Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
2cbb7cc4d0232c2afeaeee8d09f4c150_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2cbb7cc4d0232c2afeaeee8d09f4c150_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2cbb7cc4d0232c2afeaeee8d09f4c150_JaffaCakes118.html
-
Size
4KB
-
MD5
2cbb7cc4d0232c2afeaeee8d09f4c150
-
SHA1
c1b3ef5d429f352807976e23843d5e01c1c899a5
-
SHA256
1328f9a448fae5f3c808782486d6c2a75a89deb963f3010108fd3551be199340
-
SHA512
ec82e42dc0623dd94ef35d2c2add9c2b095a0f5a4b649ade418ed3b391d114a34d5399945d80cc5a920c9902b2ee03ec07b0c6a96d5e4612ebe275e6c10e6c91
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ozFIDd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDH
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f6211492eeff79a0a32d026222bedec19946219b54c75a415e12e92adb48385f000000000e800000000200002000000082dc58eb7c5a148e38230dd907024dfe6d8e094320dd4a5f77d38068ebb5b1679000000061e25038414d8965b0b9fc19b433ec97fb02be7b49825b21f7de2ca20266419faf76568ea77e47f80a6f1b94a80dbf0fa6b3340782eee1d294d4158a8ab7c207df9b0e4744f67b138c4d13312ce82669105a9cc782b4f500e8543186c49b582cb362f1426e40d985d3c7aaa8831e4766fd11940f77a0a9491e0ca59b37fc29dd76d48b7906a9b3b523770e352bd984be40000000d6949bb207942889992ecbc62db488a455f07e61b4814e829024dfc6282c58c353a65b76f134ce4e255c9a4db4f33477ba13e1ac50a7c245d3d44acce114d3a6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000beef732c0e858c646c76629295c22d81fe8e85aedd0d9205cc388bc44bd3c9e9000000000e8000000002000020000000e97d614d666ad9c7f5c3d39b68a1505802e17ca04961eb6976baeef284e6f3c720000000ecb589ed34abf2baf6a15d19a89a9f501c864466899008d0c1a11ec7cb6f015d40000000d4910f5b402d3ee4c54608f70e8b0bf1be0e9568dd95ebe7e84f4d052be840cd9836de9380e77be4df701e90a73d2921d1489fa6d65f876b623a01f329ed7ddb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421467296" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEE4B611-0E6E-11EF-BD6B-4E7248FDA7F2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70127c937ba2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cbb7cc4d0232c2afeaeee8d09f4c150_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ef5164a3d6e28e8de5d56231117a484
SHA1aa5ce968c5dd440dbc2fd616b3870064be84e41e
SHA2569940be1b787798ccdeb75a847d33a24655432c8e24232872bf985ef01c180508
SHA5120781d03a10c80f34e536df444631c90fc50175b6c959fee531fb9abd6bfaf2d852513c2214ffa0c06c636edb34cf271969beae94a29701c1dc271cdf8c38c9ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecf175ba5dd9e291fa5dba91216a1092
SHA18159d73fbd434f6c2eb1a19f918902c587d0ef47
SHA256d9dffd58699856b3a14a7b19580a0970eab0d5ae4eeebe38d3981931af925af4
SHA512862b4aaadb2bc86dc0adca5a5eb412b0a8d8f16cf77188cb2593eb99c66eb8939817638e7bbd062f9328417b9ef147f6edcf8ef7793976e8654dde8cf994f56f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e69a220f0613e2178ed195c65a66c339
SHA176dbf9c7902e07314c0cba0717b086103424965a
SHA256f11afddbbda6f4f512ccbb69c76eb7aa47aecbd7a40be1ef0d751b1836155fc0
SHA512a2d850f548000cef88ff9c7913fd6321d316ddd500b0b84d634970cc17f453087b928438f78ae640cd54d4e6a089dbbc8b8d3035f88c0560c967073d0e3533e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54742846851cc57fbc9ccfb5522b3495d
SHA17251ff61ea07203ceccef1be8290bed989aecfbb
SHA256a1f6a5acc4d62a78b40bb70e5ce0569f84a7b79a40445fda2b75eae671c8f1e1
SHA5124164478510024c7863b3680b9bc8908c9d4dbac7d2b0e59d6a95b8db0531950ad7e55b539309e8360b996b6529c443dbdc2b33348382aead6a215d93a5a74650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ca85f3814224e41a07dcd8eb7a92acb
SHA1ab68d8993e7a43008ecef5f751329cf869af03d1
SHA256e8a920797e4c9438fb49d5348cbf8159ec4709cec079cf4d826bfd664528b8bd
SHA512fae8c5b82194b94eef219e195ac5ec965e1c304c615a31db1d3eb1ed5f15971ec5d3a1943e44e70f5a68292adb3cddf847bcd000c0ec3d63a19e89daf78ed515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d73c82f1fcf7952533070aa8058cf583
SHA15dbff85f0ffc92e1c82de06fe320d0887e7c0259
SHA25609b207fa3c74d9841de20a366598d03247f67d5ad7b5321ef37a768c03e114c9
SHA5124a93cc8689c756b79cce281be8ae729efd1da6e3e7f3da69e54b802661aba1d77496c49a2b38872a7705986f1c0773ca4b70bf8a90c7ef2a840a99df112c663d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b0cb1c55e599f4701b4ddefe65822e2
