Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 14:38
Static task
static1
Behavioral task
behavioral1
Sample
18242c8983ff2a6160fd5cd3d5997e32_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
18242c8983ff2a6160fd5cd3d5997e32_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
18242c8983ff2a6160fd5cd3d5997e32_JaffaCakes118.html
-
Size
13KB
-
MD5
18242c8983ff2a6160fd5cd3d5997e32
-
SHA1
7ca3bc60c65f6b3bdb1f0adebd76a6a39e3ef53e
-
SHA256
8de18717dcb6598e29bec2c2ecce0ee8f6d97481faa52e11f1e34b959c383461
-
SHA512
6d80af6c0052c678f9d06979c9096d1205c52427ed8f797bfc5f6bdf8db97f9a6b0113ec076eb8dbcb24a3cbcbe4d26c6cd42c8bce514311833212a4b00dc4f2
-
SSDEEP
384:7bnfBEWYDdai0W/AxCAwHitISh3nGKtg3sZ1rMFQozmle/DBag:7bnfBEWYmW/ACVC6S8Kwsrr4QoCg/DT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000dce0a8263cee9464c3aeed76939a5effb588faef18af9d38963729918ab4177a000000000e8000000002000020000000ae72e9b674c57e244b1900daa9ece4d853bdb4d64f9d19522d9192fe73115ae3900000008999bf7e2bba08491e39c6106d3593f7144aa46b7e5deee76c14c92fd87f508a462ba4621b1c515f02eb3d89f3207fa120df35166e5f465e8a7af3ba446c8f7bc1e86ac50e88ba4f8acf0c1cd704138a506bb611f9ae7f8aa03a9cb1d095674a1752e8554a7eeb90c3912bfcd773c314a9132f95da48153620f569d85c0c5cadc63c2a298779705623e4315ea321c67340000000f1fe9fc7b41306bb69f4b878763a951ee3ab4412008d23d0bd72286bd03e252160bb0db13d724d9af7cb009c188e889ecccc4769854c92eabf2518304875cbb0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F011631-0AED-11EF-84CA-6E6327E9C5D7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002ad402c22714e12ece769b8d33a0aef68bdb5c0466536d92530111438f462536000000000e800000000200002000000005d2fee8ab00944b815e44e0fa55102e9b6f169fbe0b54af220f7019b0549c08200000001adad14d3f4ee6ab8af84a02a882b83d140e691af763a12a1a0c4a98e497a25340000000ad7870b86a2e5dee6e7fd12ede8c7619b72bc86657f75b632f20cae1e827288ba10a57e654f3a6e22cf23205f5afd4c05bb801799e584828ad2168072a556315 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40576407fa9eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421081798" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1336 iexplore.exe 1336 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\18242c8983ff2a6160fd5cd3d5997e32_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bcc106c73a73ef8a63327c55d49996b
SHA1623759eb78f067d894ac9ef88bc090df31a68ae1
SHA256ee1619cafbc5ded78ae156f18df8d693739dd77c8fa65a63ae35d8ef1450c541
SHA512f7776fc79c8bfcafc2aed09c3bca88c61d86fd83ea3522dff252bc4da897a90ada04aa5ef5c4f07c1ef65a1609b41b7d3f521a851c5f369f23a75fb358319a73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaefef7fc222f954781e744f747d27e8
SHA1c93316ad28ee9f282d8c49483910a68164124c7a
SHA2561b10d69dca37219dd48887c9f30666a40c10e46d2a23ceefd8869c0b406a7d9b
SHA51277be46b26f97d40f1be7cc155fd46f5202cb5584fee546a0355a2d96ae386f21afe39345613c4c2c49afa9697ee5247e5c5750f391108e4bd27a4e203b7c0ecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568cc8d4e285aa25ba0bf9adebeb3817a
SHA11b6b4feb14a9d59118bbfb3a082ca6deb16dee3a
SHA2569fde765b687286996d9573e0473555073f43e09dc04048b9e2d1ed1e117737cc
SHA51238e97b68ee30250ac7087161451b8f7ee94e454fe1cb041dec6f0f4cd75e130be9aba509da45fd7f4138a39cd42cc40cec6154cfbc26d80109f80f2d526eab1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587a522fafa57af4561cbcd0e3486b33c
SHA115490eeda11479fd6b552976aa351e07fd426b63
SHA2564b55cb2f88bfd390c07f8d3d54372f42e2b9d13ad3ad74f99c3acf162e6ea1d8
SHA5126c5396e5519e34e248c352ac74c9ab0551a70087ba4eae542317e07aea902ce3581cdf67737b270051fc0dab65c2602b9eeb1e995a84b491523cfc296e9f31ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577a4d0ab6af8636cc6f10e209f57611c
SHA1732efe5f5cc6d0e1cabb542bc80393d42fd4acdf
SHA256ecf974a7da9e1582e6b68de757dac7e68b81b6c5ecf75404916dbef433973975
SHA51233ac13de6d564d8eca781da7e9bd1ec4a8641434238f6147e8a3d025ef500290b2d204a8f1d379e0f5acbd390de957c7b404d693536469fe6ff499ec346cb3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1492910dcd142ccd017e0ba8c28ea7b
SHA189a269fba4744952a552df9bb7efd953e7352d26
SHA256b980220ddfb7b1203e183b28a8932723dfd37ce45b6a1be758638a9dd92b7de4
