Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
23719d1338cb164c094528b39c0a6e61_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23719d1338cb164c094528b39c0a6e61_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
23719d1338cb164c094528b39c0a6e61_JaffaCakes118.html
-
Size
2KB
-
MD5
23719d1338cb164c094528b39c0a6e61
-
SHA1
6458c9ef8bfb405e264f5e28650a22ec37257b18
-
SHA256
664474a07c935e8b2bdfd758ceb191c98fb86d09c5d84e159cf9c77c573852c2
-
SHA512
cfffa8ab33ae24470de3d796c9274df1c83d64c791dc7b798a95a304351516b7b5cc1bf645cc5bd7125127bcc4fc01c55a020bbff407825d858c342d0789bb38
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{971F8821-0CFD-11EF-9966-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b154959fef7e8b38204255f6ada745ebad81e9d3b4d2fe52acaf6acc9de78c06000000000e8000000002000020000000d886b61f8b8a41bbe13cd3f5997434d0e6c97cb2c2e5a6ea09c3355b53aeb32520000000d6e8025ab4eb8ad3f2dc781fa0c73b3c6e3f70c52d06057b0229be5690326c60400000006c10692d5f7ef8befa4a59985adbf5394955e2d3c270c07e77f9043c10a25d12162bbe2c467db0551fa06ed9a91e04608aec73576269062a89a307d7b1081039 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421308745" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308ae36b0aa1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008627c0f6d9f42096293b35aa3540b8f8a6863e90bdda79c7d217b60a2ac974c6000000000e8000000002000020000000fa5155abfbec9e081c0dea27dc17fc08e03d9e3e78cc24df08c21e5420954a5a900000000ec0ffe0fc4e264eaf7dbadd7cba68fed07f24d0c43d6e922d681796799706c9419be238124e11c9a5cee6e0ee25eeb47f6ca43306718327b41474ffdc1962dfda0031cb08b7785084c1c15b0b7fbe0669525676d3f271fdd4287d86a6a286e5144b7754c5539da44ab880165f4a4ec332cd9885ac21f76e01a01ab1816d73e451d495a2b11028153a561c401f29c2b7400000006fa1db8f872cdec44321277eedbd0eef8237bc927ef04cf83c50cd7ca8e3f6450e079fdb3d69edbf61f4f8c1a98e696650c6a8b78a9685f13e95773d170f7291 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2480 2164 iexplore.exe 28 PID 2164 wrote to memory of 2480 2164 iexplore.exe 28 PID 2164 wrote to memory of 2480 2164 iexplore.exe 28 PID 2164 wrote to memory of 2480 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23719d1338cb164c094528b39c0a6e61_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539d97bdf0cc2ade999cbc5227064a9d3
SHA1106fb738e3d669e72fade9607a4a02080823214f
SHA25684ea3b5902d9c75d3143a523772cd241868aab8f26732e311b64f7a0a9d7d0e1
SHA512ff6aff50a428bc10d223d1ab04d87fa209ee839f4448de45d2d180cfd50fe2d88b613be0045133783b53a4452adefcfab14cbf8744689c4b1f83424bd926b518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5374c26d25b00f8433765247d9c193cbb
SHA14798ce846600e12e257f5ba130219f3d0625fdc3
SHA2565c42b035946892b4e765b692859cec2acf26cc1a82af22f817543d80571284df
SHA512e18275e6e8f4e059c4066a3d142a584e4bf190dd37277307ed8544b9d29af2c7d7991fe7a2f29b26135f68add1310248664dbc2489c0e460f893bb5034585c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bab4fda8b46c484f38b992492df6effc
SHA1decfa7fc93de740999b60aeb65edaca416df222e
SHA256b0ba0f678ba8a1e3e1a3d93f2f49f00147b5c91f190fb183aad51541732038a6
SHA512a0d59d2b70c1f16091345d1915a2b9aa9defca4652cfea711cede960a52d0cf8dedc7089f6ac6696d37cd1e55dcdaef06038ce42b69f77d740a98000808a8f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b61d350c1d3aae7116c8e01af36eeef7
SHA1fee5625e7ee21df60051e683bf2b48705ea78026
SHA256f6b43bc8c26b664444dae4028a3a714834f319ed1c568ab1976f0312869d08d3
SHA5127e514b162bacb7bb721d86742819331f2a293871fba532413ee6ee5be4e1608cbd796fd4eb789db718ef18b48823d080426ee20d6f36e72963b0b4b77343a5ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b77cb3da35b33cdd67b1daf99a12c0fd
SHA1cbfa75dc378d3aeb0149108e91e023b5833903f1
SHA256dab799a55ee8b3e99e7154632f987334679187f28828cdc4ac8765082f32ca2a
SHA512c2867ea5bdaa179473bc80356f77d892c13eac7bcc1a52fea2341ea24593e7840e23829694f1a5d409c9d49e0930b7b8e8b99d1efb8b18f0147d74a1b6f6c805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fd4a93a4723ec12b7d843f39eb61b01
SHA10a732b347c1ccadf17465243d94bb1b6de21fef0
SHA25618adad2294100520c781239b92ee480c78a17e3205b37e9dd7d8b374d25d41f7
