Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
3ddbc0c9186e513179ddfc7ef20cd621_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3ddbc0c9186e513179ddfc7ef20cd621_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3ddbc0c9186e513179ddfc7ef20cd621_JaffaCakes118.html
-
Size
6KB
-
MD5
3ddbc0c9186e513179ddfc7ef20cd621
-
SHA1
7fefff58383f96f2cdb81059170822f8c3f9f6af
-
SHA256
f128f9a38457b4542aef15b75b974670c83a0564432140938c5c9b60a73fd0e7
-
SHA512
b7e94065bcb96abf4f39904f5165216e90047031a757916fe01ddd775a9c14a4c1b8b78284eec6c4a06a79c91a6c7108aa9fd483191323b06a75f83965cca6a9
-
SSDEEP
192:PJ6txaqYXSD4nlyQQZPNE10hRUxXBLnBadh/:PJyxaqYiD4SZVe0guh/
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005f00e33eb2c6d32230d61c671a7bec6e2b8f8639aa6fe4bd5df3879499b635fb000000000e80000000020000200000008ab906fd833fb79d89fc2d11504abd5e7d57dd34e1ab9fdc5edcd03b81d38855200000008405a492e0397f1055991330221bef3af323b16db49dc753c5bc68f7f2165a94400000004d7aacbdfd67430bca49216b14ea924e00f20d94e320d291bb18e06384131210a408856ee41d2fd7c4090e30ff5ced3df97d07a0e2477f4f78498ac3791b16b4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000215b6c7e4223bfd699a9b288df4df020e130b3744992294f51c9a31e6cb73504000000000e8000000002000020000000d27b28852097d69adbc27cf59d758dba827acd545052392f473f5b8d3a892f759000000065da68ed692d772599015731508952c4e5a1758fdeca0ab656f01d6e56c54122f24497752caf8fbf59dad18c5dc7d509e3360479091fcc2c4d323e7a193844bab7a0b0fbb6de0089992f4446241f3621432ebdc125c9a7d622c8d6db81be87a6d5b6c7871013af162aff8d21ebaad4a27789d0fd936a96a5e2b30ce0ee6b16b5f5540429c670bd2a7987f500c8564e88400000007b58fdc2f6034a6da4569b5c51fe6b391c1b87436d5b0517721f56fad162dc9d84274784b94b7e82277f800be54a68b972d6186aabb0153907c2aae366d50e18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40902ddcf4a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8BAC5A1-10E7-11EF-8B04-EAF6CDD7B231} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421739184" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2248 2364 iexplore.exe 28 PID 2364 wrote to memory of 2248 2364 iexplore.exe 28 PID 2364 wrote to memory of 2248 2364 iexplore.exe 28 PID 2364 wrote to memory of 2248 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ddbc0c9186e513179ddfc7ef20cd621_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f017f365cbb46c2135925564554e34c3
SHA1182b3e032c0ce2594df5f67434d4afcb98fc3d73
SHA256ccad0bcc5054e34610681580bb7769ab1abad6d0d8edf56c5bff358673ed6235
SHA5122f4948c3a2d8e4e2e2af8efb4c2a60e9637eead7d97c3673de3b6b78a4d0b093c2dd5447ac742b83ce91d1bdfb72752b0c04d7a6dc649b0d6fa4ba78ecb81430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514dac0b9b3f077153bf885b2e978d583
SHA1c3b12d541875181c1b0093d9dab7b1b6db1d8829
SHA2569b53b979ff616cce81d5bc08e45f4e3618c1a3615d0d89fd141bb4de56a1e204
SHA5127766b9ecd9569dcb2a9e2b4de60e42c633714393b39b0613859e8e72cc2891cdc1f4ff4df2a8da3a9a1fd792d152c145c207559acb79e792c8066a0ff86a59ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5823268ea5d17f097f781a35d711d4999
SHA1a8ce42691867d78910a62783e4fb24c45faab35d
SHA256f363644443c502d8e21098d3b14f30674ca93134f05b068bb4a557a754fe40d6
SHA512a3cfeabae2f930e00bef8e68fbc570a5088534357d29b76fe4e3335e28d174de1b002fdd4163ffc5f3e3b99f279a731a2a5dac0bd43b6f24491038f04615fae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0f2669547aaf17d1440bcdbf6450fea
SHA10065f9c4457444e85dc2cd437bf1be930e423226
SHA2562bab2b3795c511a5a94d47bd97d39a3d4b097be5af2bb806245509cf332f1d37
SHA512afbd13ed2fc0ae033ece687881bb9e7783329bcf3487e981a1e718fea0b00f049598bde017e79c96e5f031b098166093f8e063a5855339278d4c0d75be52e2fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5099165e308bf63d95b1977b042d2e876
SHA18c8ade95d209fd7542b265a3ae035881540a05d8
SHA256809ee322b3e0c204112812cb4ff79b0b74e70a4c0b2a5f056186f0fee7feebd0
SHA5125693d7aa892583201d2785b3d8be984c5290e660864389ebc6da0690c2d6e8bcfad494a52fb119942b698ba27993322741580bd75182fc6879c8f4d0b7658062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de9f2b0da5ee87de1bb28e09678f67ae
