Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
2626b1da0d944b8f249469c39b611eef_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2626b1da0d944b8f249469c39b611eef_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2626b1da0d944b8f249469c39b611eef_JaffaCakes118.html
-
Size
4KB
-
MD5
2626b1da0d944b8f249469c39b611eef
-
SHA1
e6b404ebc5679d509f1dfcfea0fa08db0b2bb100
-
SHA256
655e84435cb6109587660611b296c10a486235f35d04320459c235e1e2148216
-
SHA512
9c7d21560fdf33627f2d4a799f7dc827a05ee685c2d70bc174d4a2a9fab3035054c6176254d911c46033291f510708f602b09a0a2021505ee618d44d66674f8c
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oViGjfJO:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEB7C131-0D68-11EF-B6F2-56A5B28DE56C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421354875" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005ecddc8420c39431fdf10f43578bff1f91d28805b14c2521d5f398dcad37d4df000000000e80000000020000200000003d9b993491a9980420dbe84515d0bc56a3f2a0a2cb2565faf9a50cef72d95ebc200000001bd4234704053820ccd880adb7debaca0abb2543a57e76eb8b782ee4bbe7f94540000000b06c3c9549dfa540975d7eef7b5fd7a3fdafc98e87eb718e86452508f75b984532038bdb62203e6a4a04ed7948d3b72ea037b55b32a581679c669a6f79fd3973 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000aa04a4985eff4e4dfd1c295e57bddc7e9d19489fe93bd08c52ba76016b36057000000000e80000000020000200000004b9b958f2d02f9a67e1abc51c0680663a466398a07e33a14e2cd371fdd6737e2900000005ca19cea47131cef9f10c2e9c4f46cfe84b3f44f6ad2c2c01f345ab0cb9bb6839917e7293ca35a5f5ac689e5babf7f3e1a425a702c2b04adefdb0d8044f350823e9b82413badb4fe141da9510075a79d4996a7cb636c5cc45e6ba0de9f81225922e2b713a8fc0f959b843ad64abb551dfddcb5454af7653a5488a7937b5ed21b7bb43493716007542c09eecf05255f4540000000874442fd35d4b815ba7f238b3f31f5d853106485d3b0c82cf7f7bfb8584d139022ef8d3b298b6e3a966fe6e1bb17fe92a22456d60827ebdbccbad9fc0dd7da62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d332d375a1da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1280 iexplore.exe 1280 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2168 1280 iexplore.exe 28 PID 1280 wrote to memory of 2168 1280 iexplore.exe 28 PID 1280 wrote to memory of 2168 1280 iexplore.exe 28 PID 1280 wrote to memory of 2168 1280 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2626b1da0d944b8f249469c39b611eef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572631cc3a84af55c428a6544bcae4d70
SHA160c0a886a5a605613550219ad4f926ae267884e9
SHA2565c4dbf3f5535d95b5a7fa64e50286f2e60042b589c14d0c7fa97a296dc791d00
SHA5122633e477838de2c2284522bb47aaf1300ce7d9d1d1d6b7f9312a102a8e33ed0984ba2312b6239a4aa057d9fc59bec586b8374c2164ef4deb13bb851ee470fb56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512e3bfeab7cf1cef3314acfcd3c79768
SHA1f70c4e3a12b771f1842e2f304dd8e5c90c4611d6
SHA256b9e736ad873bc02da9915e9b0142f035ba0e858a74d08a93ae9738cd11960c0d
SHA512b9f0956651dc1290692b3b08b4a5eb4f4f4a8b8e3ac36703ed16e007316764a12683ce6d6a4795f57e4c823a395cccc50a3e8dbc9ac44f8dfbe50670df8aebb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfef1600b03c202bf8ad9779ba4eecb4
SHA1fad944a47beecd1d4a9256187f17c4018b4889c8
SHA2563bec046483b2d111f1411e5e8aff1101d47feca7b55e40b23ca0ce4109f7b08e
SHA512a43cbeaf034ebda0e14ab376ac6e6598d03f259a055520cec801a3a45223785d51abe4181e2813969c997d71a7ac0e61ab21b369fcfc6a398f71a6ed9a758b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dae354865126bbc35787f1282d222fe
SHA147e5be60d7b885d8676d131d0e75a0bf895d93d4
SHA2565397b0eb6b35b6a0cdffa836a3b2e521de5614376d7e0d1c72cb570d42d25ba6
SHA512aefad19e89ca2918af29246210617e138307975d3458000d3ca79bf036665a42c59272161e1afe28d050fa8b37a5b2c844b576b085c9516ade3107850e0447c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9596fbc9950be8387736b2d1820f1ac
SHA1b1a38009acbeca44a9889977cc4e71e3b8de4c5c
SHA256f78ef8a4b29731be3a1547842c06f9e185545a28fa578b61186ca1f3128c6c60
SHA5123a10793e8f4e10b2a2f70946113249201ef12b7ea3f73076f5ee4f149876dedd85fbeda8183c7e7a62f4f87db0fe095f7867fa87534acc8a06b8ae81efef0754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba431acff57325b86303f74270a786bd
SHA1077c2ecbf4980d06470c1ee44af9e51ff0344f2d
SHA256d274eee6ac406621ba49b7d715b3bcdd39c39162d522f8f2958538cb6f4e0c76
