Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
3046d12b8f3d7838a85520bebc0beb50_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3046d12b8f3d7838a85520bebc0beb50_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3046d12b8f3d7838a85520bebc0beb50_JaffaCakes118.html
-
Size
461KB
-
MD5
3046d12b8f3d7838a85520bebc0beb50
-
SHA1
f4f49168d38b926d13717d668af85d841dfaa52e
-
SHA256
1b3c912b3972098df413cf828c81d54446cc72c5a1f231e7ef57251b538ea7b4
-
SHA512
93ffd6fe6f4946a5a40090e6176c377c1ea5d5458debf5c2ff72ad4b88dd898f18dfe73c8c4217b9b3c377cd32301b8c5070bae0d7dd98f9f4f414a0e030f7cb
-
SSDEEP
6144:S7sMYod+X3oI+YUsMYod+X3oI+Yd+sMYod+X3oI+YLsMYod+X3oI+YQ:85d+X3g5d+X3U5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421524895" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000031330f5365347f41272490a37ada66f3054e41529c923841eafaf0f07cd3eed6000000000e80000000020000200000004f155a29224be193e89d1f94447126ca5566d66157bd4b84423e12d02c9da14b90000000aa2b6e593bad7ac24a4a31c523be1d2d679aaf8a670604f1fc321e18595fbe0fac2b851b8cb074f3a414fd98922e6a0fdedc98f134a5bbbbc3dcabd6ef1a576e23473eb1407d612f863ceffb41a272147839cd0c8755ac1ea49579fa626c0473c5ab0ea7edb368ca0c276158b495812e6939ba0865e42e9ca0d8aa76050fd6c7ca1ebd6ef2df8cbfc41ac1afc246ffb640000000095acba5e546a062e1e859b16c0f75d9e7eb60b09d3081ecff9046afe814d370d0bdac4bbf5617e3f1969c64be1386d6430be711acb8b4570a2c1266be2f5329 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA95FAF1-0EF4-11EF-BB01-66D147C423DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0993eb301a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002a3c44e650168507b303cdfe0c192240b1e298c9b6a7eb4f631d239245a217b6000000000e800000000200002000000031848dd1df2303f0fdd0dd99c8f07adfa7fdaec070e6e832a18f41e6d06dc49c200000001ade6b5dfa1cd85482a4fbf7ad177dedcd6509cacc3662e25fe05fbe63fe0f9240000000b31892b2cad10d5713206e0427da8bea1246b25bb27e08676d773dadfceccc7c2f0d2ac5ea4c25979804076a44962fa39dfb5b13618ebffa664e495c2067b701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1688 iexplore.exe 1688 iexplore.exe 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2980 1688 iexplore.exe 28 PID 1688 wrote to memory of 2980 1688 iexplore.exe 28 PID 1688 wrote to memory of 2980 1688 iexplore.exe 28 PID 1688 wrote to memory of 2980 1688 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3046d12b8f3d7838a85520bebc0beb50_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573f49f76b7b4e521f4be23159207fee6
SHA1c98d2c7f403dabc309d801cb12055e532af33e53
SHA256be41f5e74cfdf70c6ab146909806f9e20bec9f732d1ffab42a6c61d6aa47309c
SHA5128ab62ed271d699ac33fb8aa970a47d3641f817bbcf402abdad11785b4e2391f43452a7276d4ba08fbce6e6a69294c470fe033d22c48910c67136adeb58345b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b93ca4cabe0ce19488b8e37043684f0
SHA156d360ba30bf48dff110363cec1bb9f01ede9576
SHA2566c03a0ddbd7f224bda13450e0338faf78cb50ea985ac70b949462e521057d2f9
SHA5124f3c573e6980306a114cadf386b1f5a1a08f8fc30bb2181435af441ffea59741d8d04b96e35f7e6cacd0ffd5a21d14ecf9af67e4512bec4cfef2b1fba99f3679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b75a7df970f5404e5be44cf1fe29b5fe
SHA1a8d6f265cc8de37e0760d83bb3080a0716956920
SHA2564994124e0f4235fa5491edf556f52df3a0cc3328aa78f53c0656ae777ce2bca8
SHA5124cc71ce81f2caf1eeb359a6ab69320c4b7015ebd6ffaa272b869fd3cc83f9af7b2eae26e8e2673b3b7172a22026812630763ef52e2c7a4d30b83971226542241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5813452f9e26f7853b0f893237f4dd08d
SHA1ef7b9369af2010300bdf52ec0d0477f713e0da1d
SHA25625e06b5264686e7132bdea820c6a39df63113726fd573d3a25072d2828e3f109
SHA512ceffbc18871c9f34862315e76ea6091b3e13bad0db04644bdc82d47b022ff8c4721e3c456cae7b8414985589434efa84ed8c7dd787180a346da2524c8f5fce74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beb7103d082c8042fb77f22ce363a651
SHA1e430c44c1c203f81d1c1c5bd91fc293a6e887c54
SHA256a911a0adda473d5583d5407a52231dbbd0fd649bb6d36ac43fba7cbadf05b004
SHA51203f67a539dd2fb98837b5003199f6c2a32dceaa9389b150522752052ded8463b67ac746a05d49532bcd7c0ff30f80998d1dd36a3783bde0e30f85ccb643491cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9e47ecf5472bdf0e505f9772dc978e5
SHA1427756b378a283ab75cc81d7971e71b752832dcb
SHA256da2aec38cd1c707e7a55742eab332489ed41621f8c85eb3e60b3ae70abad8108
