Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
2d5bbc3b3b745b9d0fc07d8923b603aa_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d5bbc3b3b745b9d0fc07d8923b603aa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d5bbc3b3b745b9d0fc07d8923b603aa_JaffaCakes118.html
-
Size
23KB
-
MD5
2d5bbc3b3b745b9d0fc07d8923b603aa
-
SHA1
10b11d9ff5881d8ccbe33b45409846c3d52f1671
-
SHA256
090becdb00e081697edd38a186b97b7f172683eaaa9b486b547d38db1537a771
-
SHA512
40c4272e78c725d45f6d5394be01ee397f8bdb6776d25137f4c2cc106d1a501b25bf1a18f70d72800aea3dd704bf62993b0f5197ca423a5118d6a055b6b770fe
-
SSDEEP
192:uWvQb5nBOnQjxn5Q/wnQieLNnbnQOkEnt4enQTbn5nQJCnQtrwMBrqnYnQ7tnkYg:UQ/VV9
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d3802693a2da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421477420" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000004e06f129122a378604ef710519ee115b6ebdb5ef58d99482d2dc65b393cd3f2000000000e8000000002000020000000322868ebf3a14f06cf1058cb75a1b1556033cb2e37e9b99606517826c55e327a20000000a516513936ea2130d4a2619f48e4a4c21c635cba589a0241b7601bec401af4f040000000a3ae69dc263a53deb648068020de7e70e644265d46b224081c4bc259da12bb57b150e3352806f0061368c910595b9cc48257df6d3da826ad010cfc498d317b89 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000815aee379e5893af85a89d799d271ddf9445eb9142c159c26f2dd0946eee673e000000000e80000000020000200000000f17853d436fe8454c742411565cf3e5a5eb4c4da4cad6c333523ede2e78b29d90000000ad475063029cf9c2a29fe5be2bf2b83ba82617d24481621b58dabfcd5b8c4abc8f8f595900a4b3bd6764933acf8d6324417f67bba0c491ab7d5f874eefa93967f6c6248e09df82f8d612dcdfe572f4a592a297a4a4f9f16d3401e40c972685b54ab10c89e0609865563e73aaaa61045be0358b1d133dc0dbd3c34210f950854159454365dcb38576ccf28a0807d4f5e640000000ca1ac4664ec4c93de3a95b6281b5e98db2ccaec8e5d4ad42247d0dd58afbc506f793e95f778cdb90a97d10dcfba51b326494b938f51c7240a6612d8212761d61 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51D346F1-0E86-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3044 2876 iexplore.exe 28 PID 2876 wrote to memory of 3044 2876 iexplore.exe 28 PID 2876 wrote to memory of 3044 2876 iexplore.exe 28 PID 2876 wrote to memory of 3044 2876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d5bbc3b3b745b9d0fc07d8923b603aa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5980f77ac43f5acc94f4fb3321705f7a9
SHA1a88f7b0bfddbebd90717b71116fdcf69d6ebbaac
SHA2560032e71d1b18ee0d3bc2a81de3472da8ba4109ad573c79693001c08498ef2595
SHA512143fc74c947344bc46f09c80f82e4bd08f7033bcbd1879897627f4359a7a7ca6803061dc0893b3ab6189b7816e6ca5726a70dd0e2a1255847a828fd3d3490f78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db231cbd053937b6ac526fe6178998b3
SHA1231bf319929fdaa96248513fe1ca9893c8518e14
SHA2563e5c01d9021845f44019465e46ef3a5a5e2f6f1f97ad2603f1f9ad26a960a583
SHA512ed41910ee6422004d6fb0208fb0aec07cad3b423664e74200d010044637dc8353473fb4315f3d923fa50b140e9843f41e285a4c4312e38a5587589b5064ff753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525635127905bfb700ba2fec4f6d60395
SHA1820719ace06cc5519aa06809722af07adc41fb62
SHA2562278478cee5d720dd75186cfb667f22a62e23d7c4ecd25dc92b967142f0c1329
SHA5123ad394f1fdc358cb7793487f1fb5c1284b85ccfeda0d571d476b6aeb57fb257358be03f3d1ddf313a1e894b5bcce7b70e184e1dc35a271af54f5645b237ef63e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f971cee3fc49fe0d7e2254c805cbf155
SHA1c1c7bc91e3bae17e30cc1818a0cf94f41bc69700
SHA2560531d0c78f7db6d2aa39ad30fadcf3890cdeefb5246e75a12a9ee2ffd58aceaa
SHA5127064c9cbe6d2958ec395c6e049c89d428c40022cf5e23ee92d76b16faaa36ef6086311dde361e88577cfa5b263067d54926a56346d1de777bfc8389954b7c2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5442d2bd706c84ebb05ba9ad4516dcbbc
