Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
2575c2093b73ebf549976899239eddba_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2575c2093b73ebf549976899239eddba_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
2575c2093b73ebf549976899239eddba_JaffaCakes118.html
-
Size
118KB
-
MD5
2575c2093b73ebf549976899239eddba
-
SHA1
edcbd1729c0237c47351303b1a47b50c82025d5b
-
SHA256
5569e05f0e0c1da5f6394b869100ee94ff7ef2d7e506eb5bd276ab39643c6978
-
SHA512
b0d91a9e811c9eb53f9cff94709eea4aa3d85e24d472035072aa8d608623bcc2d50c0a01da9116201ad009017ba5f8ea0925d4bbd261a71a110a885bf413a3ea
-
SSDEEP
1536:eD/uqZL7BYXZ+MDuX8ZVMDQwXZgMDQTqZgMDk9UZVMDSVAZQMDFOmZaMDf41ZgMz:eufUrfUrNa
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421343419" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002d1c61f05f377d7fd26a4745900876bf42ddca2af0c4cbaaeb12b394a488ad8b000000000e80000000020000200000000627fc4854076d67ccc586185dab2042ea22309fd53e714782940463f71a645f9000000033e052a6721998e1e301124003e89a115f4470410dc9ae6678d7f0fe406dbe50f9e0d1863dec0e1bf85c7f31cc077314b91810413b440c700904773280b51ce3796e9370db0a1ab962be49841efc53d53ff848b2a554d507b3f7fd239ef23251edc0a6cf5e68ea166f12eebde417365dd68f00013b1c60bb96e9f5be8defbc111781ec8fb6e25517be4521c4f490e49140000000b8d69723f74ad724ac5274efd424129704838b1022019dfd24c64c233c9af1729fa4216da52ed11e833f4cb8d303e1970a7747b83836fa9d851a0494a2792d8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d052cf665ba1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d2e29251ef4e8f34e7468c2da542de1ae32927ee02f051d307c9109443aea7ae000000000e8000000002000020000000551ee0b29b8255fca8c3c6137ef9d7627795516decdf971da289721f2ffdc64d200000004f58ba44b141dc6ab53f011da11ddb1d8cbfda8110e179fbd4caeb07459be0ff400000006c751f07c840e71998d218572dacb04a858746e480926ced13dc5d6edc1f531d5bfa4e157d67a238be8ab3bf15b1c706f54dbd369307da5e52d2ffed3e939a74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52699CB1-0D4E-11EF-9D76-F65846C0010F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2564 2348 iexplore.exe 29 PID 2348 wrote to memory of 2564 2348 iexplore.exe 29 PID 2348 wrote to memory of 2564 2348 iexplore.exe 29 PID 2348 wrote to memory of 2564 2348 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2575c2093b73ebf549976899239eddba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5611f0bef5e32ed3cfba7e622cd2a1b2e
SHA1e932bb7b75bd617f77815ab872cac5661c7261ea
SHA256a5d6d8f0ebd876239b65026ce357de7cdb9ce487e4e0c90f7a7c562703bf11c9
SHA512a6740e619abf824288777d980b1300093b23ae1eb3a62583276d4c4227ee9300a26a46454a3b9ed854f49350b13854dcd87c303e33f0107c0be57d5d077db7ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589f782f1d00e117ead6d760afce244ff
SHA1ca04d676f90b9db795df0b3cf39e76a5a38cd366
SHA256f467df79f7ea24472b202129a78a529b228a4776f7ec512727195417315a928c
SHA51230a1a9278b59e3f8970982b2a0a9b34005352f6dd43561d23afd4219ff1146a4c155622bb3c17a87d1bcca135b15acc959dec6dfcecd334114e4f3054bbae610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eb608ff0d735fcae7fe1d3f06183c82
SHA1cf315868f17fc1d224ee0daa05ea378b0838b6cf
SHA256d37d5349ad07dee81a8b721cdc8f39a558d05567476b43927bf0ac1d33b321d3
SHA5122d216c9c8ac34e55fa0b66447523d215552ab37c81a6fdf4cc45dac73145ac9f71ed5281f996a45313761d0a974f6229d0e19691b387aae12132ceea9f613617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed051886d78efddb8ed2483864e48cc3
SHA14001444e60ed6dfd4aad680d4b31d743b46372cf
SHA256d9f0f3b40288a92ea4859b647cd213fa4281b03cbb1f3073758c05a3df5821a5
SHA512f51093a3dbd05dd930d7ab572e11323189a23942f7db0b0dfcc95df96d915494fab6f1251e8f413c8e8e1b6a84e8752a3931faba8aa704e133ac4e375f3b7a6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5897bb42614b3426367b3e9ce68bb167d
SHA18ee884bc4313a76c1fa189997811da506587f051
SHA256fcbabce07c1ff292e5a9274ec2e12a02ac177da0dd7eb30ed52c58e27e5b1d50
SHA51292b9aee5c62c2cb387fde4d37e2ed2184e968ff2ad31802ab3c641a8263f10fa1176d77a9f0a45544653256f238069acdb5ae8758766ecc06cd244a4641833af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519f6d0380b7bfa3219b62e4235651fa7
SHA107d09a6d5c2bccae36d8e661ceed8047654d72a5
SHA25663cb6efddeded395c0d888c1befbe45157fa5cc97a54f4c66196aabf69f11e1d
