Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
38838f02d4cfa7a9ce4db85e186f9400_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
38838f02d4cfa7a9ce4db85e186f9400_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
38838f02d4cfa7a9ce4db85e186f9400_JaffaCakes118.html
-
Size
4KB
-
MD5
38838f02d4cfa7a9ce4db85e186f9400
-
SHA1
407b2b93f4d7b155cfdc648f128be24c927015bb
-
SHA256
92b6d26ce575b404da0cda1693c0dc2ef7eb84e0e22fddc43a39fe469b175b66
-
SHA512
8ca26ce04283aeb1947bd3237f3b6ba88136a5c52a27cdf4b9fc6e0222c0d7582356b374a73ada2ddb8277c82cf1e933388f48e887b739152ebd732df3a28d15
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oEWZd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDo
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421653989" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CAA8B41-1021-11EF-A499-62A279F6AF31} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003920c2469ad1d83c8fe8ef7bc67fc137f5131b9ad1797a30aef286848b7c81ed000000000e8000000002000020000000a8d45575a0a56662a531c580c1d7e68ce144d5296bf7e7d45a9ac2a0acd37d9e9000000043254e32453715474d81918135f023c16e625e93d0aa725ad605e1cd6c52931e8dc16eacaed6c0b295b9f8d9709896e15a5d49ff466be8d348aa269614b217a4119fd9b3f3c15be9231b6867cf839845b1089bf2d210c463da4aa8a55a0f14d483ffe66bd921b5114b69bb59e10541125d817672329801d00b8237396b4f3528267598ed8ee60eab9cf684869ec47165400000001ac33f0af607066e150887be3c6db918e896de70a5abd8b1bc045bdfb00cf00c906647324c55368b4d20554230e2841ededfa62ca3a5e2938058be2684c6d218 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006a287b10f92e09992462cb78a0f930fc36f83ff5769455afb279105443189a31000000000e8000000002000020000000acf3a321e1472cbd365e63c737694dd24c0d513c1f2d79f8ab0da78b51f4cefc20000000effc5a2eacace4f6931da0b554c9353b1a9ccf1dcd6bcaded1b9c4a841536a6940000000ace0a1169d2295c05e2efe2fa88b80434502087a088561715b695d8f1b006a11e7bef1f823d5e6b8b8bda32cacff453902be6b4d5cadb7f91f02019717c400ca iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004345412ea4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2644 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2644 iexplore.exe 2644 iexplore.exe 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2576 2644 iexplore.exe 28 PID 2644 wrote to memory of 2576 2644 iexplore.exe 28 PID 2644 wrote to memory of 2576 2644 iexplore.exe 28 PID 2644 wrote to memory of 2576 2644 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38838f02d4cfa7a9ce4db85e186f9400_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a257c85cd17ba7f6995b565452c43273
SHA1f0649411aa36756529a519a093fc44ade526ff95
SHA2563cbecebd28699be7fac1b6e5661e432facdbdbdcdf1c21ad591747872395548d
SHA5121e309e53e46eb05da0ef1b1d2557514705c5d64d458c2ffbc65a89e60121b6d041bb08b6f0afd11049a356933b8a9094c5d72aedf523da556cbc4b4b256236f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5912285cc5744be4f986daca684f432da
SHA1438a93020c2e2247bb8896a5b33eae21cc1f453c
SHA256f66636f7ff274d2442ae42e6306438151b3ba53c78afc85ce83baa1bb9be1414
SHA512e8e29581cc493b7ebabb6cfb5b5727095a02d90b53cd0ef8bbc4e2e82652fd8811de18af9174823d54faf99e3ac6b1bb01ef87bb9fbba5bd883d988ca7053e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f41bea9863a8f9b89938c8caeae6336
SHA18a7589c9be03ccd6b13e755ca3186d3a2318d1a6
SHA2565635ab42099029460b53af934d90de47bd5e9b9448e8405c312c12c4e98b13b0
SHA51247c6cbe7f4f6ff44ce2bec7dbb493552eaed2b66760c6186949672ac210e900a6ced31b1d196eef363bc86d5ce18ccdac48f2ac3dbc648d05525a447551db18c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2eab7b9f19ea631fb6041796ebcccac
SHA147ba38b2843235c5f1b6e70d9593d6b6a97c7e5e
SHA2565bcafedec47161a6b265e4c02683c297e65b6391ca32526aecad4e964de0e89a
SHA512c815fbb1cf43f4e745d392321bb60cc55bf98bb27bbd24acf9f5411079cc10fa25883c1a8c095c23ab72e912402ba7cfe73960638d67e3fac0e9a912b125e4e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eee5bad04ff384f6c79eb390e2772213
SHA1a8a71a6184b2800962e3335e8d1eb36a799151b5
SHA256878da7f8f92ea1a8ea28f2438845524ff091ea8ae27058cd1c8e6829e202823f
SHA512a38464d557ba07b4df0613545730f9d38a20810469b69741e9de4e653904882e7d5e5c9bf761c86e35d749f770bf06cc1258d4a9494e1370749737cd86284cc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548badcf250f734ad444ae9ae9fb4c8ff
SHA189070666e1b8f64ff3fec74e0dc8efff789a8a9e
