Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
37bd3685eb43e7c5f064de65da9b08f0_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
37bd3685eb43e7c5f064de65da9b08f0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
37bd3685eb43e7c5f064de65da9b08f0_JaffaCakes118.html
-
Size
5KB
-
MD5
37bd3685eb43e7c5f064de65da9b08f0
-
SHA1
0449aa50cade50dab4f9da3b014aebe3967f666b
-
SHA256
fc2951af25b9d831dcf16e7cf2278241b7b139f7f3e1ecf8b76ed73f594c39ae
-
SHA512
a1d808064b903d3a2c1fe2a42ebc27b4b527502c51d9cd28157f2aeddc7fc7a3938d11c37927aefee5bc9a3829222a5982fde01a2e0823eb24b021f8b24969ec
-
SSDEEP
96:eu3Jht0ZDI9W0/+P3vavA4vWuPMfKwEzdUfJz7:V3JhKMToVfJ/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000135d9b3f2a85db8adb1c3f0e88207ed036e3255524a1f2fa42138c988b4ee82a000000000e8000000002000020000000ab43901923b9f03cf9aa11cb0e10a39edb0aab3b2146f0f4a139f7c0c42c5c4f9000000043f9abc9391901a6258bd82aa771b22edc4d0e5c67da20d4d06fd3069bbce3576650711319302f8a5e9381994765cc2cd4a2b4c9c2e02052ae5c629d227a27ad7088b81f7a7c684ea114ab267013c1d714b2c69b754ccefd62ce180f34346a116ccbaa1974c58e802aebb5253b1475e248975d3c2cb11340d110eb95ed0e8083ef54e49f4d34fd9dbd0a9240b70f002c40000000319cff4e6978a8ba0cee99fd7664d595ecaf2fdbb607204bc05ec0c7eceea309371bd561eb5d4820c5bb5626ad01add4dcbf028ba326278d049d3d24bb0f8ae2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1790E251-1006-11EF-A2CF-6EE901CCE9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000074313757affd59675f2a1bd59e68e3a5bfbaa7a29936a54b00c8dae30419801c000000000e8000000002000020000000e369d591b222bbd56f4d750a4d08c9d522da13d645deb7a3158fbf3c1a3c323e2000000028e77547de590dfe3de8c2a5dd5650110e448bbcd9a3846b20b234ee5b44a5e440000000ff2628782a4b5355cd53f48b7a6a6537fe63fa4eda71c4a09aa31d3645aaeeaef66371848e74cb27b693ed908e7d61e7407487b46324ba0333b0af462f6a994f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0532bec12a4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421642249" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2404 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2404 iexplore.exe 2404 iexplore.exe 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE 1028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1028 2404 iexplore.exe 28 PID 2404 wrote to memory of 1028 2404 iexplore.exe 28 PID 2404 wrote to memory of 1028 2404 iexplore.exe 28 PID 2404 wrote to memory of 1028 2404 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37bd3685eb43e7c5f064de65da9b08f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb48696917f5ac1a125dc6b42406b7f8
SHA1de36efcbc5033115c4c07886fbdc603130f99340
SHA256072459a6619c971a357e2ad98b49bd02d1d10e278cdf4279b3858cd4cbcc856f
SHA5123c9add2c6fb88ac73947a3cc8c6152b6c93fbf9b532e032e37a46b2ab7e39c27805e9c28344e0b310222cdd92a6118188fe6f8e5db2afad1c7f7fdc0e3171274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577dd67c234dbb700c27d8c77c91a676c
SHA1b2d63ad18c9ffd63a5ad932c2c28eea475a3763a
SHA256bd935d7eea14077981dfbacd7aa0cdabd9c5165f543c81ed5f33e7479f2ce3b4
SHA51207deb768832a88ed208b77ea171cbc45ab57098f960996b288faaf6cb67f4d5859b9b693d4e458c4f51de296ca169939c5b152de56570cfcae69f0d206f51aef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5552f188d6f679401af57c13c66c0f327
SHA14b1f1d95f96de4b8d314192515c1aa035cf20aab
SHA2565c034e868a1a4d72b3468797f4aa7127bd05373d8d4aa44acfb91925111069fd
SHA512cb28d58eb455680a3074a7e3b718586fee414b285b7fc284b71a77e7669fb47a4d6322e53bd4bffc1b3932feb21e4e7bffc50907b8c244f8d471ea6c10ddf773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fb3ffa1f33bd447c2121f5b31dec56f
SHA1195fb5d42a26f746dc27987c5288ea7c7cf6325a
SHA2565f3eb04f50c98af92e38725765e92709954da024e9cbf24638010e05dcf8241e
SHA51281166e9493b88920723b9206189a0f13e139a7332e86a5f9ed6ab02d935b431084f941ae68f044a569533b0b107bdea288ebf8c3fd14bef91ae0080e95eaaf86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aefe576ce20710a432748450240fb964
SHA1d30630d61af4ef28c9e6ad214e37738a4acf68b9
SHA256a65eacac7cb625d1b6cbaca4375fa219f325b107ee0bdc12083cf4136f4a8690
SHA51265ca712881483fb1c5ae3e975d72aabe28defd3250a216536c7a7ce8b0529ce6aa687ebf42ed103dafcbaad5f568081df22920706b1fca711f4d2aec45ca124e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532478955e2028a68ad3cd6b79c2fa1ad
SHA17e16d260f0d116667e6461c0be3766b8aa6ca6ce
