Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
253258d135a2d79e56fb637aca4fb99e_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
253258d135a2d79e56fb637aca4fb99e_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
253258d135a2d79e56fb637aca4fb99e_JaffaCakes118.html
-
Size
34KB
-
MD5
253258d135a2d79e56fb637aca4fb99e
-
SHA1
d96f895fa80e567ea032636b5ec8779f5b1b4560
-
SHA256
e2cdfc73ef553c1ac4fd1650a4e6c06637ff8fe1c1be734ae09e85c76f471c00
-
SHA512
a6fcbc4467384245355296665ed88e8ee200b958a0a32f5bb8a6d3b3694aa20aae8ddc3f676812d7c2606e73fd13e4bd77974a4b5a4a4d4194a2acd11d01f8fc
-
SSDEEP
384:g9euTQDmkaAPAvtdbsb32/1jR5Va9vr5dLicIHKK:g9eudi4vtdb83iedLicIHr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421339097" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42489931-0D44-11EF-84D8-C2F93164A635} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f087421751a1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000088bce8a8e3bcb878ea93e648f22bd72c2fdc006c3586ccb0c4f6a44fe9860ce5000000000e800000000200002000000013a71536ed4a68cacce7cd5d47072851320040da9bb67f91a7f6dea4b96a17c390000000af8bad27f6ab0b311738cfbd9679cc0f4efaaa93053e782927724bd6bbc5eda958736028a9d5a26cb32631f7bc4f96fe62c62047b29b5d68d24dda91d2fbb2bd54bc45f7b1f3bc5ee6624247249602f51e2b535041965ca062b8939cb8402cc29bc1372df9eb96c71791fea7b5b85731f757243864fe38d062c5efcdd9ba8f67b18069c1acef4cbc3adc192a77c57a8f400000004c4f3e04f59f2fd35201ea4f97e2d80626f74f5d7e4316f1ee2d3105a7d7af50636be878ea8e6b2ee357ea9c70a9488fbc01ff4db674edef5ead53e5253c549f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007f6efd4a7ce191d361b191530cbce2c8cca5e3d8dc5eb0989c4f0d10ec703dbb000000000e800000000200002000000091f3e5adec04144823701bae1cebbc444c364b85d3fdc1c7019f1031cd55efea2000000077a466cbf692b99c494659fa65d36760c963daf87d609cfcbe2b64f39c64cec2400000006b7ad5c52418ebd6a55682062a3dee766eea680f9f39b090219632b5cd22d7be90e7a319e8b3040d361fcefff4f2efeb4ceba6450c9778c841fb14163500ca80 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1968 iexplore.exe 1968 iexplore.exe 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE 2580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2580 1968 iexplore.exe 28 PID 1968 wrote to memory of 2580 1968 iexplore.exe 28 PID 1968 wrote to memory of 2580 1968 iexplore.exe 28 PID 1968 wrote to memory of 2580 1968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\253258d135a2d79e56fb637aca4fb99e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54532c92785367573d519fb10456eb649
SHA1630f93eb4ab01625bbdc536321967f55fb8ce67d
SHA2564d85e06ec2b9a039ec1ec5bd17c34a366bb9d5c02ceefeb09c178e03dbe909ef
SHA512b61898f417e12e06787e7a859f70c97ff8bf090ceb333c935491bb0e6e41aff605d8ec12153c6e52783754f78703e92e8d87aea8ee66a59aeb07c166218e9224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545ccb55f4d03e340b9663c7f3c0428e8
SHA1684ee8dbc875c3502b1b99adf160cc33b2dd9b42
SHA256bb957c6fdc922527f1f8b6edac41349609f76dec3923810803471d034f85829e