SHA512720efc0e477b66e9eb5a50f01fe67b84d012d2f41699ed6d2ed67e1ccc49cd06e8fed788ae3c57a6dd7e512ec39dd65c74ea212529e85b9105a6f62b51baaf19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaf5ad3248f21a547ba1bdd609af13f8
SHA1b2f8abdec4ada46586abfe301b746e18c9bd1227
SHA256e55bff06edf1cba14641f6edd55aeb01adaa54b60153a58f529a7204f0e2a3b1
SHA5125441a914f95a6411302fc750bba8717711ed02130875cbf02239e70eea3d224e9a3e42d94e057d54b9d3ed8ef0cef85c4982ae194c4657e359df269d0fa6d05e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547602113c44e1ae78980a549a87b98cb
SHA1678d11362fce047a1ce29c0ff0c7ae967d9eb490
SHA256cc6ba004c68d9d7f1df529abed2de91c21fa76d7c766d01ba2fdc07ea7435fd5
SHA5127a0b70d007a16feae604c702f53abbdb8ba05953566852149e97d0f01cf616e2582b8cd31d566e67c310e3e2237572998094c54a1ed8a281f6dfb107ce02fd6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8ade7de97292baa777c2ee7cf2870d5
SHA14241f4a5eb65f082bf331c9d0ca07008bc9d5308
SHA256874ad75fe18b88cb37929eaee5a63ab48dcf1917ef1ca1169b0c30bb9c2d5ab2
SHA512f3af4e36d848122bc087bfeffd4128092e0764d5f317388e1c8619db83fefd1b3e77928c8b226d33d5574ba77e21d38c86686b1f2f11039120713cf205785f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5480b8f064c80e0f2a81efb41b9003145
SHA1aa5736044ddca3f86250ba370384f8fa416df688
SHA256c53964a118ff949ab3eb9676c361174cf2b253dcc8df7408904e0f99152d0121
SHA512201e4dd08c84674f33639d3f90abb66eccf4798cf9e1a894abf55d1430cdd3eb3b58d5eb1fc66ad1fe55a5a3c2905595fe99179ac089c1b5013369f7d9ed6eaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a896ed95f5e5877d618c11430b5f444e
SHA12d69f1d580d4a0b6ad4801d27102bbff9334cc4c
SHA256fe20d38b444552a170e70c3715e8df12b0368c91fbb4eca5632ccc6918cc3d1c
SHA512a096ad83d86eef93fb039fef4df5620aa1746f826a28619dd810676bca0fbc7bfe7ce5f4911806b57a85738bab26b54a40f6cddce7c6637f5f86e1ec113d3b25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538cbd0bc94b233e6de15bdfddaf12a68
SHA155ae1e06939bf66029600a93f71aa04e86b2ead5
SHA256810717f9d56dd57ffef88e26ed287a084857439eab26eb810a21f5471fe39e59
SHA512d1819b61c30d5881aacdfc2a0b976a59e760b3e8447b524d65c859ebd717ae14e806804aa55170f3d0317ddc035648ffdb43bca238a8b420d707a8c2af54e2c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0887d80c4163430f927cc38738acf3a
SHA179c385b8db7742b3512a44866b246f8b490dbf20
SHA2566827eacbf56003430fc6cd9eb7dafdf1e78eb0b092f79ab9888c6d74144f656e
SHA5123fe5936ae7b9985595f1f337ccc22405274209bfbcb6feaa317b1f228c0c0b092ac58a7bff7e52c0a548ad93a992ce485dacf5844b288a8ec67937dcce1e9b49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9ee284e67e0e3a9595fdd86b2755303
SHA1447c401ca95960c43193c917f3e85e406f5ad1c3
SHA25654fc3d1d1dccbb234e9300611090a1e0bf09a164b663bbb8b429e8b31e7c51ab
SHA512f048fb566515a792fe781aaff0a528a5a26c58a4d982c725cd6fb6d814ae2924b123681a69c1fb01dc346fa40fb4f2b4058e6f55a281ae5805948a6345bf3653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05e90dac464ff98204bd318b0c44ac6
SHA1c09cac914f56f491860ddb2b6dc532ecba3e134c
SHA256db280c0d61480bc1def28d4db44b07562e876860d58670334f4f844a5f05e088
SHA5121174f50ed6b0e2b767ce503232321147bae341faa9b1c016aae6379fb61a41ab2b2775c20e5eb5c6342b44a329fd53a67223996de749d27bf1fbd64090527948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac8158c31454027b15bcac40451612d7
SHA1c3951c1657bcd620106ed60686aa5b9b01e6fe19
SHA256d54837d30e99aa3ebc4bb42cf38615eb0afe247b7f333d83347bf6c7ef297a36
SHA5123e32e6495d3cc62de0d4008524b1b4eadcea6dba37e6ec1f76434d1cb74e7ca3d10d3f222afc7cc74b56b3234c425428851be50c8ede0b5cf6724fad0d5cc51f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2319f698a8a7685bc0e914b5632dc76
SHA160bd787dca53b3e9f13d831655ad57d85cf8ec76
SHA256b17e6f3f98ae698030d3cc1b7a9f766869c47082990dfdc4c801e67db628f469
SHA5123ddc69c229e22b4b244c2bbcd848960aa5771f93cca363890b9039decf0ccc36c00cce45b552d4682556879d2b2c348f900aa8a896fbe4300a7515367a5855b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5262d1c07a75197578091bc14f2b543e0
SHA1aa33f5bc6bbe10eb8aad69b20b020fe72664db1c
SHA2560d7cb4c7637e8fb28d2b12938cda816bbf9f7c1de578f24689aea2d8f1763a1e
SHA512228de855b99a9407069ab7f0967b07617ee4f5fc101093de5ad465ede62464fbd311133c0c36327d9b4c86fcad9f1ffd4d1915e9f997a4994bc7b088f185402b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a