SHA25676336a4a377197ba489174c3f05eb2dcac386fef8823556ff98f30ce84ec362f
SHA512df9091cb30fc8e8a2ece35d047a69821eacf61741f8fe7afe2e9e6c4128af2a768df8b5962ae6301406de64e520e05b2ca3abbccad5e1fa40bb527481d00f7b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c03940a93cc7d73a66cdf2035ed3604a
SHA1afb0fc21a4a89003fa56a4a30a8dcfef8db8b45c
SHA2564cb438926b2ff793173d4fda02e8d1c786347a6c5d0706e4cc87b00b7129b0f9
SHA512ab22a50584b225e6e32f98eac73a31221be755654d1f0d7a74c092319d1bba67072a722105a1b940fde61fd6e35ba2d9ae40812ef1068c09a02e86282da50434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ff8c45b6b9d9584eadd4351a11a606b
SHA16347ff1bbe3e1896213a5a366cc02e34d711e243
SHA2561c7196e5399939aa950bec0ad464ae5cdbc47eaa985742b85fa7b8e3717b5984
SHA5128ca3de02520c4c33a659098e0042143930c6188138753af16e8bf0cacda4b6518e5095caafca3e2b040552ae9be2b3b7b5d48ec02368cf56627fb920f56983d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d15c983ae85cff91d6780a1b83b3c23
SHA10b76dc6aff048c170627578dcb1214796d90d448
SHA25685b4245a76ed2de083b0e4abf537c0be863d098b127f445827e2bf65d5afa0ba
SHA512f118d2d769879e55bf16c3c726f1463027099fadf38d927cb3ee032705cf2fa6ec30c99ae8584fe1ebe1fe4f969dfc94be71a41db5e9790267e476ac796fcf84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf6e5baf15f638a81c004601775224de
SHA18dbcb4cf6870d2e91060a583544e7b335c0c6447
SHA256851339ba68157b977df833a6f201f2e9bf771adb61f1ff9c4be5606f6b44008c
SHA512b32b0688e3b52465799cc83bfa75cc48d6329d4984b750a296a8b24eab616a664b8e2e0277e10b94b1455dea9109e454f613835dd79e74f4b46ad0778e61bbbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffed64f1af7a1a0e3a448c4e070a852e
SHA1cf2a70dc26e25daf0decb5836bb4d40dbbba30fc
SHA256fce2c8b9ca96d3e6a6baed3fbc9ee417aa6c9e17b7393fa96063db3250c05bb0
SHA512ffc484456ab9502e7966f22afe5e882230c29e2d06f9a8d644ca85a75f9bc44c9c94bc50efa5c03562f1d22692764dfc0976dde90368371f02a15a8cf421240a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7a4b9e3da8f303b73aef315ea45fd58
SHA1b0bfd2a65dc938732d53ae54e6c9355bbbd6cf87
SHA256a8658f1b9fb003e12065f3792a4439c23806a3168174159b7a1005e2160e309d
SHA5126d8e596c851205f93fc698e3d0b9b34e49a2c06a7f10f4bdef316c48036d871f4bf5dc0f273dcf30ceff7f8da97a7f2488ff9326e1fa1a2a5b1867c3dd486742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590c823017064506b56a66230265702ff
SHA148c8cd9e4b18d5b38048056a9a6c3ecfc62e3bf3
SHA256ed1fa6ba106f1573dd68b187f76dca94be3dee5f89ac6c6f4564f75930876512
SHA512a60a9aac48a1a4e35147d35379c95609566a557152eff996c2715e3830aa3f1f525717b7bc6df11ebd8adddb365a47dd441277454d1f714e5f9269b3964254c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581d4ff1cf1db9c5a8a841039ca408d6c
SHA171b394d505158016e4f4af1a4a9b78cc4a6da77c
SHA25619746b5a6e320de5e63d84091df97f078392344a9e3df6d17ba357d75ad3db85
SHA512a31b629f5d0579f351cb56b04484bb8eb21722d513726710cb9ea3046e9417aca6e9305ed2e33c8c7795221a8cc9d8ad4b70e6fda15c2d6aaea08ab0bf4e4f9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567df594de7d91a33bf3b26e352eba744
SHA163f3199b31579d52cc21db19fafbb72e8f464f7c
SHA256e47131644ca91f1438f5c2df9ee17723d708ad508507929bbf93e9d9c9b3fa20
SHA512b5b5f145629f509121c9e59bb62b24c5bc204e77f6ae4af4651f1919f1ca7b8fa36a168d310fb58ee7392dc13d42a9300dc3b32c1dce6f43d3f7eac709943e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53aec3a23199507a1dd16bc744f023dfa
SHA11ea4ae653794417afb033092620f90a3dc1e22a8
SHA256e5791b2d64faed212fa25aeb88ecaa5b8fd69d8b962dd244b6d33e608ce1db55
SHA512997a6556eb04b3e08b3e5cc9314b71e2d7319de88246250c9eb2363ca456fb63b4fb4cb3e2e8d190d2b24c42353747ec19715c0aebd10e36287cef1d57069594
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ff45d42d442203a2ad314dae3b0ce90
SHA13efb549a3cc1c5dbb72290e3c2e1edf651e83dcf
SHA2560c985865ed88c8a14d923cf99fdcf3b5bddbf43b936d4df9025df47c6db284a5
SHA512240762242ef03cf9bee7c6f90bec35dd2e7bcc3865fdb40937ed5c406f84a70b542f73081723227681e9aa9171fd1f478385e2c3601a5bb1fb8d23eec9a84fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508fb78f867c8b208df190aac4f77a56d
SHA1eebe84da1ae962723be192490f774e2a1dae06f2
SHA256a4997455975d83e7d3e69fdd585bba65efc703ebac6fabc7daa8d3140d8da4fc
SHA5124a50db671ab59abc35bb39b3cbc4baf5810d558d104adb43adce98e6fa48685f0c55f18f2392d058da04025e96538975e0df731409070fec832f6022f2eb15e9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a