Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
2e15a4b0b9964a56c22d95608201f835_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2e15a4b0b9964a56c22d95608201f835_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2e15a4b0b9964a56c22d95608201f835_JaffaCakes118.html
-
Size
13KB
-
MD5
2e15a4b0b9964a56c22d95608201f835
-
SHA1
144da89572238d126ad08d868ddbc038deec4bc1
-
SHA256
9b8c6504bf3511f33227a84030b2a76349f5986758eea1a6567a602b0615205f
-
SHA512
be63541f024e134e7516660a7cfb28771dab0932229d3db1a585d3160560fba02eec7e9c5f302288b71d2103b388d07c7b548d1a673b1e201ef9441bc40171bd
-
SSDEEP
384:fru4ND16frQUtl0/euBx3OMuYsAusnTyB40ZigBVeYo1ac:LNU502uBdOMuYsAusnTyiUjBVK1ac
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305c5055aea2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c5b8da487a9980f72005cb42f37a683982e83ea5b335a082db5a8b3e71109cc7000000000e800000000200002000000073b1224f648f3f780fcc192001e8e8d380de75e90e8644b59113c5af5bdb43429000000007664e7d3181583e8311f7bde7112ba2c9b94877beff4bc9607791e05f3a5e63ad1b2c6ec2c9f8f658b7cfda94559246b3bcd6e26da7714360b086d9fe6c4503485250c3b8ddf383c0637aa35312d8d3b0907c36e80cac654cafe1388b3b5a7ba830da6abab6c59b88686ea48ef6ac5655c027d771d84fb20c20bc61e6851c55d9d0799d04b98ba5009293628d95fd9840000000bba51e90cd1483ba4a8cfbdb6c9a430c8ad66cac04c7b9f19ddd1ff2515b5c2155bb1dd78d808965e57a0271ad1c6a7ab3e570d997692c38d9d6a28e015bc4b4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421489094" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000008a3bb738b79d450db82c8afc709114032dea68f376ecd8502b5f7c795ea84f67000000000e80000000020000200000002c9e6c46491d70603b313efcccc8c5edc0c5f10e599f10b6d468afc3baf72d9420000000137097a912ac3d31ba43f4e13c591f6cc64f837841be1af983859869c1b116984000000026945427aa6409979d1acf0c78b7e12fd51dd30705709143b75d012f7182590832aa0a64938fa29bf6b0b96902c30198666145c3fd2ead67a0129a2de7d8e2d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{802032A1-0EA1-11EF-81DB-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3060 2180 iexplore.exe 28 PID 2180 wrote to memory of 3060 2180 iexplore.exe 28 PID 2180 wrote to memory of 3060 2180 iexplore.exe 28 PID 2180 wrote to memory of 3060 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e15a4b0b9964a56c22d95608201f835_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f158ca7588e8a481d9e2410e9e37eef
SHA152c43069132c26c74e7ceeeed76c8b0a107d1f97
SHA2568ded8d0a6e780f02db08e5da7a3d4e75f25097dabfff3ee8cb3e0d5cf63830af
SHA512f22c11f82d49dcb30e32e3fa025ef4fbf0ff11f926629b5709a3e28d282993431e3a74f8bd962ebce6dbad323da6ecab565a207754b3cb34719323a91a53b852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e613635402cdd4e71dde3f9accb9ea44
SHA11371301c63cbe44cbaff9a236008e4aa2bf47580
SHA2561cf57e8cdcf63be14064b420750764f79787ce4eea20ff9e7d76bf3afc699717
SHA5122da3dae30716d01b58b1d6d30cf34b358b9df11c3c4b1a4bf46ca2f1cc4984e7f0e638ed22d1e571c9ea1d9401d429dfc07a095cf26ff8a88cc478ee9f6b65bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5399ec3acacf8fb90d3dee862d11e0c77
SHA1c5ac898c1e405c355024e5b59cc7b2286496ad09
SHA256756851551eb233b0787f0644d6de959bd7f269d3f5eea7d8c55ca76023ce9578
SHA5126117479dec524738ead98ebee73b18994162faf0b2845c03180095055f58757097c9854ca148c00a92bd43510cb4eede14c3b2c883747209d2a9bbbd38e4fbb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f40617fc41abd97099f10454c1fc557e
SHA1d99969245649964d3b089a7e79d3bb52ab4a6954
SHA2561b48b22c3eb6740f7f215e918104f8219a7ae6f3d522c83dc6baffc5a2b84888
SHA51287b5a45a6dc04359c1038cdaa7474eab68f4f02e801b1e08330893d14081077d37e7e69fa95a6fd7240ed3dcc9d94ecaac0c261d9829d559d61dcd2ecaf6845b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4ec67b2c149ad4c30044678fe9f67b4
SHA13eb0834c464ad08bc986bd0a835daa69f0a3393a
SHA256833095d43eb28d095b5c36cf906fc2f1ff4496161834ea75edc5e9b150b19a8f