SHA1902a6aa5ca2095de124672d78fd70ef4bf3b6199
SHA256c35dfadb3702308e488b1878538f8e35821d2db707db3d6ddb7da66aacd0a2d3
SHA512b731f87728cbc6aa08c5ce5b85c90c224b16100aa5ffa1fd419af8ec030ed2996bc885005762f88b59fd04d4c8f0e3e292b1cc53b89ee77ab9148bad740a6f0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51245c70a0cbced0f40e5428b1412682b
SHA10a74553ed4e2a25f8407777bc38d5f487685f6d0
SHA25667ac201043a20732c9bacde1933f4fde87d63535d6d98cb9dbe57981592ea4da
SHA512138b2bb71ae0a70d4de582f065cfb609b35c6d7987573f699fc874c24964dc5ce75a752f7d631789e07f6105b9b671eb2253d7334179782ed7cc6d7969024afe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ba3df66021f32e6d91ea15bc300ecfa
SHA173b7f208cb89e29fd87b665e653f234a94876697
SHA25605a2d1ac95046da0ca315b9c99f11a26a6b1506786381707a06026461d045a1a
SHA512e286066c85d5f94c37cd5b1d53b46f3fc19c576b3e6f8da36839b14f85f2fa44fce74b62ae225fac18979e2857995a1f35724da04331546a252e1027162830b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542cf22a09f2d12b631e7edd0b5d13ef5
SHA1fa3c84dda2fc6f541bd1029ae18890e1aa15cd55
SHA256e22000bf5d49fb94404b191b7249f0153beaa290116f9a5d97a1b668f9f813ae
SHA51275e2cd6cf32fa63f21943835b9b29b6aa6106e0d03909394d80640cc2cd09c259b0ef51e776531707bd0df52d61bdb203beb701f7f89a1f568ab41d9e668d841
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbecdd43de7d1a53441e0b6c729c8a4f
SHA1a515498eb22c1191a5e64cd617167359c06217b2
SHA256f5939bf565c341a57722a220c693a400ad5f1e71e4f9a688f4af648766def685
SHA512efad3fbfe60b15dda514e0b0e41ee522ce7a76129e193995e800d12c36cfd1e52397ccc71e57597f3874e64e7c490b9edcab5f60e23d9911f0c1a515681608d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6443a0c25ae0636a0a19735e2356c98
SHA13ae2a138e7426cea4ab4062cac8e74b2d777984f
SHA256950aed961c1eed7c6ee27fd22a444a5f0bda5223d05081b8abbe5beb523102ba
SHA5128b1fdeb6b95d9f46065c25da0092326d02bf6dec9df1be79f8f93a063506faa92daefc14872f5b29721c40b6de8dd951c5198312d6086bfb583706bab12af26e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5401e07558036c67d046015425e0db61c
SHA1fcab7072cc9d68234ba8d8e6993b0a236745548f
SHA25673eda99ce1147bd8f87a44a1aedbd158fb56209de50f357d27762e28c05bf599
SHA5123ee95ee02ea71b0c288cd58629f4a011299b71cd34643123f7ed8871ba93fd626b86f35e442c01c9fed95e260f619f38caf7c95a399282d4c738e0393887792d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ddce543d4be7a855610126b5e2a74fd
SHA1d03b54bff075d7a970792113e7e83f8eee8d3bc9
SHA2567fbe32e6fd58ab35738585bff4b00f8d1fc9f1771f52a44671bbb08c9fe75a53
SHA5128dccce14a9a7316f0dd948b1588ebbbaf53da62ef692ccea9df2d65de60fd177cca7b5f97c97746b273184d4d2e8d18308be1e6af428303f7967064daf50113f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3817259dd25bc28b9f7da596ea233b1
SHA1734936edf06355293622f597c6be6505df7bf40b
SHA2566f7f842cceba7bf8abd1e6856aca5d01a37fc2878cd925456314b0e5754e93a5
SHA512b91419682fdda0fbc15c62619bbcbc48e4168e52f8dd79a0d2d782e46a8f53b155d4557ad3be89594ebcc909ffb699474d79096a7314a9253c58773cdaa3dbe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5542954b3401b278ab04e3274bdb20c
SHA1a3e89894d8ab0a71a9cb32ceef67e73c0cd954e9
SHA256ce281828ba55833307218195258ba75e123625a75c54976842addd2fd24a820c
SHA51264545eb729a85e5de4a4202bb4d1c5aab79666f2d3b02de36e6172b6bc317cdf9ea86c7f9a26177013754f63f42a84c315e24d6b92f81cf0da373a297d4a38b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5619b668b9e89e5d170da67140ce4dde3
SHA1010b90a03843743611b7da75ffc1979e0d589162
SHA25650f5c3d72d61f9810a5d868cab84812410711e54a17c4f5a29f8427eeaf0eff0
SHA5127b44e8969505d7df7eaffe041decbacb38bdfe5c7703185eb6733e0f5602de12abfbd491c8195ff78d7db5918f91ecb159eeeab125925d06f90a6909317c4fb8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a