SHA512e3e3fd3c0410623e6303a68902268c32e3884e0488f34b5c17ae307b38a5b42888e0c9f1a53215058b57db1e9a21eb170307c8eb27313351c14d913124bbca75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5359911c4f7406cd0cbe922b769cf5403
SHA1965521cfdd6fac523cdd76eef6974bf641dd8255
SHA25698173952911eef540d0419941e65e46018bc072f0eb2d039ccccf95e360d301c
SHA5121bfe2960c59039ee53969d36fd871a5f9e574af1dff8b64d95545953fd0ca3858b69f8bdf7925de2f576614225b57f37bbeeaf25f7e06b1bf5f139a95e0ef53c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509873cc2b50b29a663611f7bdbfa47ea
SHA14bf358dad5417e69264b73db78add653e0fc4e8d
SHA256ea9010a05f16627069faeea5326b8c96bed37edc1016ab6426ef19c9e23bd5b7
SHA512ee666a7c45bdc56a2352d0ff4166770d149869d8da6e5f42d3a7a9708156ee8af573f731f58121ba823de237bfe2027c50085e6c46cea27e69ca527e2eeaba11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0fa7dc20fa1f596b1aa2f49a2c8ee9d
SHA1850d7346a98151f9c80fddd9e7f98d278085d7d8
SHA256d24eaa91ce6ba788ae93c2778fc0a89bf38a1d689ab9bd8796d6052d289c6676
SHA512809701a3b71636b83dfce1f6d852cb870b801acdde2eaf53e39468da34e2df9f2cf349ca2b396b57666660bad65fb35e43ca88bf41e21eaef44894bde0d23488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c14e973a18d2d2ee2b9c32b46190f95
SHA16a7a6b370562501002bd1a68e4c02f79afdc4318
SHA2569fcf1693d2acdaa0d5cdb943da83cea88277e68a16463728acd613e7620bf211
SHA5129072d33698db56880549f529613599aad666a7592daeed352f42de75963304f19f7434ca3113fc842a4131d642bea1c27b35c6427d15bfd77b61ed709dec7461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c072044da598a348c8c55aef4718b3c
SHA1a29edd2c2aa4393f230b7e1be6b7d457174a3663
SHA2562c056fc3a16b43fc42ac9292d121e40caf0511a9c89ef86fbcf094976b3bc669
SHA51273176e34876f8600571d7ebd11d6773c617b977ca3a7e8db0346d5c87b048e16449fcaf90e530dab0a2d2050aef797bb628b90309a0df6a7d8962a5f23dc8533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cf0df95eec322a4d82d5f42f1f87edd
SHA145f1cbdf8955fc55dfe8c4cd701b9e8790b808db
SHA256d2bd1a4145023329a6e9e2db67a5255e29d15c66dd0d0f3e5b686dd8e047d194
SHA51248846b29b9db986ba5a91801ed85617aced02c2e42b8fe56314cc4d5357d616d286cf4b83e1999bfbeca523f4e758aafea573aba5fdaf404cd394295771b9f92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5056d802083f0341a31321b6ae50bdc64
SHA131fca269aa101e3ecf2db8575586208cd787c67a
SHA256a8725cf489946e2c8e1d0d2102157a4dd4f70af5f8c57213d66b557d0242dbb9
SHA51265c7de2dd5cf74ba075c5db2f2028ae905e0aa933fa9479d8a48833e669536f71b21660f7357a78128ed191ff375b915e074d113e36b359134c84b65859d407e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e4751fa2b9205b83fbf7c2d99a2808c
SHA11e9870b57a3a23183437c101be8fdfb0a50cc3a5
SHA256657d1972b9fc3d7db3f180a013690bff9e5938b3adce51ac041c75cb09ee09a1
SHA512bc99730c83b92b76c6335375d9f659e59fe6b71165f511345b1d47b66d4f69c9f42443b85f5d8102fe517eb567ff8eda9ac40064369b2d29dcf56841e7d01d65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596dada906670eb40805f12e8b88b019e
SHA1e200295da30ce3acfa5fa648f8c8ce577e0f0404
