Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
2353518c819d65fff64ca3493fb615b4_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2353518c819d65fff64ca3493fb615b4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2353518c819d65fff64ca3493fb615b4_JaffaCakes118.html
-
Size
43KB
-
MD5
2353518c819d65fff64ca3493fb615b4
-
SHA1
00426d481ea7fceaaf15ce8e1950376dae84372f
-
SHA256
67d2182e7b77926053c328a40cbc6a70c468229bcb1e4fd3548215f352ffdd5d
-
SHA512
60a406ddc4f72da89a8d6b2f8feeca4c24e52eebab80f68771bbd404eed5ae84e96221a7bdbef095f09da21933f2500be32db89b6673c569c1790121ab8c90ec
-
SSDEEP
384:34X4879o6hUKzAPEeLaxcWCWrEZDOv4Z/JKosklkDYGI9fCqc5AzoMNVCfRJg:oXpX+KzA8bEBcU3nGI9frLCfRK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004f0b7754f4b56e52c52d9ddab18b08cf4ee95b5d1fbc4ba8911aafbdc522baaf000000000e8000000002000020000000953a22c14a16de0be973c683d8bd0facda4fcdc856c2408fc945b9f2b903035f200000003e0a287154570250f5ed9bd8a6268dc52fafb4cb8748de066e5cb672387cc8a340000000fee9e9c01e3bc5c43d85f157967fd112ff938447a852cfb062c9a99ddf9a4a4bc37df6c74c52844722f60ce0989c6f4305b26910cbe7e435d36c23e3db8786ee iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8F24EE1-0CF8-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000065839cac7fe5c1b0d6744418fc3aa8ee61886e8295669b7f545cf19b30e72db8000000000e800000000200002000000026186cd2c174a005c405ae4971ec60f022879cd71492c7b7ac0918b9578fb47d90000000b6fdce0925484fe433a2dcaec7bc39a92b6c246f424bd909311fcc7e897e79a2b3df7f7d1eb30ffbe2348411da4b4b4eeb967658c97327f54692c962b418e0f1ab341ab79d5f85ab4f8de9a7cfa8c6217842f3266e97beeb117ecfb05bc287df637387b977a20fcadc5747fa7bc516664ab2e33e78fde6f8bcc26fd765235e68ed0ad5fc349ba8441cf3bad028c512ab400000001d516fe10f17f224cf520ee271b50d0564d9e3ae689a955477698b5a3ba2394fb9941dbdd8e3842897c63dd115fef6f17e17bfaccb8302c83e1b7344df39ccf8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421306707" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000189de05a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2548 1732 iexplore.exe 28 PID 1732 wrote to memory of 2548 1732 iexplore.exe 28 PID 1732 wrote to memory of 2548 1732 iexplore.exe 28 PID 1732 wrote to memory of 2548 1732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2353518c819d65fff64ca3493fb615b4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556b3dcae93aebc30f3eeae3c2bd0a54d
SHA1807418f78a450b8664d085842975e8c55738296a
SHA256af12a8ed2d171f1c27f0e3f688e339244c48f39fd8fd87f88d30430ac641b18d
SHA512b02356a46d57807dc246912ff49178bcf5cf3bb6805b6cceba38963fe53b8c0b16930b3b6d3cdb6303a3ccbe8c4edbf129bb30772aa142ade1ae4660e78ab2fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c74bed23add2246e0384fb20dd00044a
SHA1b1f597cd6f6835c381285b1b61a8b70f297774ae
SHA2566f311f376910f9513c75b642b96c480196392f8fcadca88abc6f58599115db70
SHA51275ef0249da7ab80d2a307703dec4d0915c1295772e8fc27a2e33cfea5dede5247cc7cfc6fe118c1b479cae659dfe03d3287dcb08635f9634bedc419f15470e59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f12f690665c84061949599f193d624ab
SHA1647b5285857ea25df8c8541ef83397297b11993e
SHA25616d223cf2e50d7b01545a41a2e4922cc0e0b2ed34dfedfee8252957ca83992bc
SHA512ee02eba5d3ba2beed79e4e4a7da5628dcb1e243428ad4bc217956648d38d46e45ef6d1129051dbeb7f76dc72e37b09e7e0ddbf3158c1c8c79b065b09f89d4f07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1db54c5291c88354bca9ed0b245dfa3
SHA13eb6380e8caa173a0bb9043c07ac8b0fbaacd52e
SHA25677df479e370390e6bdbc8956448e88cd737fa1aeebc5afead12e3128cd60b6ce
SHA5120ef993a7d16bea2a0c9d05e9c82dd2cec9ca4700ec22bc9eb29d7ebf2dbd3544609720c72faa1de125bd34082aae55e6823c36ff6164535db2da26151dbd9fd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55345bbdf196aad961fa87acd3a6c6cae
SHA18106b24864959a62937ad49e1f5e6e6576ba64a0
SHA256d37e92476348be5a9ea41d763d424bb33681eca2527b049827488d640a16a338
SHA512d4cb99fa756d9f7c84ff9e4d6127b200c18fbca468c9deb1cd3b383f500edcbef4e73251c86183d26b8931c69969d89a400fa640e4a9bd2a871c79601800bce6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598f5f27a2ed27bad46ffe3e3aca4d705
SHA1b75ae9cc0b16531896b64a9db0c85ab381cf7cc4
SHA256c7119dec85df8218f91ac28cb5c8783cf660743c1a47ad3d025e2d9539be4243
