Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 07:01
Static task
static1
Behavioral task
behavioral1
Sample
1fd0097f1caa27e04f3a069425696e2f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fd0097f1caa27e04f3a069425696e2f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1fd0097f1caa27e04f3a069425696e2f_JaffaCakes118.html
-
Size
460KB
-
MD5
1fd0097f1caa27e04f3a069425696e2f
-
SHA1
19ff6accdd088b13c1e28752261b527b82512c0d
-
SHA256
ff77b73e2bcf8de6f632d9723288bd1a59069b64c0e69fadd3bbdc90c4b7c6a5
-
SHA512
cb0972494badd31fcf352a91e013dd0a8f9145472387e0636d57f88e136c921b8873ea6ae46f32e13a799a633bb4beb55a4464b9a3386a34f5f7d8f4237e0c7a
-
SSDEEP
6144:SdsMYod+X3oI+YssMYod+X3oI+YCsMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X3c5d+X3+5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506782754ca0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421227151" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009f3a06cd4d536ea0e55e0277c1c3b6808d61f53d800f2155edcd4fd981382676000000000e8000000002000020000000a00c83c8b16b8099132fe869a60463b3a01c82d0d47b0d07aad2cc2e6831169720000000585ff2602123b2ac1a0e10f1a11728746a2f65ae969d20d6741cda30db6a43b240000000c8f0781700f9b9793cfa6de1d5306d0b28bd15a446fad6f5ce30b8049157b8eac003ec78ee2e0a6767a1a12564a8474ebd6eff9a800e85c7f3ffbd3edf0d66da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000858406b887f586d017f13da9ccbee3f74ce3f0ac44fc5e4cdd6e40e579bc3273000000000e800000000200002000000019b7582793e06ef9e975fd26b755ed0663e298d5d7e7c05ecaa6f341bf5a0ea390000000c9299cecd09143f0c7b863a2f1ea393fef09d48df8ed4268033871b1f408a7c7f5f5de95d064e700aa52a8b57cde427257eecccfc2eb81c35755333b43f5e92e5d423e260024fb2acdf6a11380b304a5de6abca4814a7f3ff58c5cfac55b3e22e706377b6e0c9116d8a8486ad11fb0eaa4ecf59602c18b2ef5b656ed46729dc21c4980db46427df92af212b885847d8e40000000495d592f470828af3fa10c7f4cd0e96633d97ddd49af5fbb4d4a176f03206b9bf32ac055dfac1cc59e0b0a7d2be6b393ae92c6316de117dac184cbc5aaa948b3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CAD9FC1-0C3F-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2812 iexplore.exe 2812 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2816 2812 iexplore.exe 28 PID 2812 wrote to memory of 2816 2812 iexplore.exe 28 PID 2812 wrote to memory of 2816 2812 iexplore.exe 28 PID 2812 wrote to memory of 2816 2812 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fd0097f1caa27e04f3a069425696e2f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e9226e33dbcedcbe962523a3fdafa8b
SHA15d962b102e0b240d2d133f250db41ee9d90e7924
SHA256204b82393fb4863794e104de63609416597a84a7af7626b3cc3b081f5c15e06d
SHA512b81e94b5e27f9f7ed037744dcc53342fcb40623030f112baf367549c2f2404c1f9e6799d64a4cd076a4223b69b888cc4dfacfa291783707b45d23129ffe64fe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab2f5c479f817dc84e9bbca0089d0420
SHA148197a4ff7e080ec5e786ca0bda45d3f2c21446a
SHA25648b8363255873774158492a864c2bfacfb0557ccedb96072ccd1ad48672d6cf1
SHA512ece4df7dd4e42e334caf550eb75e0c4da31ba7b700fc7bee6998597ef272560af63c072a750abad7b24299f8fd45c8cc08c44fc63da969743d6567b1d8e9a9df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533c775888bb88ee326eaf34f15df4519
SHA13e20685ad92c717e6f991ac47090d5497fe22975
SHA256352162222707a46cd74fc744292271282d606d592f1e16f0ffba51181c402b1e
SHA512951ecc3c79fea618c28e3b21eb4eb1e107dccec6672973af79dfbdcecaa108d91e37a4f6e5bd128482cfdade9a80be7520b5bcfcaf33e3f68118307602b13431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5635bd1b79f389a9bcfb76a1b9daa0629
SHA1e760ada113af0ee8e7ae229824e14274b1bea6eb
SHA256187b13d6cdfba3b866a2b37c01ad56d20e22c3d9c1fc5a9303386630bcac6dae
SHA5129b433fa3745f9b07abc0a942ac4f22610283cf71d60869a39c1ea468ee04e2611b46b273cb671db988f6d833df9f566f5c96cc0578e88f7f0f5c52ad0b158647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52879ecb5444ed13437064dbbc322ba80
SHA1c1a4460685552c3577deedd6baf07d9889209a34
SHA256ce031ed184a25eb88b5a8c7d8fc78105a2cd6ca899c859b618c79eb1034939aa
SHA512eab564f588cdeebca109694be54e880e75981988987f2e8846358f2406c1799c4820fef11cf5632f224c93ab302686a1371f8f1923d0a9f272ea18bb159ca1d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b09fbef97c675c65d88ac06f544f46a2
SHA1ec4760743f2e6b84bf29eb12826bd12b2f95e309