SHA51283076dd4f15687aaf6ee3059333af82ff3084594da54ec7c878567d62cf652cee239ee015d3409e4556da8ad570d7b850cf8e3d34d09f5669f7bcb71c16ba833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2512b51f70f2274b9af58395fc6ded5
SHA1109e5f9444ad983c770288d475178be2fcb533ca
SHA256315940a4f19b77d9a378cb3de9f981f77dd9aef9eda78dada4f806d5ef2f56b0
SHA512d88b8654474b0f8670187dd5934fb360e246b23162a81927f3c3f7199d04c06d008de98f92342a0f813591881fa98e57d9f7a2e2f34c5bab7ad8050a9fd51864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57726c4b9a87e2f42d2aa2248de3b1723
SHA1ca764671078b9f24818970c32becaf786937c50b
SHA256dfd4810beb7eabfd6c2c95c3a5bf9ec581ec3b18447f6c918f8e2eb1fea98e16
SHA512474835d1b1b279d776e1638540c6b860fe630bbd4449828c7c666a4d2f5fb128de9a9e31e9e98f6fc19348f039543e3c25bf99363f1a943df7946c248837a80e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7795ea30ffe619da5aa1b298e2073d5
SHA15d67c6e38a917ba1efd60e95b9594bea01126805
SHA256946e2626844b745b19dcd3fc9de6317180f27b75ec9658b4768d3ef7973eb539
SHA512b08d0212367ef116317864fa00be8175c2e9bda412bad47ed623eeb3d9f4eb6183b20ce6e60602e88d43d56433d04417c9efb4d17318677723f28d93bccdad14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519ccbe0a8af644cb8190f51f85375dd7
SHA1fc1b951097befd7c885d3bb7bf2a37abdc81e4f2
SHA2564bb34dc53709a63d8d287b95bbea66f70d61ce3a724ab22d85948f09276049b5
SHA512a324673ee89fee8099f1172697b232f4adf7f6ef8ca9f05cbfbcf549134cbee79d99859e031f1a6981c18b5729afc8117fce9bdf50a2c7e9ee46052f8ec8956a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51880a9e74c249e8921eb7d6a8874a0e9
SHA1a7e84948c431f31add581f6c6772260a793fc985
SHA25674fe753db8d5135111f8c384e078363a032b413eccf9c73eef54b845a3ce34b7
SHA51204ba96ad9fa91859cf4202cb819789d16545ce5f434b66173d4d301113cac3c8c541ebc019392ab0fa498dfae80931d23a0342366162e17e9cb1b0510d83e769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f41df6bd1d632417b6d206201149dc1b
SHA174fc9d47c1e7f3943fd4ce403a413d993a1d1a1b
SHA2564fc51b6d5452804cc3d803a07c60d2e7d3c8c3c9250fdee3539b95360d140d46
SHA512a5fa6540eef4fb68ff59044df8be5f6f75942a49d5dcbc42aac6e506a02cf5d58b1e97d39901679cbef7db12fd8c8715d9a32d0d01ae3048485a50c586c86b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1ed12d7058ff261e05e9e71d342a1a6
SHA18c2c442c0869d8fe4c97f004b161ce207cd6f1ed
SHA256a87bbdd73a24be0c0babb39ef7a41559824a59518a01ca2d735c4942e3472177
SHA512d668bf3172e59e57374cddd9d9dff859a0ed996a11508ba81c76d2f1f23406d1356ae947376e5066554f6c5a9dc892418c262eda3fa79e05ff694d42e04728d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e474136e668b6c71d99e62429f3c20a0
SHA13a0c82c2155d4e2c9a4fc9e5eb56e33165ccd8e9
SHA2567300d93bef3f1f4669f439d04451f31cc2401417af4b64ccc49a318994a6c52b
SHA5123767cb93fc89bf54ef5bde54b705847a885c6e54cdc799b27db54329e0792a55ac6f11858002ddd8c4349c8decb99c9779a5e19994a19d7a6f63de692aa63f61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f8e9fe7a1ae773e72c8c9a9bc2b0b00
SHA159524c00cff6547359d95e7539f5d30b257eb115
SHA256baba2577fdd3a2d75f5385b67827c64103cf03eb72814353603180b391f96183
SHA512c19d51683dcf895e86a339ea4c5116cac91f6da5d1362d5d617988426683c1e7fe300559b8e4d092bdc172364155a964d154c3f7783861e8456271d432ad50b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b0aee1e9adfd59a227f3a0009e3f888
SHA113024f916283ee375ee482ee1e8594aa6a7911c1
SHA256cc747fe58c028ac070df1319b7a48e986b96a10a2e8d18df20ef6b9d4834eeb1
SHA512555ac3539ee6d7bf6e561bd14a8e10db8def9f5355b335f54964be8905851ca95c74ed21ce6c26af4e4715c6a0488727a7fc3a836a3eccd7c04b0dbb93c233ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554f4c914ee9385a1f98899655f7fe936
SHA10379e051f5ce99c3966170b46ce29d20324ee950
SHA256c38bf591c78c29a474a242d953ad71aa0112e5e4f172949eacc8b63c0edd3733
SHA512a6b57a1c39892a776bd4931be3f62b52a48c6791d5e269dbb16b078a9f41173092f26d2738d6bf4baa2ef680b5bab68608a422711b1d6491775b4c9de33b345e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7b4fad851aed93a778514f3ef3d5e18
SHA112b3671e998a5df79d6c53496a809c8550665dc9
SHA256e50a59ec6372553e5e6b61abc364638d355a586c15b256cffb88947af0e1bbaa
SHA512316caff15edcf2a8455f8f6adbfabd412859a78789b5f7ace89ee816974254f3dfcc0426a6312e75833d9e51966fe3dfb97d792d7a97def2e29cbdcaa9ae7351
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a