Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
280fa9600e33a7d4f26e5cd697494780_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
280fa9600e33a7d4f26e5cd697494780_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
280fa9600e33a7d4f26e5cd697494780_JaffaCakes118.html
-
Size
27KB
-
MD5
280fa9600e33a7d4f26e5cd697494780
-
SHA1
d8c6ac9bc0393f7b49ee8be2a69dc286dba9151a
-
SHA256
483197add944b25cd61a8c44b9a127e0523d9e3333032b5853acc98072bd829b
-
SHA512
126838d2cc5d2781eef55480532d1fe1e66a1e9287bc114af3684c5597dcbea3f94ec70d9aee42290d6815fd4df381420818f8bd058f8ab7f6f2fd9a01922ce2
-
SSDEEP
192:uwn0b5nbCrnQjxn5Q/inQieRNnLnQOkEntOUnQTbnZnQ9edhm6uf3pm4Ql7MBxqR:JgQ/TELq3YSzkJr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421386744" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{322E8F91-0DB3-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d7dc06c0a1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e6b6af7a762b2b9063cd9a0ab39479439c342fc4a16863121e13468a91493c77000000000e80000000020000200000007d9f9e17e4cca34e2706d383c68b9599f16987ab799caa6aa5794aab1c909255200000005d35f9bdb6a5c0e7a999c13886b0eb6e1c82e47979711d9f8fc4ca8ff9886676400000006e642cb8f4c4c6260eb08b6ab7e871323433cc46a641109459b74e7d2f327d8eda3632885bbf3cbf398338ce4de03c24e6d490cb0d36b771f505c0ddde68fbaf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e3c6e50d44abce8f1f79000c48d58d57a3652aba439ac0942b27a4b7634bbfe1000000000e80000000020000200000007625f9f80a6f930f2e9fd3b06663fd5417033c58bda99e19f1ea71038169f37290000000fbcae6106a897caaa43c52d51e82bafdeae2b5de619eb3bc91234d497e810218d0636899b3f56020a888ac3ab78f80c0317e3f4f2f95a88d8a529e444e5adf89b12ed54ccc97628f1ceeeeee77f7af4584c8fcac3e7f74bdcf7ea06da8017d581f6811c08bcb68a358a1163ac0c94b3f0ac98ef533466928cd7316247e464561b078c50d7892a403d44665ac2cb50c6440000000cde395163f147546f819a736b87b1bc356f952e4e6baa0f68c5237dcfca832554b0438ad1b16b4b5c96c74fadc19d0878b1e47357f39178dfeb1371b1fddf727 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2460 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2460 3056 iexplore.exe 28 PID 3056 wrote to memory of 2460 3056 iexplore.exe 28 PID 3056 wrote to memory of 2460 3056 iexplore.exe 28 PID 3056 wrote to memory of 2460 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\280fa9600e33a7d4f26e5cd697494780_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ddc0ddb3214e92a1e76008b9e4297d5
SHA10a49674583b95bab19ad0f9ab4ff87f89351fcae
SHA256d84b73102c9c385e6f2895c574e1b62b2255cd720a6f3c03194466571b3c8685
SHA512d01859459e9ca196c3ffe3fb478449b08e41b479f22ef665abcdf4b4a61f761b3c4ceca988dd0c04b31661ecb35f7f08c97427569956c88885dfffa89bbb1458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f3710e180235c7f391bfd22e82d00a0
SHA1ee875cbbbf130afc4b29dd999fd26ebf19648c9d
SHA2569a295892d3c2dc9e9ff36435731afae3760849d41bebf8304b4ddfd06c54c70d
SHA51203b32009cd1fccc2f4be6995d49a0aaed482eb41e00676bd79aec6f4d4ced27b323e07facbbac15fc64e09f16ad276281f9736b105f719b3ee4f34934134ef2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fce3fa3a1be2a788ecc921b0ad376b6
SHA10e6403dce6013482a08a3ad3950e32be152cd511
SHA256f461ad0d8745b6129f13245bee2d94414c8726ec1545f033f630e39dc847977a
SHA51262df1de1cba61b10dc593c3d52990631b9665313e1e4079cc189ab6b9e73336005518b479a67d1f3938483f6b384dc673a08e4c2363db8c026494030d651cc16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bd43264f56666228dc15b5bb8bed333
SHA1583a231f8c3d75c509784e6e7ee738b0d7775d1e
SHA256b66a065a342a935e9be2e23dab5f9ac172f9ef22bcd045bc32a52881213b375f
SHA5129af02df582bcf81ff1565966a41c2811f3ebd15aa22c40dd8438c8498c0c777eeab04d13a5f5578e49db8ac6b87b7aa941547b96d5765685184cbfda4227d30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2372a7a76fb461945b2b941e693cad5
SHA16e66078c501a218eaec1e3cafb4089d867257082
SHA256a6b73f8f7cad11fb2882a73bf86fd5024441d56317b2de9e47ebed7d8016d415
SHA5129a085fcbce442ba4b770a162a5da9d12b7a1ee4423724e11395f7c528c9dfd3070087f98526cc33a22a007f0b6cf7cc3e3fcad80bd5bf766fe09bf0c9cb147cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53973a341290a2cf184bfb7789e5a1de2
