Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
3892950849972dc8743e872e128df6f1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3892950849972dc8743e872e128df6f1_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3892950849972dc8743e872e128df6f1_JaffaCakes118.html
-
Size
11KB
-
MD5
3892950849972dc8743e872e128df6f1
-
SHA1
afe6d43a4866be5adb91fd3089d32a84bd686ac2
-
SHA256
7d5b91dba3db0e352a12991039a1b552106c257f87d09d04dd744d1f75027455
-
SHA512
f4d2845c68f8fb00b892f6908855b610d669253c06f72da4eb324e22cfe60c091d123ee75c30a06c9a112cbf12f59c5369bad439691813000499df1471600090
-
SSDEEP
192:FiJjYib7PiCPtDNzzuapPAL8HpPMROie6np/KCslX2pe634lo84jjQDgoaTj:FojYqVuapPLOOieG/X4+8Sjs9O
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bc134f30a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c5c05bb261197d53ada35d3e06cd82b9345d129b863b0dddad63a6d5f4492095000000000e8000000002000020000000bc788d2fec81ce8473a944eca236e57c409f0db3b3d6e6ef58146011ed9fdabe20000000b6fde036fc825f224b4b2045c30d380fda099bae68a52d1606263705c287bfa74000000078303dc8d86aba49c4584784cc291cbd53e7a8f67b24809e603506145fa0731cc3f7197d8e960823ef708219021bef243d6ccc5d395d4785848bd9b49f03b398 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{790F0531-1023-11EF-8356-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421654868" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000046878dd00f94716f63d89b914f7350ba92495b25cb7275b8e9d675a81256c338000000000e8000000002000020000000c385ddd94adc80eb195bdec6a529b13eebd13dc538f505be8e47affbaee00ef7900000008e5eb747c779ca047843c2e7d817820cdadcc577da7f76c12bc91ad61ac97f01b1a3db3e2e16bf9d2140441c3b13b2b33865716e18ef2c374973518485f280d526db79745d19f3cb51a8b9e7f39645fb07e6e03478dff72284be7d9da5bfd6137f3b51f243958c2a49f3106ef52002c4d2fdaaeab1698f79fe80a1979cea9648aca3e4cc9dd5c7a15f737840b0948604400000006675658d6020b6fab1d1124fb6cba4c53e136aee1b0fcef0c4f9e21a16017b34693e09bb112334f8d7e5dfa9f1503e0b7f378d00740ff1b2a0a81b256dc1cc77 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3016 2972 iexplore.exe 28 PID 2972 wrote to memory of 3016 2972 iexplore.exe 28 PID 2972 wrote to memory of 3016 2972 iexplore.exe 28 PID 2972 wrote to memory of 3016 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3892950849972dc8743e872e128df6f1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5124400b608c5d8c030d1648c8b33c98b
SHA17b0b368784ab782dbf7d6821dcf00e2d82ab22db
SHA256f8823bc7c9dc4551b1bdeae7a48b6a7ae570634b1f6aedd0cf08367c6a31c4eb
SHA51252422d3837f0a83a7c52988077e5ce693a32adc8b89465e77e87ab273de7116d40f9f719fcbf90c28657a2d980fb0c57c12e6e2318d81a806ded09071019402f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528f54304ac567041ef7394f74a11b609
SHA13779d117b63f03d77e481ab41a3d9f43eca19c40
SHA256d12fe77ee740da7ffe5e9b0d4ccdc1619850e2155302294b0595636628f1536c
SHA512549438b199079cff0669905f8ad88f8d5afafde0500c5e693740572317268d657abdaa56d073e9ef3251998d682d2023d5662279eea906b85c7e9f60c647bc9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1c7e416cd1d3af3b60aace8cf035a50
SHA10e4186e18ad4984f772048f598e66d5af494ef31
SHA256c71fa33e9d1ef1510c0442300c8f7dd9f64e9cf04fa21d16311766aaf5a07927
SHA512dfea228a440af3f59694109725f4787b60dda78767f235e278ddd292ce18954f9d7b493479cf7014c91fdc3c790333021b12d10b539a89fbc257dc5375001131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af7bbf5bc0f0ecb03d0ad7e5a3934152
SHA1ef577fb6652100d0608bda518912ada9de5d7819
SHA256d4555010ad934fd44f972dc5937560c6041d1ffac1615fe368b88f9b11eee5ae
SHA51265fb37bc1c5cd4436f560777307c5a8cba4e8cb54882ac0196997fb35cd97a69aae4b690d2497047d628492dd6a366362fdb432138c823ccf409c8fcdef1c9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c47462606a7f1b08976038f64ceb8a11
SHA1c4f1fa30408d162a4e2b43c5d6367575563b9368
SHA2561347385a2f150fdc8d95785a8349d61743560c0c410a89c236a522e3a387953b
SHA5123271bce71ca8bfaa9f65a17c22dc49a77a9414a66ae43e55b6f6d2ff39e1c4d1045f651b0d609ecc4a6669d6483f1710396359de3a1f535e2cd01d63d131f5fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d10b6de2511e2da4603c877b4927a47
SHA1e5918a60c6945bbd0596bc26fae57cc2ac2c2e7a
SHA25608935c017e1af121d6e49652ca18848739189d0e955c2ea83583a06f576d4574
