Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
36feb825a9f147f0a33a6715150143e8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
36feb825a9f147f0a33a6715150143e8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
36feb825a9f147f0a33a6715150143e8_JaffaCakes118.html
-
Size
70KB
-
MD5
36feb825a9f147f0a33a6715150143e8
-
SHA1
18227bb99bf09a664db4c585fd9ceba11487d30a
-
SHA256
1f7753ceb82e9afcdc017d3642acf90b42a4042031db9c77ad8ba6e175348170
-
SHA512
eeaef70d6f8cc53f68441bb0ef7c16241c0f13143dc47c44cd407961ffe50dea19eb8111027ec99d526cfa66b7b123e6ac842ba7582e94784e0b92361eadaa02
-
SSDEEP
768:JijgcMWR3sI2PDDnd0g6CspboT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8sM:JpxTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08129471-0FEA-11EF-A7F1-FA5112F1BCBF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421630200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000054a332529e123f73464660b08a1e7f26e9f325f53db55c26c43ec07066410de6000000000e80000000020000200000001dc844e1ad7ca40d2c850ebb902405d4e76ff8551644adf37c57ed24b89725d420000000061fe2ad598d4c81b87bbb3a0448ed0fa17b004b6a33e25d36e15914e34015a64000000064264033ae061d5b4651e35c5b2dcaad934088bc51f760b41715572bb14586e9fc11e6ff28c0b0f52815b250184a3db5d9a04300b34fcbeb193d4e3ca69ab0a4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0089b9dcf6a3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000046e7722d15413908b7b8d6439448c3fb54ad832491b9affc100e14780c8ef9cf000000000e8000000002000020000000c2fba6c52c5d9d58591eb09bcc7d16e34c77618921828dbb7aaf6ef9057815b290000000cee00b105b071bc629fa9b9c5f270ffe9e6cebe8a3ec5ad50eea10e3b6e529a88b98c8433f5aa73cc4cde14f251e76a3e073a3f6494ef67443e0e8a15f8b0b44c7c0af00f57dca99a690a0fd492e3bb6b2623ef04e96d057e1abd731432280afcd1e82fdfb310a5d5c629491d46b259337d8b03d147c3f22bc625ed54282270bc5ba9a85e08e19f772adbf52da18a4a0400000004226f3b3a648a4c3885f7825d7453f976830337eeb73e2aa4010236adf0908a6468b7bc3534fa737fd59382082cc045b6f31c35d0ad5ff7aae0d47206b3d1c18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 1256 IEXPLORE.EXE 1256 IEXPLORE.EXE 1256 IEXPLORE.EXE 1256 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1256 2352 iexplore.exe 28 PID 2352 wrote to memory of 1256 2352 iexplore.exe 28 PID 2352 wrote to memory of 1256 2352 iexplore.exe 28 PID 2352 wrote to memory of 1256 2352 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36feb825a9f147f0a33a6715150143e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54184d831b54d09a581b15573b0bf03fa
SHA15f568f178fb1487e812c85956ba97403bdfc85e4
SHA256100302850399f861e704560bb82f36c400b1e727be50b0cee10456931b8ccf64
SHA51205f9a6e70848997a33698976a4f264f06c73ed1c6dabc093027e1afde700b6ced4b9aa44b30534a3e0453c65eba0df6f64cc2e902fe045ecfdf949f5547fb15a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce3ab2eeb1ef2eac44d428d99603e65f
SHA1335c20335da57630dc99f310bb70022dd120a102
SHA256cc904fcc297120bb14c73e8ca7b3df5fdae3679e31656743daa75a342be3793e
SHA5126d56d8109302a98c4f57b65339190626338a88c3c3b11d4d4acb3f2813e91daa13fb9c09c7a3b43bb96567a041e3633e4c7ec5a2a2ac843c6f08e8eda6221ac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5768f76460126a9ea670f5f9068d37dbd
SHA14a803363faa401996cb235a3eb25d0ad5917ceb5
SHA2564bdc91674394e40e6b9159ca48898c7d4dabe019449a17333b50b7d136eeb502
SHA512e85abaf49e9d08bd5f08e05e539f2b4503fdd4e053101f61e64b8f426af3af17c70f01c8dc678e1d3f8ea7f7a8e9499438615ef2da4a65aef918aacfe7528d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fde97742b110cb9aaf48d7c48c50a863
SHA144a1a548e7477e529845655a9063d69610ec0bca
SHA256b42f476d881e1143316d6ba7053b0c4516ead3aea6277803d90ade5fd87dc50f
SHA512e4b8b22af6f179c5e902de5140747d3b3505d988cfb04ace7bbbba337bf5d83408e4321a6e0a6e7017514ef9d546da90aa03cacf90796e212fd6e6ed23557873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502f6099aa0b3b69bd64e05dcdbf133ba
SHA1178e1c6fa401e4ba3949a1f124cf2460359c691d
SHA2566c856b6beba5f6fb0a0ad84b325304df26dc4bd33106ad045e24c7f5c7b0361d
SHA512c731bad41e846fcd3a8799ba0363d578e516353f5a6d86fc7449b689ecd1d9e72af8e21117bf78255010c980f9a001776b6d3c28f00bfd4e6553a83d2d321392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc3e7b6c53924e5763de9e548459fad8
SHA1be2b2384b31307fe634b6a8eeee1a2e13eedbbeb
SHA256666ac8e2aff5d6266a7e4ee75292f1d7ad925f029e8caa2db3969a78757431d6