SHA51284aceedc145a6b7f31588a2a0b2f745da4ff32fa2c42ba4bc24c0f02512a5641b69cc08128d74e1d7482b21980b04635591fafdff3dc48efc43c3534b0870478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc6a595db1e646a81a2c3cb33ce82ff7
SHA11db476bbee2838ae5be6bc9470f44a1071c249ec
SHA2565201885eb460d4b1178a13bc1d4fbaba8cf0052fa6929c55cad7f2827366d9ec
SHA51293b9eda6d3184561786cb12c242db259482397355809a5e3fae276aecc030a4fc0747cc42914541ae7d5fb8a72d0464d95817e372c3341229934e71eaedddc3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e58dbfa17f2f9572b9b96ea7a97f29a
SHA1265f7b44dc0ac7d7b11e4cb0d39a1d33dd4f1b2f
SHA25603c1000a27b8d324a173f2f86a982549ce54f85f4d7c808e71b6e1df467f3023
SHA51222fbf30c41092104b43b65d98f0283f71f452a6d4bb6c0db8bb921ae75a636df744b9e9e46394e0f66db498952b8a0acb6d9fa009bdca2383f1f74a8ea1f5673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b224e2e25e8fb5ee4fd0fc69ea914db
SHA19eddd9714e23c4a2fab1f61e182d0278a16bdab5
SHA256787927a2affc39e91e280f668ef3db31333108a7c671aa5781c8a7b545cced3e
SHA51211d3e7bfad19cf8f19a312ce46c047d3adcb5ca2ddca2d095f30f6f5d3037cca8200558bf79bd3b6729f256a76be1bdd8640f0c6488303acda1c32318a7ae962
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569cf07fb7778fd520641be6aad184af0
SHA1b08b82fdfe3340aaffd59a5f563f8d9e588a97e5
SHA256bb1d6e8aaf70d637e81587d006153eb2239ab6bf86bfb849cc7b1e6a49112d3b
SHA512267e55b0bbf953e4d8690279992d521ddc8e28878f4b274313328502e77e71500aafdc0a30994f8b0b2fc83a7d084a26b2cd6e8e276458991f56e819ad0d1d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509f04166ba6a372436fa7a09251c8424
SHA1c82592a7a4df2c1a5cca612beaed95d83014a7c8
SHA2563a86b35a6189a110ea9b297390ac7c3cfbf3ed56b4ba25a2710170dd3b847ff2
SHA51289ff9b59f115fc9b38439ee6d84d9a27a3c07d9f54ff2d2f7ab523a323f26140a382600c15a85a9a23806cb8d610197375ac76df8a59e97c138fc8ae3c8562c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa2e38b33b9666283af2fbb80b19c98d
SHA1feba6ea6d68fb30b3eedadfe4a1868da5e8bf173
SHA256ca182dfb7ea0ceef6d32804660719e9b39cdd63a781260792c4b97a5920b4622
SHA512935ddc9df2df07a14b42dae7d92aa6bde524b297b3753b5e1f86e45ccce698249a27e17f25430425272b59dad7fcedc440cc49aefe1c020b975fc554557668a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9acb7a439d5fb53e95010575e49a485
SHA1d145b7ec7673aef5f74f42cdc5cf6ec0173cb3dd
SHA2561844154afc5051fed06443dff542f63bac4234764c1a4ed133b580fd92e97493
SHA512725ad4a5332b7339c99dee5f51561444099ab4c7fc2f747992dc3bea7f9d4c4e9286b4732a856d06001b7bb262dda8489994d218b14057ff68a41e402dac1ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597492dc97851f8531c7d7793d655323f
SHA17c3364826b081c71c79cf9d41d5812d493cea343
SHA256570e7db56d5edaa82dc84f24164e2986dea43719855bbdd67286a03fc2ca870e
SHA512fbcca085e417a84f624f77330e43e708b410565ff9f13f12cf12bc8536f2d438ffe11c852772c5d1df09507b7a7e46f92d12922e0bd3fdde1ffc1b75bb653ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ec7c3ec1c1b441dd7af37a3dde2501b
SHA1d1387b7bb1559dcba6304c70ffdf993eec80d395
SHA256dcedb1798b9a316e7646d5e220db052ba7698e55d7a54cc885b3fa5e0fc27fb0
SHA5128b26a9bcb73d9ce47b722322bc29a9fa0525663dbd7b483a1c6e0e6f8077af7ca44e51ccddc6b7c0e081b9175ef27fef0ecf6a6b3e923d95e99901d4d89c7243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c32a06f06e835de15ecbfa8b87b9e63
SHA18ea9a8cc1dbe23050dcdd01acf2feaff29df34a8
SHA2562d2d327978fc40f866aac970ebba43bf74bebae403e9328525955a59e6786dab
SHA512e29aa2076088c5c48bbdcb58ee63d3caba18cb40e8a69aea1fc445c978ddc741d90baa4c5d3a2d78a09c1a8f5bcb7b194ec9d821e3c4898b3168a8b0fad4fcfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edc141f6b899fd935d0a74956ac21824
SHA1d00a272430213bd2a0c6ce9eeb04d3c8055d63de
SHA256b77224a51a26d54590611b66f31be9bf62669ec962d17264f63f7e748a2056bf
SHA51286f145076fd397750a429bc7881f319006751400bd5bc333d7e08f693cc31f502b3f974287bd7f700c5ad30e764743303c02493f3ec76d9349736ea73d7520cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9bbac6f2e368df804d02a26a18ac2b6
SHA1d092457669ea8bdb9051364025896f88ae7dd06d
SHA2569e81b7bbc77a8c261e8b0caacc457f48f825adb17e88ecb3bbd1817dc77a6cd7
SHA512fbfb5ea8c5e6b3033efe2102f817cc4cd879a17a85a4db22037d01efcd060e743fedb309475af1c8541f9ad67d684af7f260df448f4a1e243993153cdf54b3a2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a