SHA256edf4ac6439c0312186b419318a9edd56a3baf3e32856f178b4161cbdb68ab015
SHA512168403a7f0b05ac22218d9f7b37c0bc58f09c5184671f2cb4466e52f4ff35ab59e767bdd6215a65d5add7f389035ec50c7d95a36dc3100c82c619a5a2efdd0cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9602fb5684f2b158683f438f733128e
SHA116b4ca2ed02eb32575f203112f4f9b4d393f6b6e
SHA2567e8bf2f97a95f7d765a24d6dc5af44e225f472df51b43f46ea73d2dce2370a27
SHA51228d0ee05be7e0d415cd05db98bfcb22ed94e6a439d4fb656bc6fa7072c531aea9f9d37ef285e161ba7f01b61ff1b5cd150ca7ad0ca97ed09f0625b9f8a16b38e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1e5951cda5e2973eea9caeb9b29a34a
SHA12377cc2370af05271644e9803edff83f55ea622d
SHA25640df934c63b6d8323dcadf89f2f1b05370c454cf2a589233842a39198001d4f7
SHA51281086cdb7d6f62dbead1e4838e654dc42d0725051d9549d87e773e2fd9882f060589b470c96c3b837582ebb9ce24f3d6e0202abfe82786a6f09999d29e94dc45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522f5e01eaab590ca58a16a12d950571c
SHA1a9fae9d10fcfc8006625e1283f6b623883be618b
SHA2561016ff263d45ecd8ea57c6df0df28d599fe886364e65834e8d37f9d200f632e0
SHA512081aa9234c9e564320050542c297bb47229f1d04aed20c2d31d303ea743675f79d4742167bb62a19b48f25e737b1b2cb187943fd60062c5d5377f7dee98657fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd95c5f1a7ea49ab4aec060a98a1fa9a
SHA1e4783dd02d858df348114e36623020c0c7f09028
SHA256b2ec41a9b65414c3bb575fa8e7416b0f9071cc73f7dd63325089f501adcf85c5
SHA512132e2dc96827bd24834712ef671883484b2ea9d6c9bdae9bdadd5788d669ae385202705c510a3356c1899da97224f8da15e12d0677fbb88ced5011d7acf87ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c9e00e46eb3ded29292bfe050b1025b
SHA15f8d5ce2ed3270bc8d7860036b324011b694fe46
SHA25652c4a5356f3922d7a0a49da43e8b5e1e502a738abc8145cf09f6fd65d99bc94e
SHA5129a9839aae3990953b9bd9e4424837c78fd922de7e8702d9720ea7cb16e68be2786fa2cbc0d15a226c4808ef7505c784d30821a6b68ebfca17afe8188ff0dea0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538db83201d64ba36aed3dea374a130bd
SHA17da5f64eb36b295ae10493174788f8090ab4e570
SHA256d7fe72268cd432dd1ad5b9cd7188d45b385c3b0c89a4d8b0bcb7aafa8f7902e8
SHA512096f55a9186c024475fb8dd4b8d4a4cbfcece061ec786df0671f77078281b10b6da1f15c55ebec5677f04064361d55e8f3672a05a5d9a29071307e57a0cce522
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525ffb45394fc9218e1b4653293b7e584
SHA1782d267f45de68cd03b70882632154942d75c10f
SHA256f92af1efb868c266683d402274c1c9d87c89288220653046ec9936a367707729
SHA5120c4278954dca7895efd08b4a8aaffb43adc62d1f9158d3e0a2a15cf1edd00205096c0fd2d7cd85cde268e79dd45b4791696b9537e43f2d9f19eda42499835984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0cbb313fdbf4186041b7e738ae9376e
SHA1afe345fa26b5b38091f67589150746e9d0c0d6ee
SHA256137bcb7ca6ecc89638506866ccaa2cda67ff588a7f5cd26ddb63b4fcf6e732d4
SHA51250a1c5c7b2c7a44af622dcbf202f1d105fb10b4339655d8b5bb1a0096b4e89b3276ef54c2314aa209a1e386b2aae54f2418180123291143c6aae965c2d2b15e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c63237b34e50d2fa31fb7faf327fb0
SHA1d589f20a373d9719854ef1b7212187aa6609c939
SHA2560da8437d92631b9c48cdabe01066970417879fbf4f03290520cff58bdd442a56
SHA5127fd55b5a28c1b896762638d0a086ce04fefd9e49b2a765548f6f396e1dd071991fc2f7c396ec75adddcf43994b54767afa82d3aee633c8659c00c3c75a07ab7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580e48941ba6312a2a6cf4011b553a790
SHA10f98edb9913cada1d514df6665645acebc54104b
SHA25663a639a0600d3c38b2fad49ca135b63c2d6307f082ff3e243409a18186afa245
SHA512926ee8be35a45bbe55114ef16ae12a7963ab619a857dbf89c5b3304b93f3bdd52b3ce2d6a11948c1cf8476afad12e61955b5d8055eeac2799400c33469ae2ea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5591c9b36fc5e985e03b6478b3d137deb
SHA1a79b6c6fe34387d3884dd3d99fb6a9e5f4f4fc96
SHA256d8a7c2dfba6516a97a4a35e59c2a3778b19b37d11ae226b2e51c3dfd0d06c134
SHA512b9610578b46be22e878fe39f3b6ff6fd1e05aa95f8e4c099b4caa894c9fc6e03aa961d562ee5d506c0acdf6d02b241a297f547379816ccfd835e5a71d971f15f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ae7f25e958e90fefa6f4b0492e5f9b4
SHA147173c8dc7a2db81ea2f8ad06d2c32157fb450d7
SHA256ff48fedf210ec24ebda47075865e53cc0bea181205ba937f890c68cf26d16fb4
SHA51298a568740ef0ba8f1170f0b0c8e79bdd137a13d70772271ac3f119297c524a6f7840143a0fd57421806bbedb2f8a1822c4d07ee7a4e8b5d0b1b478e97a97177b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a