SHA2567867a6da85a56a5e36ec864ba20fcfdde1527ddc74c16025821addf2a93a2e5a
SHA51271b5134fc442196f0148d24f1327b46712c27958fa2d911b260556595b53a39362eeb3b0b0ba979bb069d8559c1efbaea7c9d11b05554267709054b83191bcf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab8f73daaf500dd8519bb9849f311fb2
SHA123129c8bc560a1fa6da2bf81767569807fe6ee72
SHA25677b3f9de50d97cbef3b7b24f924e39c33dc92dff11c7154859eed8c3e7e2d6b2
SHA5124f9dee56b5f32d9dfcec927f8241eabf7ec0284a727529d30e8c2ab697a7147c0affe331278fd9a92f9a7e0aad4ef816e815c0f298df828f2985fb5f10c00985
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5424ceb91bc0261adf01c4b01beb97519
SHA16ecd33ef974ca6a92dcaede649e2c181e3a1fbb4
SHA25679ceb1f6b7172c7238e3ed52f1425b78bea244493f928db8d774b6d6230a2e2e
SHA512f33cfb7bcc8c2a176b23484b717a174961892a340eb8389f636bb75b307c3d5061cd146d959b6aff8ae4d37700925f270b53ab0ac4288effb8fdf3e18e59c558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5729caac84395da8d65e5fd4e79ee7fc1
SHA1ce2fc5e3882a168c23184413d7605ee6b23f37d1
SHA256ea14c6f55160fc9db54e8fa9cdfc9eac8760e469ca8d3ed9519f7e66294f7307
SHA512aa5cc7f1a86252854f6bc14d9f8c64fe2623ed43390664ff2f2bc6d34c3c120fe63671b1705e3b2640c56575055aa75e3e9eb138b91c4cf54a51bd5367bba8ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d30816c696fa9062c171dda64300a97a
SHA183a73c224a51727191cf650a629fb22f331f3d3d
SHA256945de33d0278fd0b7e04ad32870737c84395995b763ed083fc1f6fcb9bd74a01
SHA5129b3465727c1b599da698854c6157d96fa275821ba0d4f93af949c776cae463bb0c81bb0e6fb5e503b63bff483cd62effd3374c35e465fddda2d1c501f6496a5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531b7e7bea59bf0daeeb08276091bf400
SHA1b4428b54ba9a8c9ff34af4cacd514c30b948be26
SHA25669b71eb98901055d8b27280760435c13aa780f650a7e34a9ad59b0c918a98d89
SHA512b00ff1e3eb12c747e5c0ddd7a5e57f4300d49269758c834a16896f40e94d18f71e57e447275e53c261c21ca009faa5b32614ea42225e0537d0e2e864bd5501af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bced9af6542e4f38a5ed9910d7417940
SHA117e69569d52e9c912a027d0be8e6c7ca7e2a7424
SHA256449f2722ce00acb80540c8ce6e57032c5e902ecc9b9948db2e6858db18103317
SHA5127a06fe0c1a932e711486b950468f34016a8d242dc7ecb889299a9de229640d3732d65cb98312319a8edad938d502cb2869f01e7bebba2bca52b696bcf615fe90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec76765539b5313f31596d2915dd2873
SHA1d765c02de21a112bd7af187787de429fefac42da
SHA256583f7c95785b2e01b9d58d4402649a1011548fedf693f691da37182b2e8da75b
SHA512c8894ab1d686773bd5957778dc817bc3a31514877ffde40ad6ef29fae640c19cabe7930c851307ddb168edce6490c53520d46c7936adf3c5a589743e7e0abd93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af7717f8ff07dd47155c7a92f995aea8
SHA169c0e8ed526e72249922329c73874dc52efbe0cb
SHA25635cbe03c1ab536983c965256109772929fd6d057a02e53387b64120ab8269899
SHA512ec8ea1f86c272241391ca0fb3395a951e74e89f123d8cb656960fb272fc32f08b6c964a47f93d1836e411430d02902d4fbfec89ad1adb6475fb47242db42961c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a