Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
3fb67314cde742a5a04f3893f78be2f1_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3fb67314cde742a5a04f3893f78be2f1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3fb67314cde742a5a04f3893f78be2f1_JaffaCakes118.html
-
Size
4KB
-
MD5
3fb67314cde742a5a04f3893f78be2f1
-
SHA1
be246a2db727f8afc3618d767c06add8f58ca94e
-
SHA256
d71a6cd9bf6fbad42e6b568b673bee9ded676ce56ffba8335dff6be918205434
-
SHA512
1f428dfdb8aa56bcbb0a90f8ab4e53c4a7f88f458cc25b88338d727d0ff8f1a3f13c3b79804c99570bd5721b6dd59dce51d5d24703a2216b3ddca2e53c85d53c
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o8JsVbd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000400576776efd0c706647aa70b600d8ad2af63a731cbf6ed3b8cb8742d28465d1000000000e800000000200002000000043df82d18ef177ad3e109eac529fe59d7ee715527a0a06e1ee4357f31fd4abf12000000070052b6ef9fd63dc1667028f019cec610a1d7649c0bdc4cfa0d9d1c18c25821240000000ef2c27a6f4c65a586535ea8a0df64fbb3e6efcdad5348c8b1f1b98949eace9a378ef5d8788300d249da2fea9fcd759ba3094e1788579e48954e22f1c4ba4f410 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000576c0a143019c552582f85eb4c4139965e918c1a1e72482a0175e78e7111c16d000000000e800000000200002000000048655334f2fe1a87cb6c96951596b0e7b184a2a1ef4e9bf1cccc6181541ae8fd90000000bdc10b076dac29d6e86abab66a95cf6c0cb738615d6e61d0ce608afbe5b165185a06aa7c510f08688ecd2ac3b32080761126c8a790e785188e899937e381e5b26993f8f961a01c82174efcbb8f014a97181842b648de3ff0684ede49c2a30c653ddea5d24bcb95d9657b84f8d954a1bb29916b051292a9376f99c14be91e4c621caf32e4f1bf005fef1a8e438fefe84d40000000f387ae434d4b1e8d6819eb84614d1dd9efb52867d9333646f77872b008f9509a27c47db3d22cadb4ebaab5594e30ff6b623d2981bd5fffe60c56a02b1cbe303f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421769017" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F337C51-112D-11EF-A1A5-568B85A61596} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504492133aa5da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1952 iexplore.exe 1952 iexplore.exe 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1456 1952 iexplore.exe 28 PID 1952 wrote to memory of 1456 1952 iexplore.exe 28 PID 1952 wrote to memory of 1456 1952 iexplore.exe 28 PID 1952 wrote to memory of 1456 1952 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fb67314cde742a5a04f3893f78be2f1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545e99969ae3e23b61ef02415efa0f992
SHA16f3159ac5eb395dec7b318cd84b367debda7dedb
SHA25692efd4760dbd7923d501a152ae9c9284c26aea2bb593f44c7c3dfcff782d6314
SHA512bc770ca5793d7aa258cdb74aa56d9d92010d416485a2b824535028fb93d43eabd5f6bced9e2d561109ec217215f87b2cf028fe54fbbecd10e71af44eba793126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5752edc9a5724bcf5548844e239c3fc36
SHA1bd2e6f87f786826a0a921e0f7bd4b3803af4be48
SHA2564e2ee3f5fbd08aef62bda89faeb875a2158a353ac5805a7533fe306a41d31b7e
SHA51231a667b4c06fcd3634675de0d9014271fb8f06d5da7da751149d952af18ddcf034837674697f39f105a8155bd34b4f0870b1736b3959d9538dbf41d0028173da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca3203e0dfe7e4a86399c1c1bf6b45f2
SHA1cadfac232558f6fb85e69ab9929240460603b64e
SHA2567c467065cd1235c9bb61ccefd1ba4ab2269466684bb90984313875f19470034a
SHA512efa90ad96412ea5dfedb334c8744df89e4b802e5e9397dada4f5ed192f46302ef6e30218fd432173b3fda3e4ce5de577654f770f9003384782b6da4f2a8a1e1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab92aa367e43b43a66c059ed9c7f7f52
SHA1c655368343698f9b2a0d111c609a02623b5ad385
SHA25688a53eaf528aef8c4b488402636ed485f1c7d6d2f0bbb69dc8d7de8d4a84b730
SHA51283ef461095b2ef12facbbe052cb05bd46ef5c24f2035ea49b5eda26c3d1f75abd33f1e9c21ac7dff753077d05489d587a4533d21cb252d7c6739f593cb162418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513d22aac6976a5f6b07fda5cc5edb980
SHA133c60bc957b4ccf098200e0b0c52bc348ebaf355
SHA256ff24e42342954e54ac156b53d8d4e4c9f0d639d23977d9697ef2a4fb7ee13c55
SHA512d52645719698843601b31e1e41df6e1395891b7713fcbbc9fa5c33e8a1459805aa33d4f77e271c5854b8081af2a09039b8d9cb993bcd924422116952d5499273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527da93a63fab3603e35c14f2e546f5a1
SHA150af7f43522251669429282ed9683d06ee801253
SHA2562860d127d1815042c34d665413069326b0ddaf7669bfac562e7ca5898721d817