SHA1b34c4f18c913fd4a98e58d1a08da93f48481bc5e
SHA25645d84416f547b94092f6beb98c6b065874c8f9f01d409ef8623c33709ae21d93
SHA512a81fbe29467386ac6480c61e3f071309456c5e3a3d675a153b8942d3c90b2cdaf7376f53910c2541ddf51eb84443840b3cbbefd49432dbaf6bc6abdd0b7e1ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dcbeeafe1d05894111a91ea601201c2
SHA1e80c34dbc59f0ebb7635870ed8b60e091036846e
SHA256ec00d4893c5c98bde15cc97bf49411b9474ed0e46399384eea11b2f2c001c349
SHA5120d30fb45ca939f07dfa329b1b5d50aef6c7a6e2e999a32f4c7ba91922828f2e461caa3952d2d08c0d84ab865bb5051e891572c69d93b62f01b47ee040bdb4254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a619cfe802c7d0c50a10ac607317ed8
SHA11c329c099c7a6cf91ae2d7b52d3627e94dfab468
SHA256d6bdb6d57b54449315ab8c701ea8659be403271632a7ce7c03ca590e3fc1ed9c
SHA512eb98e78897c243fb83b14f3e889452fb95858d2eb1ab8bde16b69886dc536ce80532ddd9974052e9969069cdc2bd40971c1863403328dd89db6d05afa10679e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c5f5d0ab8489011f2e7bdf56a409278
SHA12ff19664908d92b582553ca49b672a29ebc0cfbb
SHA256c4a5c8af8d11a032b017b234e077d34e882f0d22f32f6157db95d0f4821823c4
SHA512af4c495f958b83c222e1829e655163d5a2da1f05fb10b4ba70ead5e9f7ec1592101e339c972ee14dc27024beb2747a27fcb3c6818b02d1657dcb9a0a754a0061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585881aa11b747e4e263d6aae75db331e
SHA1caadd6954e98b770f6c283f6c8964000b1e2cbd9
SHA2564acc458dbf108f61d7347f6098c67fd66184f25e7e7a55652f4c0212aa4b84be
SHA5123728c6acb09ccf57cbbb07c80200e9fb1041d5a89734417898b247029ee6722739713684a674877738900e8e9b917a981264a2fd385718f5f077ccab9d0858c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbb9e528394629aab2c01c6fa9c2ff12
SHA1569b8078cbdcfa2297bad9979b6146bf68bae5b8
SHA2562930f97c492b94dabf05d010705649574a04965534a0f830df8950fb6450198a
SHA5120eeae8418def3b304d13f7c49a4e4db49a21eb8ff607ae3f72028dc54d4391ddece88da7b71e5d9e7d63927ee7a98e586d4213f094b6ebd2dc9a1fe65a42b6b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1237b9bbf288046aea5a41b137933a3
SHA12c4a6f47f40f08035c3ad85229d46669620fb373
SHA256ac435bc0509dddfcf4a356998c39253b8e296be2ac5d1e1480218a9fc3053636
SHA512b0e3d4f9486047e81fbdd7259973996ddaf864736d16b2e8e3e3f69789e7cf1068fade1c3107eb4c743094e76b7915a5a1757c03a3a47be342d2cd0376137706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545c1f0d13961c2ab5f877d63fca385bd
SHA1a29be070383907d27fa5a4ae3c14503a4e01bea2
SHA256b11b8c5f6d6e64df78e0ba1da7ad36651083f753fb246bebe7c186ebe7d70756
SHA5122f66b49b3d935c0f94aa7378590e91664f0a385872c6a1fbdb1bbca245e845c7bb9f748a60f1e839f8ebc756916066ffb270cb5178fee6fd4ac9b44fd3ceba2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9f8ccb7481e638b4d58da922898c7c6
SHA1f46bca47190883858ecc446df7fbdcefaadb1000
SHA2567298a1db29a906f5f373ed5a8b1bb09e6be7be8535651eee3d117a5838401933
SHA5125bdcf7433d4ca6dc60273cda5cfeb1da9e8bbc75f4e1554c42dd0710e4637d61119618298d9a9c4aabf31eba7cf744ca64e8a60629a07cdded9a01e190726143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb8e64e3d06ab29feab28a6260069ad9
SHA147305bc3b0452088faf6e729460233dd36f3563d
SHA256bf3fbbbf90ca7ba9ce68cbcb27113f8aca717f3b047e674a6c46b0b51a7d708a
SHA512c374e1cf9506d4e652f3dffd5d6bc016852c3ef359b2a1592d260f453792cc1ea0b6bea1c821d084d7e7b851eaad7b5f80e84288e117213a37aae71a63b0308c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd85ed89d87739f9b740f1f673e0f43f
SHA16adc5ea0ff01e2ceefb820b8af8b5365508387e5
SHA2561ca2f4de9a8012e178b419045504f4e1bee61902ed09e574c58e3169905f0879
SHA5120cefc86ad14b1f7df7100007ddae12cd45035f8c042a929f3e554733f627175121633e66512cdb4d9b1cc092c697a4430b070bec7b48ae912564bf2e5479d631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5194621965e631a44e392754aa242f780
SHA122e5fd8188004e12295a45603d2f786fe8d5bfb1
SHA256aabc582f609b74132bca18760e0d51790f387074d26f3504d920bf8a850589bd
SHA512c098e39aff64b5cbc09dad7a192d6638be98ac6debd32bca3b120285be8837dca6df0b1ba33831807551296031bc883a7d03af27fa5e39ab8f8bb955412df0b7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a