SHA5123b7008b5d9bfcf3197c517540355d1bd73c0e959f18a1cc66eacabef365f91706906d07efa8038e44665d118fef90e2499a4de48ecffbbf3e6deecebd13204ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513970e23a881e285d36bcf6349af355f
SHA172d5beea10a75d6d98a44b08c762886b595a21b7
SHA256356c72293db2a4375fe4179a17cc59fe2dab15a90e863b9df44d7df86299486a
SHA5124a7bda85b1ffe46880e82c072a63ed65975c6e076b66716e817074c9e4149ef6f4806edd1727956dbfeef24232e8845bc325a35712a9ad303c3e37bf0abcf266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0bbb7930c90ef764fb80ef1b3f6c4c0
SHA126a30126a460577e6a97d5ba82109df02017c5f6
SHA2560415309a6f7cb0cc08a92cd396776d307e65e441a11a58140e049681f13abfd6
SHA5126c27511291ceefa8a749a0fbf105e7c69d4d205a15c8ca7a89e250542dd1da5cd0b9a8d3d948eb4dc3c782d8fcbdc3b72c35c5eb73490a47e6d2c5489113295b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d96aaa3a2ea1fa6508c83d478f668053
SHA1fcab6c1e9d902d1fbc89ad6343a5e7cffc7acf29
SHA2562e5220d94585ee45fb05eaa87aeea877e45b49f941e5fa0e73c5ac46f1d6a6b7
SHA512df59e8098d50263ed066acb75f96a0784da19cd70d397a4dce24c0bb899b56b2cb7436ee4313c1656696cfa4933656bc1d0db056d1728cba12ad3358a12a0db3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04fd521a2d3247e76108b6dc29a82a2
SHA177a8a828a3ab6efb18aede00dba47492aab3aa5f
SHA2566a35016ffa1410d345415ac047f246104e316f3af0f11fc758a111f1dcb8cb52
SHA512ff5ae582d3020a948485a34e331d576483976a1b8559f7550f14bb7e9d83b6482338a3048f5b6ef3dd54d5cb03193b64f5cef2e95d209fd614856f6de164cf92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efa3c4364fafce2011de37902b3da33a
SHA1221c5cb37d6032f051373467972c4da3a5249b71
SHA256b839dc3e7f46a5ece29c29de0181051b93bd1d3619f889b08635b5935db1ad44
SHA51292b6bdb418e1e51fbfe7ac9a24c3df47f99940e462d7d2a94d9f7c1a89ff4bfeb30cd486370ceba228fb1ce6ced7bf700ddbb180d527b9365aca7d43c009fc2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50567819938a62bc520e7db00506bf727
SHA13413ffa50279a751e46456efb02f92fab6840742
SHA256f4932d806afed536b433e9e616d362778894e6656ee259e1bc3b5a70ebe5548a
SHA51275ecbbe40635e1b541202a32b4c4ce62810e07ac5de3fe54491984a1e8be33a9b48f219e9ddf34db8a260bc11dcd951b2ea91645ca3f99414258eb0cf997a518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f898c4ce567f39ac73b842d0f5841cc
SHA1dd99cdf24604b0f22430be4e0d85a63e3bdbe1de
SHA256836156aac8681c89c92ed921c7b5f74b57108c0fa9f2526591537af4b075601a
SHA512adc65f75445a130375182bcf0e1fdaab2a00fcbc316b8ba16afe07bf34596b66677ca59a4c3ab609108af2db03a88fc22207afdc052571612e089811b8320e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571d4ca198043bba8b91cf5ccaa201ebf
SHA1398547e30fb03ba441a27f5cdf9c78103bc4e537
SHA256e6eb57a37b9539b44bb303ca2d422eb529d85d2cdfac40eb53e82a6e041b815c
SHA512012bb94a83e4c92a1c94d23494a9b63edb34fa913dbc4b6bced97ef652dff7cc59802fbcc131a769bccd9b4514a685988101dae8afd4e3f0f8331b7a097a5d63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59915895e9f1b73bbe915446a1fcec05e
SHA17a9acf3fca104d504a4070e35ee594f627e01dd9
SHA256fc3d48eb729f15b1488921aa2e7dd088dad4e1ab6544d229e5bf6cbb47773300
SHA5121f7fcaeeb558664b08bc208670cd9c73f34d8a529a62cd4b628d6808ce770c0ebc3e0f1aa46471ca24d62bf3bed9cb8aeb6abe942580fd10d066b2dcfb9005fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a0f049c2506bf2e4db9f7786c13acb
SHA121a54db3a36f232198499dc1e47497b9d4ed9214
SHA2568013011c87910f4c3b2f1fed37e34d45fb74f4ff65deaa1541826156947de48b
SHA5129afb76e7dd2e153729fa80e72c40b42717d10287cb033a35c369e766f9ba787caa5b501f1a661f00c9d3eade5bf055555b127cb2acbaa3aa0db94d5945dd0b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ef2f5a9522c69602288e60e694fbbf
SHA15ef0ab5be32503cbe7211835456a8de9b9f1f972
SHA2569c195e01d8c3a48852bcfd72c45057841eafd4f9c15e967fe007c516bc048288
SHA512504d23fc59dbbcbd43a482cccd6bf8dbb72ea3218494b5ed317637386b092b7e66c3ce019a9c3c082023ac14f5daa3c5fccebb847099c230a14e83ad841d7195
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b5f2eb7a6b75fd4f3d96071dd5d3a5e
SHA18e893c66ee63728e338bed0cee67612c09fbfa11
SHA256cd661982293f523d38c2c0079954adc619a8807c7c5a6866da096860384b9a91
SHA512745e6ba4a6b2050dbf73e36cb67a4c89ec53815564c61ae78dc53feace9bd4b5e6124062fa892f600ae793f582666d01fbb08f6854c3b2b62c23381e306f7366
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a