SHA256c252afa8a5fee2cd7793d7794b401a8643b62161e668a94cb0f7b501eeca5830
SHA512c52a44bf09c84991e4b2307224dbf77a2c108297720847c44b9c7477538439eebe3abb8569f86d4f1f5d6e30cc10377166b23a584b549a1073e148148401fb9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5250570dcbe6fd5328f6d85282b9bc97c
SHA1c76d40ce59dd3b40b8bc81a79e1588606fe0b9a2
SHA2567a70ed9c316e413709258c7c9d83bda2309eb8fcbe583f6b55c026e88c4b7750
SHA5125b226408c7e8468870f9dd2170a2728d07d3c78c4cde5aee1f1fdccee312e58801a500e36139d7f0d4531be387e680de49af9cf9276f07e744eb67abf83e0ecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f1a5663a6278e24d6dd04d295bae94
SHA1871233a441c641b9f8ea6604b6f6da27f152e139
SHA25665b084b28d666253a46d6dfb928126fe252d80cb4e69bd0667fa6839684475cf
SHA512e93c0b697761ecb736f5d2da71ada8ef4276227feac910f5ab6d5fba2874735ee6aa2f11eb10bdfad3ea1ed4742604732e00586f535bc558788457fc85a2892a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5976b65074d3ebf327d8cab541b89b622
SHA1ab075abc9272329a58305f5e69375a05e9284404
SHA2561a74d7dfee814880cb567d6f659c15a37c46e7d0faa4b31cb7d570ba3e02e3ba
SHA5120bc8a5d98c8ef90c6726a285c10260282df2fd2824a27c94172e5f057bbbc7fd0b7789febcaba2b6538003157ee8ee100ee991c858ad1dd86062b10d8f783c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539e704ee5b04fddffbe78eadfbaa88e3
SHA1afdd764794473715e79e78baf8293be225bc7020
SHA2569597a2920de9304f100646e1ad404380f29587550c8a3c7c27dd5737766a8306
SHA512cb9761fa5989df0b8238504ea178b2453d4d2dbad08fe7b57f708d55e1b12f8ef03d475cd7ad08f19a6975ccf12f2f1eca8045f0a313705d9d30b4b43e94d9e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5099f93f400c23b99a3f624934a7a9ecd
SHA1b86b51f39b1b42ecfeb9e0ed29761ac4f0558cfe
SHA256e42cfa09789529d1c0e36d3a2503d27a6c8d3f2fa347e81a7e59b91e944a9192
SHA5125ddd0d5bfb01dc7e4db5da0fd0e81aeb1e26d7182c9c2ca049eaca56230d002ef4b028df126c973744ac0e70ed1b19e41dbf56a693fe34181fb69310df19b354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a5dedb4dac7b688d0676ab29f47825f
SHA191a0867e227593d19825a2fe919478d308eec1c4
SHA25654687efa5938e67069fc332448f03752d88cb0a26901d5ff6cdfbaf90887c40f
SHA512dad9c452bb18fbf88bff60de8abc9b35684895cacc793e59f5f7ff2cc9cc154b4b7b03fed26357fd5fc4c5ff6bf31152915ac773013b097c2e61acb38ccd5277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd00bc87322c660e8b59f009769f80f
SHA163befce3696412c2a07a4ac397318e790b443209
SHA25638621c9634e2e2e33ce3bba7e249173f469f0841472b5938de208ae4b2bf2ada
SHA51280fc2d94e63d75018f6307396c7bad8e2048375cfedd98fc47938d7c1920cfb6936a6632ac975a489cc196394dad50694a83ee27ef325e6c83305bd9b3a8eee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b4cf8d397c405c99efffb41f6759ae3
SHA1be26b113dc3aae4c49662ed36fbe07f8ed5cdf4b
SHA256fbc35fbd242643de181dafb7480860873a0d0c46750eb27cf565cb26be42be40
SHA512c3c5f96c76799a60c493eb41d2aa5c885174c2c7e18f8017193fdfdd23bd3a5fe08bf3ef24acff7054946d3d3c1b2c5aa49d0d051195efba4b514f10cdbc933d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c75a268b33f33fb057d47371766edae
SHA1f755d862b8ba6856abc946e8165b5c00f8620382
SHA256b48bd235fa1c38062e9714bfd5ecf70f4bcfe2ce4dd826397d93672f45c7544b
SHA512aeeaec7c6726ab4529ad5d15a1512a9bc8de4116fe3ca03803d27c0edf1bb2a800e7bb908e8bbc57df61ed0a6818b02a21f349bb11ef5d54ca332572d6498cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecf89b212e68197b2a68a7dc9e9726eb
SHA10ed3efd6619eb675e9ecd9ee4a302bd1306ce77d
SHA2565a1f68faecbdfa81fad18d1a7f44ea833daf25bb73a39f5d3d6152d7c0b02940
SHA512ebb4fec932d3266f405d8605afb0848f0c295339715cf394841cc874b585bd865b4ce026f9945dc5d89afd83bb2519652d081e0f3fa83fbbf5e53b816f2ab477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fda6e1097585df2aa310707ec621c4db
SHA19244fd4fea524ddcc39bf7ca17ed49e0ee8be7fe
SHA2560971b145de07e9e5c49e2ec2b4051c37a7cd3afbf59c13e43e892d650d96426c
SHA51283f1079ec5617bf64cf5d6093c36d24a78db1566da177530b6edc743b3c69f558847a225d13be6048adf201ac25b51301aeead7d81a8cd3959a2bff6f869e979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5573eed312e7765228276d010aef5c098
SHA11ccb5bcbbd9dc74d02fad4863c9d2cb7042e07da
SHA2561ccef6deefcc9e7c5757d127776fed6cacbfdab86907f16953bbe9a629c2aa59
SHA51279701b6ecea50fc9da0b5d422d0f92110b75e3409c21e1d85904d780813e710225362b3d9adec8c7cd3f50a1d3c3353b4776800941f152f47e51f753b27f12fa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a