SHA512a63470bacce02eb6c534cfe4a6fd99202b37ed31bd3bbc4a7994243955662fcaf0b241fc82c0e53152b9c0269ff3c352217a1e76e64c690254461c3a4a911e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526051a0ca4b74add29049194317c95fc
SHA1220fa19d3bf5d8f6eff8ae1600f8d3c5ac92dcf1
SHA25670c0731fb16af64dc4d037ba588322fd2061515c6b42a92f9b1e511933601207
SHA51292b327913f1c71de67597379789febfbb7820e29781fa0759b2d94b3f27e28dc82fb00b684b23a8d412cef94a81a9fb6e9d8ebbd01afc6ba56df237db5719e43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a51883b91ceb0f422bcbc5b746dd02a9
SHA188ce92e4cffcd6d3d90e1b16e4265905a6b3c6c6
SHA25683b9dc68443a8e8deecaeb519937e483ee81f47ac651a20f9584f77acca6ae64
SHA512aa55333b95f4560e5e42e5b3d878e005d0b3462e251553146c88d4d1d275c652516a8327c150e9705bd23b2d077087866f2af95d9ef754a1de4a9932a9826be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5967bb42b475a8fd50f34c6d28d98cb07
SHA1375e43d30eb66beca7baecb464b8dbab58c307ac
SHA256353fd7ef3d31a0f38eb78c9155003aab2b4955637c3782e513d15fc8dda22ec9
SHA512da1d84e92b4aee12a6a4ec9ab6bb12c0a94dccd17712703e4b487e84d77814f3f99a8a43340e4ca0c457870d282ce2df54c217b3a8cbd2b0a898a036baac3870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5190a6a4b9e49e04a34c9cd139d316ce2
SHA1c4e41c090c3fc16baabbacf195903ea7bf471a83
SHA25624c0a709f43827223f426b7e7ae2273ba39865f1a545195a59cf3b2bebb6ba07
SHA512ed4e06e682bf1c1812baa8ca425424be9535694bc4e0cac83061f2f0e1433d4803039ff2df30d7ed331c591ee15a9f8722f758145fe68e87470bcba23e58cc6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ef2310260060d80d14aa77004703a64
SHA123fb9dba4585cdca5aa835b32a726ac4e06350bc
SHA2564257fcf13dbbdcba85b80dd3a8417f59a9d8da916c859c82443dfa85b0dd4d6a
SHA512b46ee77c667e3c687155c79ef38f966b3ca8a1ff1f72a2e8c0956efe641d56c1cfff25bb967a1b2a29e831af8f2131c3572ca1f3bcc7c1be83e3844af37ed55c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7a34757da02ea25ba3f475dae32155f
SHA10029debfba11c2922e9040e615d288236881e7a8
SHA256bc7845918009224771a737cd77dd1683ed405758a0c74b19f92d69af0c7b1664
SHA5128a080e641f9e81180df4b1db0b6b9566f9b08c579188a41e975060960f27d564babd9f599640c2d6d8cefed62038e7e69f9022e75bdf6394fee8c0b3fd7f3e5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b000bc2985d7086aa4e9a79fb56bc29
SHA122e2b6fb030af497e35657fb438c3f85ade3d607
SHA2562fc234a76836f3b2db7a699cee77255ef6bc6b8f815035b1caaef24d231044e6
SHA512b90bb3ac3a7f191f61164810bfeccac079bde6a234900de1ad7e38da52f92980fd5e3fb969faa904fb12ec743f2d75b5ba431ba62f24f24ab3a716d369d6e6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d47f73bcddf6f3cac513ae6761bc747f
SHA1bbdcdeb05276715563f7d1129b6962231a863a19
SHA256662abca795469175fb9f417623dc315083258c9e6011f235eb72506d2b2279c1
SHA512aef0a8fb3d2c7a9587664cb550d7da4cbe484a6eff5d997b82af3ec538360922efe544dc58574e93aaa1e1a7c17dda6d862f70ac76db0c73bd895ac8ce430b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a336d9f3ab18f11c9c13086950da01f
SHA1cc5f605a96eee83648af29af07a6b1b065410c91
SHA256e608ccfe4eade169285ec901de149b4ee59bec1ead75c61ece2e74ea0c855c24
SHA5129b626403466a9e3f1aa1030cf9fd92f317d0600e9df8bf26749e6b1e5daefcd8448b9b46c2d292e94a2a2777e2c61730561ed209290c4b1afbc51adc853ac504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb4b2fb6bcbf6cd7dfc0991bf8a310ff
SHA179d8b9fe0f1396a825c44840b755d7598f1d3ce2
SHA256a67f41b69a2a8934de642ae2023742c23850b619fe7ed151879da3daf60f0b95
SHA5123d080041b2085714515e5c1f981b3b56c429ce557ef5c658dcf61856060751042383c74ead751d1e93b72bf151b6b3fc181fe98a50313e2f457c3c7e933c36ab
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize6KB
MD563ab6b2f6a40b8e2b66bca4f71d68f6f
SHA174872c1b002753eef084f324a69811481567be89
SHA2565c56b2d4bc952bbeea0531dfaafd3be1641b0c2a48bf11de5b01f69409f7a3d9
SHA512c603d29beef51f1fa656fdeeafe1b49831a17353ce318262a3bffbc104e30e444359c04e8228671bf2d88961c94e6b84b7e2900ff314c8cbb2d9fcfa03b1aaa4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a