SHA5126caea53426ac18a17e78ac6fb365d8d4d3265feedec60f015a37b04421fec3e8610077ddd996a07525aa9d533a8c86170e00101009bc280b151c9e4f55f0b701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee24283e3788dae938a867eba7cda340
SHA118b9c6e4350dea7592d0a9394c07a0811b68bcdc
SHA2564f239affdbabb9cb537122518ba8d9b66ac84e11bd17d5291b4d62c65a54186b
SHA512f7193646e7956c18d02149d9f8445057b1a96141016665df584b1f07dd0576ae795ee0f6da015dd3711f45b033b5a56f99810aa04543c4e57b00bdfa34ea12b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5589622b26db855318ed288cf75b5b163
SHA1ec3fd4b5df214a00b1515be23f296f4caac883b7
SHA2566726ea3dd53ed2725a372c7b391a331499287aa846d9be1f264f5439bba4cefa
SHA5124c196efc1f703bd7078f017a160c97fdc4f5a170ab5b1de092b112e3e871aa2cfb4b29c1b11bb8a3e45fbca7ad962466b51a757c211bfadda31c16665b0eff8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac7d300abac2707932770d3354aea01b
SHA177a7404ba72f00fc6cfd26f7cb0bfefe6b351e66
SHA256abba79b2b7514b22e13fda99ba3e2c7740d385b049e1c1d9dd09d0ac91a10015
SHA512b69b8d62516b28f3c4a53890805b49f999ffb928da8fb5ad6899eb87366c77c5b88cc017dee91c32f241a27f6f4eb7ed21e5faf08b45eb54d737d4f67e9d5ece
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6f88e8199ab16e3dd81e59c1d8a399a
SHA1fc95bf56185f387c491709244cb4ea731f338993
SHA25661ba4f8fd9a3ffdc223899451a7168e7519fc3d0c1dff3757a056c43c1e080c7
SHA5123a6f671bf34442cb2820f73a85b9e4ddbdca3e1cf8b606769fef08d0ae3dea21cac9dbd3eda526dd5d687d58a07ef1b814f136c00f12c91e5a5a8fa9ce021d1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e08dd179881427ea04460b1ab94f0b3c
SHA12efefdb073da23a0f89f5191a2422be9afd6341d
SHA2567a35ab051371feb6d9db22531a6634826df70ea985c2a01e18f4f398d369cfac
SHA512c90013952ee6ecab3c27e708cdc5b59b8b6501ba5ce617b8d79100af40f6650dc8a8243cd5dc0aaea9a171a675aa13ba69c4a68457c560507641bee683b3d2a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e6a89db450303373bffe3d533f76157
SHA128e2120a6e72db631fbbc4505c7ba979f6f9ddf1
SHA256f4f2608d1b1c543ea933fd008bd741855021eabfb36e0c1160178aa955ab503b
SHA512dcf4779241f19f7e1cd0011ea0b5eac6afc573fcbec4a819d6b4fa9190a75980c93bca3446c2c30409e5b5e87af4e08874dfa56a56b82444d625b63674c254b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b98c77fa3934bd16d7597b17b20f7b01
SHA170cde9ab3fcd1edba46935802555b32d314cfc1c
SHA2568f78a063ea76a6b13c0883d00b45040ce7c81151a5fac897fa4ed28025201238
SHA512ef4483ee4fe745e6061ee3f916cdd682c919803a4f188e41aa4e299e8633c9181c68a20ba07cee8aa257e691b25cb2e83411440f4d536a2953d8c1d2aa5e417b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea931c5595cf7a43e585836bee51f104
SHA115825c8dc9b68f7583695c625b435545aa937733
SHA256d8263b0248752cebb29af49be3401fd7984a5d3feb5d9e78bc2f68356cec91a1
SHA512f285039b924b38e72e64e1fc37254d2ad9428dbc0aef6ba6c64d1d5ec3db5e61d7a572d3786cb38b8f7aae7f8fbb3a5999fec452c3e8c1de47bb88bed526c1b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6e39900a72ac53a494c81988c963158
SHA1cad6fa1fd00a7f43650d73218af053397c4087b6
SHA256771a6771f961b897e4072f33a8d866327bbdf8aead56948865e11428d2728096
SHA5124d4480982488fbd08cd2d896ea90fd17c0ab1df52993fd71b00f17c6056db8e2a16de61c22ea5d589ceb31ef562cdedc6f45ec0a7340db277b3a8b84206f895c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592b1a484d5f46ba1f8e52aa35cb7ec19
SHA152cbb1604bcdcd27ad33bdc440c748d745114f0b
SHA2569c27ed3d0b6c3615689390cf0f9022d864b19ec8a5a41e29e62de5817ade2c6b
SHA512fa0b24bb567bb863e61d6aae7f4717209a3a00bd27bb0d82949dddf6d29b5fcfa8600587a20bc3610e99f0046648d7ecfd8f78232e1fe12b4ac799c754b4880f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fedd0daa770041ca2b5a44abd2aecd69
SHA14c448bebd729a7029cb485c7e4860be4b42a3bc7
SHA256958f774441c6cc1aef6f82acbf8218c5a657fa4a8aef229bc3c66c8227beb101
SHA512e76cd2133acaed557523e9ed9476ea89183b0d2320391a3182f2ba7dcbee265a162edee20ff40a19467a5ba73555540462a240b6d80fe40c2db22c4a18071390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51274e7fec15b39ff425ee27d037acc80
SHA10c4347b8fc6aa60602b4ee5b408a5080ea44d7fd
SHA25688221915622ce1f18b097fb075cb2a556f36dc688fdc96aca3d1d9ad3ba5b5dc
SHA5120c36b802ae58b3e607c2940ac7ae2e767d57c49e89118f761d0d95e2058585579002ec7bc1dca81d47f67aa1d812113199b0b332baec63de31ff7526d7c3a79a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a