SHA51288b6518d0409e2d2e30220f0ae5ba7d743a5aa9f14494113573b9801a25de910ea22d405a08a66c2099b192302f457ec13051ae0dc91b07a186164647f312f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595785263dfe19c7e24a413bcbdeff0c8
SHA1160538be646965afc61148c544a1e0f6e577bb38
SHA25648cef82e63b02354cbb2807196b45f4ee98d80bcdc26fd52fed20deb5a8651c9
SHA5123ef338001de65c854b400021457fd39a25473b7d20c8db3e2f450c7db45665ac1b5dee5fc6e27a94c6a2c69f35a7bef19e9ce4bee59724bffd056395875d08ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9a22d79f60f1cf8cd8466aa2d15b78a
SHA1b8d84a7f7b1109e138e3114ece4fb768e74c43c8
SHA25613f7c06d3d8a6067f0830fe19b09bf5fdcfef1be622d8f17691d7fa351caaa42
SHA51255983781a932879302737dd789896bac28e7247edcf613bdd53e96612902fc1619524f3122a0121919b5a6be7d5dd23b1a08d63e00c3675ac4e8f08302f7d423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59294567e323c467d6c25fbec5cd779d0
SHA1e4136c10968a94cbdd1c98a6fcecdb2436d67519
SHA2560782361d6bb4160ac57e905a8877739c16fd36aa4c2f9125cb55d04beabfcfd0
SHA5128044df7b823ed7fce66fea8ba93a140b47aaf454a4ba1fe6ba1fd3deec81c23479959655c7daff2136ef468aa708549bb5b82c36d62637742054c323cd9e6cbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502d9aebefdaf694160ebfecd76883880
SHA1c162a6b3a268c21cc5a7290676cd340885c496ee
SHA256e3f2c42439aefc06aab639a654467f3ee8225ee2ef221e70ef39e409d5059e7d
SHA512a033e9924cbca6741e84a48954dbdaba91367cb836840f6a5edf74171a927077eaa315674d183dfb16429a2a81e0302e370a8e5b5800667ed2218de7b0d9914f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5664af73161867de1abfe95313b7535a3
SHA1575bd2609ef933f7ba2cdc5984e2904f7b953100
SHA25659301d644e6196dc5cbf5088e2c3bebd10f29a0733bcba321575f61cb7e10443
SHA5126ca9ebc5c52e09d2d552de6b57da898622380b8effabd2123ab5bcbb2daafd45454f7541889f983ce95bb558408236f1a8640034bbbd991ecd9b96fd84a17bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f117110f72f8f3b3f2174e2e2749ff6
SHA1c1e2b835cbfcf588e826c4fcb6e9f0ab826a2bc0
SHA2568b0a572f9c91aaac1cf0e3eb3c6afd1d5d89ccd921341d650a682ac56558c2f3
SHA5121a4c1732a8dfc91248866c93bbe58e6fbce92bf142b85ddb99d65e206896e7f7d17424862a215458dfcbecdded79c682ec67f8f31e9d492a15e358f9dbb721ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eddbd319a9229a767200faca4b55366d
SHA176a3469b8f04bd25ce67241529b049e3bb1b4b4b
SHA25641def6750549c812bd7ebdf802cc7528e8edf3138cde0befa547ffacb8d77947
SHA512c67f65414bab186f11b186e2ba1c23c043439b800e9b17e44b2529949c816749e48c51219f0533f6e856310c50b82c40045212a380e97d8961ffbc8c0d629df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fd5bc1e1dffd60c35ab63feeee90e87
SHA162dfd1adfbe3e645c86793fe5e02cae3ae74c373
SHA2566f56be731b778a262d80ea194dfc73418b18f2a94f03250dbb514865d23558ad
SHA512257ae8584f322df108f328b600626845887b879212e7d449e8f8628a5a6283e1d9c7b8794c7ba7adef754731e7215ce17865cb1b4f056ca557e6f2ef9bf30297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5300fdb8a5b7f7d187e7325839eea31da
SHA1e42b0cc7ad5e2ec7799163e1e43e29116e1bb00e
SHA25695d98a7ed55ca7daa93ebbf4a6a0b9fa381e8b5801942c32db35b3dcf20bbfac
SHA5122059ce8bbde70598bf99a44e85789d20e13e49641a56c8e903df3ad2a0b5d2d463937e6ecdd1f04bb4506e1cf04c0a0898dec1ce242852da65f7166df46d845d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5556c5ccff83469c4191132754f2cf98b
SHA16c86fc42ea9fed4cb4e0d00744ed0d75e4233034
SHA256dd4d4ae3ccf7010e5f58eaa9501a50b1c7f0a655917b5606310e1813ff19d6b4
SHA512af1ca9e7dabecff1535e207b0ed84d8a95eb12f6906a7f7875cb97ded7fbb4c44b1bd72e1d22c4c8f05882cd10acc8d75784aff2995d6084e832918a67fc3c17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5264e6a436bac74a1602fcefdde9b25b8
SHA1e08cb3d9c024822ff8c35b01a6ec50e6ba463dac
SHA256bbdd816f190f14bc5fc26fb18ae4bf61ac73df8a8f13676f192b1962fd8065cf
SHA512903400879a9448884925de83ca3767db1bf2b11dc372a21f0070c08d62e62df5b6b625d70b6b3ba52303d3a598cca64732e78a0dcbc0b6d39ff093fd17d1808f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f38d6ac5b88e100ca8e3a43025312c6a
SHA15da422fd255d8575c91d9662eb4282daab82fb19
SHA25604df99cd18362f7f6f640ae69d2d46911dbd10803569d58efb05c17fef3d98a4
SHA512c560f79a1194f9c60472c51316274587e1bc6918055968f6dc2dcfc662265cc7c119ae268569e10c6a36ddec0304c1751cc9609d1f5713f1ea306efa3b37a2f3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a