SHA10a5774c102fd7853c495c55f5865f096c3463492
SHA2564defd91d58a2b414588fd660bf472d69551ab424ef349ad69efce033e3aab4dc
SHA512a2c69f108005c6f0bc3800de7d34f44c4196538b6fd001be28f812b8ec7f9e30e0bcb251c0d137473121c11a35fe87cfb5cf2bb964ed23b5724cc59c612ac1d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5affa890013bbb410bbe4f1366d7449ba
SHA1ac1ad7101d7b7418056715d525eb31da7dc88294
SHA256e395c6f0a1502162bb5bc1fc6578f437782f08a8e8a3bd1a2a673329e3f8dd0f
SHA512d6b0b923d6a73b78fb8ce4ff0cd0d1659178b61c46e0ce2c57d9620fbf93269477092257aa46f1b0fd27fa8b28a096c35a16d9f8189a2851e46e16b89649f5ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0febd6c116405f1e237a79c77a1a539
SHA1ec3af759f793331a78866382180226fd5dafaa38
SHA2561ba4f669fd805b041ddd01f633fd9634f11b348f75466dc57d4245ad22ee6840
SHA5122b3c687e65b05b95d98ef18fc84669f4b1f51e015c88b651d587665c77a1d87310c32643e88ab006dc1335b2261f0f90fba70bd48f606265756f14be1da9723c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522cf19e09d5cd60ca09f127cb765a13a
SHA168b6351d24b6fedab535a1bad9eda51070b436a3
SHA2563e086b824c896cbdaae007f5841a777e65ea25f28fae98d4a84adb51ed9598f5
SHA512fce9d3361a0eb8d00e3eaad6104a2288e4ab9f41fc02ba8f82f3ddd1b47a8c85535e7864b6862570f8b54de3b06f95e615fe89fa4938f639531e9ee0b0ca4433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf7ef96a9902b9bc8ed9d0c54d26f340
SHA12395bc7a3ee717ae4667583b61882471aa7ea47e
SHA25677851dd3522dbecb1dc274c75a8411aad0eb84f32cacc84473644da89de428bf
SHA512562fecca89ccf3e5d7cb3709bc2729543b108277cd4d8db5d0210a461efcf820f92bccdc7c31a69156776b8e09c8add8d2184396ac22f2259edafeffe927ccfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5721e3c1c0feaf45ffdbf299b9190c5dc
SHA1ae4fe7f5a0ac37d54a51ad6471a64d1a497ae040
SHA256be4332eb7a50692c5a9bd2a942b92a05626aca39f213efb58d1e19ce6b7ba77e
SHA512e87f22858da4957dc97d1654d423479bcad910c5df581e75a34711795de166b2823b3ec5736e6a3df2c62416f7dbc6f7fa0109e9c6794cbc0611bf71b0a9ff4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5686086e94dfbed8e4c4e4e031c8e0463
SHA1e5d2f677e7feef495110ac8007ab124d260315a1
SHA256a8b62bccab62256b2c1f17abe6ad082aa7011b599eee55cdc11b42f00b233125
SHA512d85ba77bc2a206c2ccc47c07a5ceab66bf19bcc1218fbc07b2182c860120cf2abce9a1459dd9d2929e892d1960d23856344082e8897403a4aa87a4b3194d6e01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552a3eff4fe281138cb04a64cf256dace
SHA1ea918e5d276fe63bbbf111301ed5cfc49b4352d1
SHA256939e699316d5f19c29714bd199612fc6a90b0320917de91ef75231a6db7c5ba3
SHA51231386dc0b353778efab3d7ad86cb616b2433fae84c45aa9601d066d505004e8ba5c7b6ae9b3b77ce7f11f89dde9f0d3f1e6cab9faf9af8b9e4cbce104fa5610d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cb7bd1b184a466dc8d1ac4626539e3a
SHA1280d0d484a82b193e1a54644ca2ff389e5306a19
SHA2562fedebbfe13556d1fa6e1346a7b42b5f56e861f5df8075de923c83b6119e275f
SHA512d4ff3e0c3ff9cd779a8e179ab1d0fe516da88e92fd8a1fcc0346a29fc2b1c69d3ec20a85b1f9fe1011eab49dc8c146160e5f04576ae6cf06cddbe232d218579e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f555ce90b046b429470f01680a4ada7
SHA12b0fef7660b4174d3ef9615bf700feabe7a430c2
SHA256bc805dea8afef853db452feece1ed5d3e67a6db157f27cbbf521b6f17b55e6f8
SHA51268f56bb1d8b610189f51027afe72904394677e5abeaa7ba07bf36f79816a1acd0ee1a9b14814f32a0e9c56286a0c29a5cf46ba4682a0e8f7cdc182d9c6e503d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53353b29ec78e036bf6df1ebdb4ace810
SHA134aa1b2375ae5248eb7e9874d5a4a850df37cd63
SHA2566b850e5f70cc90320b3797bbbf37227e6c048949a33dcde36fe766039e5cb06a
SHA512324d86409ba14d862e0d92948c00b152d2f459e0e68af16b3367a3ac5d0823f26bd4f62f56fff2cf9a7169932d7b0a326ac7aee10b11d64f4da4fff471f7faf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abc8aa5e7c39bb67611413d5739c320c
SHA1b43f4d100a2f5c0fc7074a50a87a3662a9d7c4f7
SHA2563c1b81dc18a5aacb28fc4bbb15978c6461abd5c97b17cba835cf08e892cb41c7
SHA512e8afc11ba52f15c11e94a33630a543116b1e97b0c38d99cbcf5d90954f756712cc8c24987f7808fc93a69687ec9ead8ef56b5c8364a6144300815a5178e1c3a4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a