Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
26df18af0df0d08603660e503cf675ce_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
26df18af0df0d08603660e503cf675ce_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
26df18af0df0d08603660e503cf675ce_JaffaCakes118.html
-
Size
460KB
-
MD5
26df18af0df0d08603660e503cf675ce
-
SHA1
0aa8000380994ecbe0e258022e78d0e6c942eb53
-
SHA256
556ec16b9cd8f20f920ce11cfa2467d968f67aaa65ea0e9907c989436576089e
-
SHA512
094f4e9e91ffe33321894cb7ec9fcb696c6af4f8ec90603929bd172f587fcccea3561f7bf04c00ed65484287b427dd562d20d2256848af68eb80ac217075ad25
-
SSDEEP
6144:SysMYod+X3oI+Y+sMYod+X3oI+YdsMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3+5d+X3T5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a18a6ed541f163b3156a4d69fdfae723ab4c6ff8c137356ae7914495ee093cec000000000e80000000020000200000006ccf3aaf2378c5138241a644dc55c4a5945aaeae0c2ef9c12e0f6029fdaafd8d20000000508123b39d98720a7ef3f76912a76269ab1c06d7543a85d632897ae176a9cfdf40000000e37ff620383de6e7bdb949cd5e95ef86eaa2ab727aecc2b8de720acc7be4c706eb47d4e053aac536bdd054dab78047d6e004f9be7d2e64f28bcbdfdee1a92695 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009244af426ab8150584ad59b6971dce63d4fa9058086e8b5daedd948978feb43f000000000e8000000002000020000000e49f1d2046eb8239736a10705d16be72f4082d90ffca78a029b789673d29423590000000343f912400630fae91e9a4bfcb1f63d0628182adf8714860980cd17a338f8cff436bf8f2dafda5061c72e3e3f5dc0dc764fdf20379a80fa6ccc3b496542775353767d0e0e49c7014cf3f4260e03f3d2e761e9f990d616aaa40bd4cb987bd5e731f88738ed8d7b82526617d2fde1f67b20cf382e14f23157fa70aa9f21852be99a88a5b1ccf003e99d06fdb21817ff03d40000000290231c82bd10374aaa883e70cf8eec3ac94c4bc30bbc6103421194a1573a18c0556753c136a59dcfcb44ebb5f34fb17e9970483a01c7ce279d750a36ff95080 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBE518E1-0D83-11EF-9387-E25BC60B6402} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501e79b490a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421366413" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2556 1936 iexplore.exe 28 PID 1936 wrote to memory of 2556 1936 iexplore.exe 28 PID 1936 wrote to memory of 2556 1936 iexplore.exe 28 PID 1936 wrote to memory of 2556 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26df18af0df0d08603660e503cf675ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5980422246264cef934d998b4326669af
SHA18bcc0382f0bfc702698ad565f1659f705e76e22f
SHA256085bce82ced3ddc9227ab4ee9ee11568c540e53e16fa1da6cdd6efa780b06d48
SHA5121f9b81f2066e723ca3e1a087315e6b33c48552fa0065ebf78167110986a031ee2f4109c02efe55380f7592a11c5f0fe80a7db9f37eee04ae08d8f4b382cbc9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56945a5406084150f7aa62cce94d891f4
SHA1adaf2263c700e268b13b4ebf4e720933ba70f2d4
SHA25638cada285809cbb1116d9a1aabaa872c251ee268d82588b1a08ebc98f5fb40f8
SHA512e2c6b48e821281cdb2c32f5d33e4abd4a1263ab45a1447d658d2069658c1f735bb17fa0dacc9f69db4a164a06d6975aa67413f4b340203a27427b6368364b08c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b024d80ea19344b9ae823d617a32ba0
SHA1a560924d877fbfed8b8b6581315937eec694cc55
SHA2561921bee8d0fb46d735c7dd5a54831f29a456529e193d72fb46f331b6052ff961
SHA512a9cb13fdb38ce09e1530101441632f5d7e61384fd00571d9b0060801a38806f0986d35c90b68b7793e1012c36ee6278015378253244003665e0bad8ab94341e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bcd512af66cff0f5d859a16ad71472f
SHA1191223259f6ae95b8565b011ff4dd60d02c52161
SHA2563453b96589be3f74958fe42b5bfbf662f312b46ad16b17f2146a98a9b9fd9a2b
SHA512d402e0d700b05d8572643bf0d7c7a489450ab7eee59d670f0a8e9e5b917e48f8b440d4351cd01a6809cd926f6c3020f26f41d3ff2ca7edf6049a52cca6dce8db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0d3df7a718211ab0d1aaa11c7c8f88b
SHA1af127ddec6a1079d1cfcb0b951a9365e083ab885
SHA2561f1f8faa3314bb20d9f5a7639dfcac595b9d0d97864b931ed5a2d33728c51377
SHA512fdb18da0630ef3c6a6fe0ff0d13e8035f08c5df8067c9a86820091002255e8bfa0f8aecfcebce2fe44b7c6c3a697955b46ef94dd5e2050202a6ddfbf5feb0772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bc0786c1baaafe187164519995ef100
SHA18dfddd81ca87c89a9e2a9469c82aee1003c512ba
SHA256ddb60e6cb66b6dc0b218c11ccd0c2a2b707a06c63ba39b0ce77ee7b49aec8266
