b8dff1054e6442241ff5f04ba8d393046659263559e03c3aeccd52fbafc1f663fccf819b491f93b0488aa65b49f123f10a45b095
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0afccb49e1a4646a7a4cb2493f4d655
SHA107bebdc383a08603f594725512046ad32b13e072
SHA25612d5001e3dec2ed92cba6cf8dc5d993b03970e1f098515d92084bb208ba51cc5
SHA512abef8e28ec5eb3f81682a53a7a0cff8237b22e1cef8ec3167c6dadd091be18fa741faa227f677840bbe45ce8980014a6ea4ac163c88f5bce88becd59bb4c7551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b22ecfae0dcd913db81c395e5a170f2
SHA1e4ea1e3bc0bb57c9de369d0d0f3c7fb18155ccaa
SHA25648d99bc945a06eb69b4fab273b63af9837034d998ba66d10ea77df35e60f189d
SHA512fde20a6461424e0905f9ca3f41926c09127c1e78963fd0df1a8261736efc9b0d862057ce0d5164fa32da378edd740164519b71ef20ccf4e4b3cd5bfadd1b26c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d99ac236856d5dfb33c52192f5e4f7a
SHA149f2e7148b3ca9a176cacf32a5d11f56093393ce
SHA256c59660cd5cda2ba3f0af3be7686944f3450323be7a79360abe018b730e7d466e
SHA51277423fa9e1e78a204e83d2ffc74c8534e074dbc414d1aeb546d563642898cf5e008a21d62a510da0c56df30903c192108ad3fa1eb6103d49a3569d24eafab1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b923b4d73323eb6e1d6b52a22e8c9448
SHA1e36fddedae07688af1b5b9971efc56b222653d53
SHA256a009c8e9d75b12e677cfa237e9311b206990ee462506720ac653d518e388e8ba
SHA51260a1904c7f37428117ead7a010387ce7cb7f4ceafda98fc1c427e3834e1220182f7843ca6e2a1075ede14ff1e6c6422abd292a29af1aa9d9f0ba29d6bdd54307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dd0bf9e9f168f9169e413d107e60a9e
SHA13d8f9242e353e709fe180a8ef5e8f9fb859495ee
SHA25654af3b968cbb1ad56cab54535556d7ed9d83aaf8aa6dd131058fe1e8eadddb22
SHA512bef09936a06c25821b61998edbba1781918c40f3af752448267e5ab2987ace5f74b1b99514506f989c8283017eb375d3e820293c514bfca6fe2dd4f497d1dbe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc9bb3421659ba930bbc93aa4dfb35ab
SHA1835ff261d31653bca89eb61b52f14a76a0706dce
SHA256f6e7a7fc7dec10c1cff96f39c3c36bb29972ccf2e76cb513f37ced93247d7b9b
SHA5129e44db95acb6f0e11d234b7ad83e9889f9e1bf130587cd10bb3e661eb28a006f3f652ff909498494698fc9e990637606d72e3a83a3862863e3657bec00718250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b692b468eca637d10dc50517561de440
SHA1d55008c6c0bbcf6336c802654d33058f84a8c55f
SHA256e57b97aecc817471afec6267ad661e34e89f442aee70e9841df5afc09e6f4cbc
SHA51296897aa4b73b0f46037a13cc0d3777c3e0ba237bbca338548f46c195fcfdb8e651a32e86a12a96d3483e1ee5f0037fa3fc7fc9f52ff9fbeae2f31aa656a65fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaad4214af964072cf9484ce39de456d
SHA16d4cd9016125d5d45ac0cc60541c928f557e1939
SHA256b2a8b579a79a71df9bb8d8eadc508142ab57bde189da37123c1bc2c76cb202a9
SHA51290cbb4890b14633ddd3fc62d2490779fb6f3910bea4c06518e4d4a5899f10e83ea6fd85de55005eabf25f146ea5771a9ed5bd5997ea01e641e1c5f103e466efa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5169be2c9b934ab8e965c8ef8eddba08d
SHA13cbbe667d8cedcabd085f8f8720754f39cfbd319
SHA256b62cab5134e0346f0e8fc48bea1fc6f45925cdf00cd66da1de327b23e7a3b9ce
SHA512de12ee5009c8fabb3ef93c0f3eafc3b237a0d0760eb1a031d1a8c34a8bd33f34023e0ad27fa8d13cf583cc287dfd896861b1d4e318cbcedc64a58a2ebc9dbc60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51760bbdf5f4e27024e28756f82106004
SHA1cbda5b0d06df5a7e5eb7241991f520325b7c280c
SHA2561072ff47ac45810bd361a45a304bb61193cc45e8b83daa3c758a15cd3840b9e5
SHA512545db732327742c1921e76c9d62314987f3b7d05d6a4c4a8bfe7ad0e53b7e91a17a0bccf515f8b53fc0c8bcd3239678ab9e94e2d3a7fd578da279a8b564e71a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f522dee1b525c74de89abfdf2abc4ace
SHA1da71bb863dba9dd04389a2aec8380b60baea70ef
SHA256f19131c6e5f43d9aa5e1f9066cd894a0ccbda62e5cbc5c65dd93d30e54b87a2e
SHA5127cfc3cc0638bcd7057e136b6c9013f5565c237e934ddd3de5b5b63d7e492cc7eb451e9c434f26a84a6d72a3f1aece7db0e11ce8ecfb35ab7c87e760212a4b63a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a