SHA17ddce645d08a6842513674ff6dad5df0c7bd182d
SHA256afbacaf0f30b731ce1149cde64a73d2d720ad82f627e4e1df905a073e0015096
SHA512b077db6d7145d8db10a8036cc99435a75fd98e122b324ecdc48666cdf23ef9f2c40c9f4e88ab056b2c6748f2333926ca7abf07bc1e34f7816837b5b41aa5a666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eff9ca4b887bf5e79fff68b0f90382a9
SHA1a7da82b5513de0ddd1165ee9e40a9997736d5461
SHA256b300705a055ca80b6d54a5a2e0bca8dac1411651e00955da5774a41525c3bc8f
SHA51220fc05661ddda612a2bb92ade1baa5d25537f591552654102b509c5ef27aec3db3595e78df52820682ee675372f3ac45cb6be49c9e440f351050988a8e72a123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cfce941ffe442c922ca76dc4cff65b5
SHA1f330f867289f19d87a89f457403bbaf0a11beb06
SHA256a547f5dbb14e7d57ac76d6746d19d6eb14d48e376cca2fa3171fcd289ef4bf15
SHA512c02511817e879e028dccb42eee4eea2d994914f462c25703df77782df329bbe0ee48baa40cb913eb589d24aa383263f582f5c63207f64cece4789733e4102527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa314bea6d25e87165a59dcf908d6fa6
SHA1a6b321b7be1fe0e290c9fc2ee7c7755c40d3032f
SHA2567b9e4a3f42b8d1ec05006379df824229c7f243d7393274a7d9ba68a65fe00b84
SHA512a24563669947642033563cbc1c5852b42b87dc06439f9965d7af037cfacacf99d8d5db1a10fe33d091e65fe140af56ea0f8b01e5b5fb030064ac852abde3ee6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5493ab84172bcbbea5ad9e0726961697a
SHA109b95767137ab3c86b84a45b47a902085e72f1fa
SHA256b96935da5523c8dcedaf79c9d94c56f3763cea333a8a6d9f89ad7e9330d42265
SHA512ab9110d449e51177fc453f3dd5b5e9c7c970da26084ce20be11d0ca7244403fb0bc9aeeaffa667e65da9d650726ba12b73b31bbb51aca85a276f4f3a0ef46e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b7d03d8f659b8f2990b4de69a6cf0c
SHA1f9738b87e4ec23881764f75e738dc5088fe7f0b1
SHA25655b0637ec810076b821a9644eab772abc25bc5b9226599a877391c97be7dfb81
SHA5129a94a56f47621e9ee116228515aed1c8f9122e3770caa72ad978f3ceba3d16984eb4cb52e5e9c91277b4beb5d008aefba27c6ee7b3c9fc910a91adcca5281ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4a962b087f78a6763c19331ada8a3db
SHA193d6e0f0ef2eef0cce218fa113c6b17b3c827e2e
SHA2568b3423ae79f32b57f93c1a7d60030d4fbae588393666f26fb1f6366c1e22134b
SHA512f6461cd2e029685ff29d34d0e50939af3bc565fbedf36950c4ceac61f7ff0c2aad7e35448211e745aaabf32c541489336608c24035ab36747fb0dfccf492d0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593f3ba385ac3375041bbd4c979c3b962
SHA1e1c55c6644382a8291980b0eb33f2e4a32acff03
SHA256ac36c739154997ef9456aa3aaca6b722e59bdcf0b3e3bdd33f83e3d63481c729
SHA51288920ab8e185694a53efb855145a6719e5d0b403c65d5469a2969744baa45b2c8db188a4c704b97c8f03091f34e78a23c10ee4f7c4de946dc889c00fe1f3df6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52093d61e1a63502c353ead3af05cde38
SHA1aa6afd8812eab8c2a5b5fddeb32e23daacd0b42f
SHA2564a774777972855bb53d857a0aa17dba7f96af8bf08d507f7362dadaeac7bc083
SHA512d99efcc161c7aa362ecfca70d04a8fb552d1252469a573d0b2ec22692fb96bf928516bb0335254aa48cb9384345e20a1a73dccbeb4b31ffa91b1e04cdf2c9d43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5768f2c9b46f8dae376c36e3f2c5ebd
SHA1f0c084483b53cbadc837a4115c52daf0e24e8754
SHA256a64aa54ebb726e1854c03db0bddd5c57e3ff6d9b071e701c5aaa9c8bd4cad530
SHA512b09a12801a7d2670258112c0a41ac73db60f7d453d509ecb156bd83b20c55cbb21cd0c567a50cd2784ca72e372efcffe338602994a94217a700cbfb6e0f46d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5206663353e41a6284a089e76cb262ee8
SHA15a6566a229364c4607db6d6ddc302ebdcba0fc18
SHA256d533d84cba8b4d5aa08facc1cc819dbffcfe1c4f7a406b50222fd53278c81511
SHA5127a624cd033f9fd05757299777e76a15e9f27c411a0a3bc79c916ec160a3dd8c27df81a2f103d2675a670930305c4cb07bed14c7ee6047156aded0656ceea48ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558fd6913f887df11753fdb85bfc88947
SHA1a7db2b6277bd4092b84a538548e64ed3bdd4f057
SHA2561edfc42d1429f020063c4407168f5e4e27a3b7de6ad6f15f855d21797e8bd0ad
SHA512ceafadcc28657e11726700da20ea8304842b944049119a48b75eb39fb3ac45c403ce2573e6c20a487ec9c71597eaf410452755e622da63b9d2b9d777577f9c32
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a