SHA512c857678fcb8804339d75a2b22ccca2b9e4b0cd0dd3c70c9f3b15736754ba659fa61b4b0cf20664ada19cb823038324924e2a68a0b669ed59e3bf7baa1930426d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1698ea26069ef60588f7e5c8855b196
SHA1e1f5b0c80bebb0c33102e62bd173781340f9bdd3
SHA2561a2a0bba3d56159b7cbfc92fb7c1ae877bc35cdaababcb953e02aaedb4d9ceb0
SHA51280af4f301b32632922bf98477c23d2e098d29deb257c516987db0e453dbcaad2594a5b3d3ef7121540e1e16984256fc4ac94bfb1137c803f816ab8bffdf8111b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5934708d7e61268c733adbb2bd088b3b1
SHA1bc916052f1a1ed42a6e1f940238c01cb14752896
SHA25646585f51d7e86db54d6a090e6d123620a2607ac1409818f37c83bcff74e36150
SHA51287c55427c74f939a14a6e82758c4595086cf9342aabb0182111c51967c624cc972e1125b73fedbc54b7489abb478986d42fa039bef0a1c0b35efa5aa2095dbed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e5f577707b2745b9a9bda3f3fe7e223
SHA17b29a72c84cea9d0f78f2754cd1bb11d3f822054
SHA256dee56a9c774e2244e1f0cc6957f1aeadf4e10f7d4efce9918bc4c8a2b51e568e
SHA51235f641cdbcecbd463687a8eb5fdfc694e5a71cfcfbed063f17af2e871a6323acce42e5115fe5b2bcf5f9df23581eb69c3f3ad1309919b74542aa13ce2d33eb1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe9815b50661171eac102f078493d6e4
SHA1c23dbbc64d553967c6ac7af55fc7c0cbb38b44be
SHA2560468c19dc475cec613785aa9e3a494077c4a35ae85d1524154f8ab9f3e63c005
SHA51219fecd1767a90671534057841bb76fd16de396649dabfbf54930a467442bbb4f55d8d354136424a72fb91e8f52b2b0468c79d134f15b036c1b779a775c632e20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505996d2732373c424df45f76d2a5e7db
SHA1e2d2fbf109ba4e0bc9cd66ce385f16230c15114e
SHA25695ba299a6eff0e2b9300dec967a730b335698e6e552414feadef19ea97d1e1b6
SHA512f33c3814b37e46bc981f32084790b5909912aa89ba5e926f34c06112ea706421546f342898adac92b802b2c7f5f24b3279db97b77412950af97ed9082b2f5879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a7f61db58bdbfbc77ea46c55b746d59
SHA1e6dfbac187b3529dc4f9e335da41a60ddfcf59aa
SHA256ded2084823e6b2bf14eeb019640c6ac89ff0b5d4ec27de792d58f728918f9004
SHA512939645c36635150d4d08ded5b6504079d9fd2e6858869cebe17ab32da1e7d3d059281257db50a93e7158b229de356a4b5847da34d9127decee93e16867619853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe83a247a83bdc6f5cbc88d267c9895e
SHA1610bf72edb337f0191d9c4b97fe2a8211a753adb
SHA2562ccba49a2e04076c786448b7bf2804867aa47664c36d8b9551c00c6c709845f1
SHA512364aa9fc86abf36d0e3c9280c1b0bf3d086d36cbd61ab383e21da2c9d6f6e07caca146098ce89396b5e2cd05f57662fe11c8cb78cf58095baad469274105e3ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c89122f429e9e543a24f1fc9c8e47c2c
SHA189602cc8268c759663999c64b5e9f25cce878a64
SHA2560e694c3ce3311f8bd200d35f627708f5ad8c0b81bb11dc1f15717590f3fbf3e4
SHA512ce556374bf1b63f0086a6d99b53ffdd42055b24ca0dc3343285d8963a5b03fb351c1e80bf97964ec48cb080a76dd187d3792d194784807e33dca205df5b68342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcbfd9a088c669c39845640872bda459
SHA1c766a59535caca1c68f64aeed78a47b6bdceb27e
SHA2562d0bcc3858665ca5f4d14185a2bf22f1b4e83df14180dea9ca119a9732122878
SHA512cdddd7f1cd33ea5ad3431fd1d49788a54114ddd0cffd5eeffdfea0ebf614eb8c67630ac8256553dc64184f8789d5816818356803195a5ec1ae59ab22d3fcf965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccb37bdb1f544c556c7d33e8c9c184ea
SHA1ea5931297f11aeddb763861f439e413f319a28cd
SHA25661fd4433eb8dd400ebba1505caae1f7ce8bd38c634c45bcc43ba7a70100b57f1
SHA5120446c66d018e2f87b5a7f0cf1c6873ce95563072fac0be73f3a7792583bfac2758bc7f58bf4b2eef283027b35425598dc0617457b983cee24ab9468b31fe17d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5077d5094e811bd9dd2bcb2c2d15ad0f1
SHA1b802d9dd0770233044fea93767272865e18b49aa
SHA2563dd74f71e93c04e64614dd272a5eaa28392799849937af163c5805180b854209
SHA5127a239ebe4bcebd240e8dfaa395d77ecdb91ab6ec84fc95906f0dbc490291b5266bd5567b2ea16b25ac4c75f13898daaa2912e02a9fd87e677e9f02ae57d6e6f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec607b136c227b4e949db23077ae48b6
SHA11e3a9d0487b9a31db3d65a026be19f645e803d96
SHA25667804cb3b722e4b474e9df3e6d9bc22496fe7d617c39ce31ab5e419c363a6d84
SHA512cd4e11da2c0ce22c70eaa3305980b4c94b70de81a49320e9189739e5b13389c71e1969b20273a7f0054c94ce71942a6b019a492ca4eda649c6341ca2f9b8d60c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a