SHA5123b18756eba6a831fc7a6fd7f737d09377c009610afc5d20675611bd6bdd1035a41302f1da6b378cc317360e75abf02a2b3ad7356be58b48253bde60f4a1a30ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a801991dc30ab0f8d1f007e10c0b1777
SHA11f92b80969c9e48fd9f183d88a323d1b677de274
SHA256e42a9281ae40ea380ae42a0c1d18aa13d2028856b98ac7aaeb1855a9741a91ba
SHA512ce0333852a02142d989e6e9534ec64334757ab8438816793c907e9cfd9d49ade5ca2f7ea5dd4497af3945f66cf00562e23667e3a9f9740602805f8182f6ad7d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5407bcd99bc4caa93745cd4451876ff1a
SHA176e189ed20f28412d3432531726dce34fc45797d
SHA256fd2f2ee7c968e2111aff74a88eeea16653abcd6c9ea72a677caadaecc17799d1
SHA512888afde9def6a048a0b6bb2fb2c0a9b460e080b3e7aea3a625a51fe60e82f1db1ff88a053b7db9e15dc0073563c29988c069f0c89d0bf756de2a3f9a69130c69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cc86fdf6a151098e5f42d715f110b02
SHA164171fc16bb8900b3f2856ae739a9eade1774837
SHA25645dcf2896af7aaf37a07fd176a462779471e2ce1c43d6a790dddf40a89cb20d4
SHA51244759e68a341a16f0367299598a543f6c7a2e0ee9aaf63f5a81166e7d0426b730f165bcdc4ad323f8342ee3625a33c5f829848acdda4a95e4cf4492a5b52056e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd13e825b683b608298f41ef6a7c15fd
SHA139761decd860a7c41f0db6ff7c8b66d58a60aa32
SHA256f3079d7ac1316a896dd6260cc130457b5ac61a6092b261e96797976c52b7712e
SHA51297ce7ea2abade59a701f224ae35cc14fee0cc77591717b6f5bc73f8b15f0cf35e5cd2302601cf6813e1089ef673ffd25fb2e258983a17796288ae3653ce52a80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e20e416afcaca94a8a68822876859cad
SHA159ce495664dba4a663f660490236434bdcf7a39a
SHA2566f923ef74a7c0a74ddad8fd44c94d26cf2fbde5da4e878897f46076b8287f1c0
SHA51213de79a6303117539157803340da56a728f0ad0d6b7f2cfeeb637f3661cc81ed1c8936505c50ef7ff5f7c178bd8bf0e40fdbfa7cb3b666ec45f0bef94cf18a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5682ba376e4ef8626c5c34a6cf85ab661
SHA171c48f445c22c067d92a22dc51902647f99748e2
SHA2564041212a74d556043f4caf9f4c42ec457b89be84a93f6442a8751b199ffb1f38
SHA5120df9f81b2b1439ca09f7e9d1ea54c864701ec8957b13952ba100718e1ccb34d7df77e500cd2f87ffab5caa428c9b0c4dab50a55eff1aca1ac72f44da4a633086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508ad21cbae838d131d4482ae1a842154
SHA1512810b74795d253f039af29c2286b907787dfad
SHA2563370bab86d29a4e0ee06035bd96d79f47c1fa45fcf19eaefed0e2946ece39a3b
SHA51244ca5bdbf3ff6b8816ac677ba4a92df0a4cdd6696c99b18f12c4d0c58e83c248c1383b1fe18b8d4b18b4eb5fae9cb8fd2c80e745180f4b2500ae3682daee1964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5c8ad6b543c8fd7a37e6c132c549a95
SHA19095f3d7bbdce8d322c6f0eec8dc4616415c5745
SHA256499ae8c39dc24263b9c2d12367d5ded33b21c028053b7255db0c4c6fdc4d837f
SHA512a165799a07eb4057de19a0e4a6876f6ffe24dd9d73f8808bf5d2d1211eb902eef44e9675618845a5ff2d677172dc4030dc48bef5d038cf6d94f24f3a0323280a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3c17ebd13c9089c4b7848def0270006
SHA1347ed72432918b2c5abedd1123c288b0bcffd54e
SHA256e597e2a0c8ea9d98aa5597d3339ddad495dc019e517e2770c2fa57b2718d9791
SHA51261338aaa74ece1754499f71ca8186725298149bbd4463a35914eb985a834e1081369154d795ab91c22318c098d4c6c109e41367ae714fb64290e8a028c347383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54374111452776309c226d4471c9d45d9
SHA18ed8cc85b5e7e9d058dd8b7f1542409c070556ad
SHA256a3c23e3eaf647aeb4f1c2fef1a7eef440655bfb161417a6bf7f3d5cc853b1743
SHA512fa1c0e147461b8b11dc2ea955315b3ba0803608a6c8044121802987db6e028ac529e53cf36457b10e55b039f1b2cd3a3e57fc4ccad12cdc2a3c8943478f42640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba183324c9a45e12c4d043817ba5da9a
SHA1850fdc2431d324f19a143e7d4dba67133aa76910
SHA2565d39715c49bcc20fd1fbe2720b93b97e9e7a0dc13c0614f048c304e1376cf04b
SHA512ce54105dab8cc507ed6bbd4430c428179ce649e76d120cbfc74b6dff5efb34b0691995d2012481ff449317db2499858473c8ef6945fca549b5f20ef309059123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eeaa6bc1746c4095c31a104abd527f2d
SHA10ef1afdad4d273684f2482419836f8bee63af9cb
SHA256b6c2abb476ad6d8c734a083ccb8a0f433331e6a17f9fc830dcf2929dfaae0ac2
SHA5127baaf3f056f14da1d82baf5ed6dddd1b887d365f556df4a8bccb0ce39382bbd7a43e3daf74840d6afbd1010cd45fd4c9936801270fb80138b2b1bb62d142fffc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a