SHA5121da30c3c1849401d379f4a0dc5b4627d22a45b03f3b7f7edb9693fd9ef0172ff96e9cad7155ed1b4667a0cd33b1bdaa64f8a692602d3976fa14d54dbec170e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1a2622f7067db7d6a9b5e03fe580ce1
SHA14b5d8519a2b9b3a06ab4bb2e7f4887818616368a
SHA2565f6eea3f887e2d150cdce638196a7d12fa9b3d91fdb5d7a7b96bdc5d1a669998
SHA51293bf760f92517630719d2f243fb18b5ce5fed97e08350357b639f9e2ce17962f3c34ad08bb5931e50a45076ba806794d1b7cb33181d5cfd9466c1465f6869066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f499f913ce977645e413fa87bc39d821
SHA14cf9208a1d21422eead68a322bb4f7639ce70f53
SHA25672257fe84ca3d59af240f7861d25a6c01aaf368b50f5f6069f5e17100a160e0f
SHA512e69e1bf1ddb5929100fc6a773a182efca5a7a719cc40fbfe2169994dea378ef7c84bdd3dce649b4382f8fe41a6521b6429f6eb6b816652e6adeafb78f215f795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565c7e22e57a576e3a0f004231d0b1f2f
SHA1cbbb4d94a94bf73080e991ce1c478086985e49d5
SHA2561b824e601c2e2d2e2a0002b14ac6ea256985c889f2f75d15dd0e5ac117b20dc3
SHA5121860474eb6f1cf163087b4f437c362977a52348d0ca7631d62daaa9898f6d0e1377f695423898cc0f2d93909f3ba5bbd0b4a47653a623f45b15b949dc3336a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aac58c9a5f39c43c7b61b3e846ac1c11
SHA1340ade36ef304f73d246cba52fa7dd84b738137f
SHA2560d5967f0c59a75f3da1761bd21b07ab32f61aa3446e613fdef3e3a9407242cb6
SHA512b467a8053cdda6cff3d71af786b962065d09f1c86b7611c8075f1027aba84560ad82cc1ae0b922816768d94226412fac575ae5879d563404a77f2d4744913033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50133adbb51762cb9bd3b2133a1f3a39c
SHA1636b25d8219d970a4dc958c525ec1ae1961c16fc
SHA25657dbfe9ffa544ff94174972b84ed52addc5ef8cc10857e533d8842ec838db711
SHA512ab9ce4568af10aef74b37955a9aa9a583d973fa6fa9dc05148a3af0287e68073734da7a2ef281a6b831392079ef666bc9cc42c4ab4c7346f9eab4eb26252ece9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5823a715904d415d6b427484c6576b821
SHA15d89d842fadbcbd6b2f53da179707af5b3706699
SHA2565e97f917eba78035288943a6fc5c584013ea13c17343cb6f2b9314579a88fe15
SHA512144ea174397b2246c212ba1b3d866ec34214ecfcf278c1a27cba8bb4a48d46594ac06e0cf559e6bc488a5d77b3867e9608372fa2a31fa2bed99533c1cfad257b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adf3062683a57e2450c8d14589cd4fc1
SHA19c2a6438c88b8dd487eca8a9482e06b984a65da0
SHA256b7662a7a28d8846d74a5626422ed6211db99c67447bb6f9d975650906c3e6a8a
SHA5123844172638d750fd2cc755e17f3bbf1c610a7e82c20b1bd7b02b7a190567ccce8669eba114f8cdf066f9b2b032d74038beaf03bf6a606937452ad8b58569e523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547a2513fc85ab6e784a9cdb2e9537876
SHA1783493097dfa4a2327b6eb94e8b6a6bc932637a1
SHA2568e020bd56cb095c4617af611b0cfad4f2778c6e3c8288ba9f89a039efffb0c44
SHA512b4121c082cc03fa506e1200558f27517a93ee15bd81563d8a138396e28ff2636d56804bc62f2f4eeb81d99968651977bf8704d1e454ff848b0746382395d5b28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab3459604f11fbab10e91ef64dc8a93
SHA1d33db8159d219a81e6b4c888fbe649ace4934a2c
SHA25683f2f8fc02a2b4b4352a7c5220655e448fe2c4b4fca4019133680ad76da57253
SHA512104361f06e12f0fc0fdd18a795eca3f6f535859a58d66c67175a645cd3fac7b078d2dbe261a4e1d7dac5806e5afa3f45b893a450798214600441c831ea0b4589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e54df3a3b7692c1f295f415182806b31
SHA111fb44c8885efaf6c6b16eedb7e736e81d685992
SHA256302f3e810f94219cf3fdc72993a4848c399bb9dc7335ed1325d76821e44e5631
SHA512d84096cda0dcdf53fe352c1646f1f3a020582b070d8decf3ecd4d431e9d28ce12cc6f64dadba7dfa5c8ea70e79109507f002cebf97b183057baa15817773a963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f82c12d16587dec501b7311fd22652ff
SHA1cf49dc7fbf5cd2790d701b4af74f0df64b4e1554
SHA25615ae32540110cb233ff719349be91e0d57c16aa8dfac85af4912689c71340a0e
SHA5122b02f96f91d88c362f91988f787db693c5acf1c581bb8f2f81ab33601cb55529f6e301616b2a9d12d2da912d716b0cd259fac35d5782de4633e2f8d0f8afcaa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8b1291c86725618300b1b5d38f5dead
SHA1c662514c38bb859449231cbf2b7bb63e0cb11489
SHA256460cd4ac9afcbbec5afaa361d6427be86eafbdf1e39746784c5ec56e4954fcdb
SHA5127d9a39322ffcf89c16395efe07f4252760bcdea3e4ed613bf87b67cfd7e1b7b985615ce09cdc5a42c5314ea747f3d000b651fc765f56abcc57e1a00b4013c14c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a