SHA5120b5b3e8ae0a53f8a2cb78c610b664e8e6b204c78d950d4aa3c04f9bc8733513dac45a367f69e57fb15f62b1cc702d5324bf21586c7c7607eb1c82cc9e70de85e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c866e139d93e121add3c2e9c803cb65
SHA1616de5fe96869e8758e2fd5234638cadb0ef3e2d
SHA256a4a8730e30a1981c3103f19bef985a4b745c20cff3384bbb64b4dbc94c117d91
SHA512b6ca1665bfc5e14c46b13e7d868029214fd55c7a722418db6d27eecf5a6910602ef8cb965703387b66341474737e68d445871fa213ca5c1c189816a353e1dbdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542e2b0aa2714a21df52da4d87e142541
SHA1d846eee3e49539d53e0fb11fc73b0d7f922557a2
SHA2567c93956836ed471f424cfa8504e35c8a697ad9ed6701b09428d418d56c45bd6a
SHA512cef4320146b10d6d675f52d14724475d75e054b7e46d2b4c5c8e9c80631c7428ebd1322523adc2191025b09e8becf1f3f7c0ba02739583f2d526294481b62f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba033f86ff32774bfd50e54178ad1a9a
SHA1a7cca5f989e5c6e7e6dd1f3bb3292768102a1e0c
SHA2565025cac95ce89a2f342309f95c999f727be9f350e4020ee132bff1e122ac73e8
SHA512c6110d69d9fb1488e271e865592a7cbc4fb0789c658f538744f69d5df8361a2311b217a291779c6d414fedb2ca62b516336320dc3242a679ef30e893fd3056fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56032ed2a7a74265c8fbfa136019b9e30
SHA14874dff5f26898269c855d47d77b9696abb4de8a
SHA2566561dcd5a89e4596f97ce99b0de4e5ba839f2f44426b9584c37ee37595d22f3c
SHA5124b9b0950b1393128f3ee5aff78eb477b30865282283b6aee5cd604cbc8bf615704b8d79f42d4f751bcd667a83a229dc2b983ae01b8c354bf52881ad27b5d9664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d80f8e0be1bd892f0abd85ddf011eb0
SHA167b70536276af5247359e59fdad02a6f964b023b
SHA2565dbb38f5e9b2b3d942ccf1d2136917d8e387052ce6c45045b283883062113ae9
SHA512cb684cfbe8b6c37c2b9c56b40c8bf7dc9e30fd6162929036ec204fceb4e7c8cf7ae67726d31376ffa925cc297057aeb16393b2d2ee7f5f2f9f79afb0888370c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9045be91461bb593793a9ea829776e9
SHA1775f5a686390581f925b220c3f9a727845aa88ca
SHA256bb3ca1135e851cd6ac8c2de2c8182bdc571227ab2e97f1a673ff2234f89a623a
SHA51261126403f7bedc2bc23cebac43420f5a524a0e751b25b0042eaa4b1c3d82f58defd2539adc9cd87cc056c612fbd0a6dcadfbd612e7d4eeb62b3adf5f6fede938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51374edc26dc24465133e3b585ab40fcd
SHA1a97f9847d0ec7f6606ea00a3a782c0323e46a7dc
SHA2560273a22fb75bf166e95a9ba6c160a308281a53fce0526b4e7a32a8f98bbbfe2f
SHA512cd7c4b8a84ee0577dbd636dc2e21fffd056aab157f2334e62a5e3e4af9ab0ec47df456619a6f372485fce4ed2b5311d53846896fdf86b60e18c274cac81ea8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fd170db02d79e023cfced4cb75222ea
SHA14885fb061b609023138f228ec14c3d4a22ed79f4
SHA256fb7973ebfea2fb4943dc6f92efb1ed4066f73f6f59f717281205bab64d7d815c
SHA512d47a339320e715733342c4645b0eb6a4ccd998bfd358389309bf1a7f9fa2ded61f8521ef278c90d44c65bed12e05d7f720bcf9af45b2cf20439265dbe0799fd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545a45d168241fb3d60fa8774dee23f1e
SHA115072dbf700b20b4c466cc318c9c79dd1331b9c9
SHA25626c392145f890c2e9c2ccd2956d2e2fe7ce5f39e4493be974b9706f49bafe724
SHA512948895cefe303e81aef739adf5033125724de9922e071f94b344928461ba419ef5146f6de8519bddb2489e05933aa2330e3d016da096b83c18f3096a411a3125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518b603e65e7e905b49101a8c451bc529
SHA1fe1f24332535b1067e239b042c14d6c4f0d93988
SHA2561bd91984a734a9b860ae799f470991b6eb3232e5cc75d5712a5fc847279e3e43
SHA512785ca3c0a97c3266c6200aa0b2150d344f32c29512e909481132a8258112284d8c3a69146f0f801ee5dff9cf7d3695c9fe58da8186fc7764c5b2b1ca5d880b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51240c0952986a3e4c7f7b3f4192bc579
SHA1ba5dfe34107b52e89357bca9fa08ef33135941ea
SHA2560074dd45b1495932ae0679f45fd747ec4b40b1505f2be64cdd4794f1c1fb235a
SHA512dbd1952a1b33aa7d23678ae557bfa639a0e7ac3da716d33a62f913af0689672360cfe6a414fadef7a467ec0f7f22a4d91e1e00e1b9439aa46e99a2c8ef6b5bd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8d1ab9e19c773355dd96e37cd52a499
SHA1f2fbe7e18a26aee38900fad6074a762abeff48f6
SHA2566d15218a8cddd37e400ed46b46de7b296449cb4e27a9ea141f02236ebd268f4b
SHA512f54a285e5ce6b043412d7dea401b613b6bced8c6ae213ed3313d090ca2df4f805c07a37253fcf78add2ab4e2f3f9f8944d9a88c4fbe3eed9010575060e6b9b42
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a