Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 16:34
Static task
static1
Behavioral task
behavioral1
Sample
4067114a627e13019ac32d58eefdbe15_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4067114a627e13019ac32d58eefdbe15_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4067114a627e13019ac32d58eefdbe15_JaffaCakes118.html
-
Size
889B
-
MD5
4067114a627e13019ac32d58eefdbe15
-
SHA1
b3427b19fc27073c0401360cff4a0eb63f4b7444
-
SHA256
7bda63dab88d579f34e284c4bca415b52d8b1793978dcfb972cfedd6c22d0811
-
SHA512
e74f59afcc5695dabdfee82f90c9aa19f5636084aeb1aaff7c2b9133ab6bdd12019b2b7a8bea161418d98e079d33cb791a1ff3c88bcbd0e68b280e21c640eb74
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002ea0a311f99e312ed776a68c14f9ac5ca1d73e55063dc0fb4b69b29af74e2f81000000000e8000000002000020000000625b6c6da43a2a8bf245966f26ab27d53327923107ff379886deef7c4b9c049020000000d43310c8d1b7d427ac1f47d899c2fa173923b6379819425bb76f5136e47b54154000000088cefd1fef9d95dfbd53b38cd943a738c0bfce315ee7fe962384ca6163ac6fd47ed7ef3dfe0927c4bf425c2981547d628faca3cc67dce8ecef87bd80da5ebd9e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c48e78e095221679df8e4f024c01d5ec39c1f6bf36d2897bc6e4f13c133db54d000000000e8000000002000020000000c4620b88d248e7b86b2602e5e95174a5beb1fbaf98c97f34bd8e7f37455d5a2090000000d4596febed3b72386ff4d78b479259590facc84d94dedc20d5525a345ceea741c0a5c480a847edd23417b12c42e363dac4e6ac444a9f13b638a2c627e647833f7b900c90496f17ad354890f713b8c1c4909809c2e9291ccf0c7f4aae0963887700e495f1a37ef6d6e9ff1db1133d44131d23e0f91fabeb75899c26d2a459a2ed4a2eb38e067d3104affd51f2a7e001f84000000066cc436d3c955774ccdff758bf796b84f1480b4297d2b84dac86a45ffdfce08d57f2a3029981871c96f3d2e02a58c419b8621856852742d476a8e58ed07634d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A13E7A81-1146-11EF-B991-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c8b66453a5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421779920" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2452 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2452 iexplore.exe 2452 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2892 2452 iexplore.exe 28 PID 2452 wrote to memory of 2892 2452 iexplore.exe 28 PID 2452 wrote to memory of 2892 2452 iexplore.exe 28 PID 2452 wrote to memory of 2892 2452 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4067114a627e13019ac32d58eefdbe15_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebb918c5756ba359e216b08efb091e6e
SHA1b2819e586b1d4fe51865b9988cee9efa12dc2da4
SHA25637eeff4afe9521019ad8b64f564e3d7c991c1efed4da0594bf94ef5ee1dccbdc
SHA512e9ec75e454c346f07391c26b103c000b59f948cc8a14406a6e65cf4c7668d8fa2b5eb265b32e1fbd4b30127450ffa076463155e12cc0666dfc4d6f47ab8a69e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c024ad5ce2f0ed6d3a696405c1d15dbc
SHA17ead136f6fab7e3d061d590fb1fb9d2117f6da01
SHA25691d272f67c89a8de7706ea34375eeff05f34dc78c997db38e409cbc70f4e3f97
SHA512b53a77365c0961d519ce407693b89239d32ae3e65350880ec533951223f2b7a983f09b06bda40666bda4915a4ced434acf4d047be88f7a348750041683f7255a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525f53125b8de9b740d82603d42eaffac
SHA172106da4fc02856fa42f958ff73d805d376ed9f5
SHA2566f3321bda570df8ffd5b6d9babb418d3b7826adf6c7901387465aef3abc36021
SHA512ee45196e7ce855b885cd1b09f34e1ef46db875784b9fcced15b0a7ed634eda2da88e57f632b27c08a451f834c1766922b8ec24c05d3f1c24a8900b818b4a7071
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5181968b7486712f3c6657fd08d62c215
SHA1bf72870f904db53d4f8a0db998ab2068cebeac02
SHA256210b86df38cc9e8a2d50e8c0721cf84e3fc01940e4ece73f4820d7f4902841e5
SHA51209c31d7421c08a59b711add33c41c867e95b1ce88d13bf242d580de7964a3a819247c9f6f9c75db873e5fe13231b334797a7d27c5622b58fa1a2a8df20bfbfe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e654c4fbfd462a19d0d385ba5f1f3c64
SHA11306123f8b5af039ab24394a6f01697c48b8843b
SHA256ffee4808a2b3eba56161b8cb83f171b05c669a7b4f363a8d3bf617b1af4b8a5b
SHA51263861eb9e2b25a7e789279f60ca18ef0fd66d2f388d6bb34df78e6997147e4867127ca2713766bb9871bc485c589463f62686757427c1ec2025b59067bc2b9bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb4f88bb172b563918b505683886ef5d
SHA189dda9c21a3b557d63e7863c0c1099f4192936bd
SHA256b22232a6145443fac3d376ef236906d2579d6dbb5a344aaa28a9bee4840c6978
SHA512a8e4ab6b8afcf61fa0175153bdc18c3cdd1362bdd731411bf48598470c9943cf545bcbdca12bb22a46fa6c72cca1705463810dfd03f773dea785adfd07db4f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef08a211f3be9246a75cd898493c4adf
SHA19da0be1ff81eb58df02d6eec6c22df9f242404ed
SHA2569b077cacfa3397a0c1f0dd2eee47ae42f6165090d50fd0a741197a375c89c9fd
SHA51231f3765127b9d49d78887391993063230dc1bdae058cd9e9cf8fde66a0965b56ac94b0d0294ba4aa345be5719c4703135111a05596e158584d5b2fe09a771a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edcf6a95ed43b770d4d3a3a8bcb63ff2
SHA1d4240d89981db71f485ee6c713fcf73ca3a6807a
SHA2564fb28003d94507ddc1eb184e1c77c0e4d6bd88e481ea7749e6a2ac7ca4bd0195
SHA51209ba82838271f858e0c73d08b4f39094fbf2c8f8bf8ae97437309950e86029358035b3e202e956289583fa77f6d634c934dea5d431817d71b0164eea92b06138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b7aa27fd52689b0a2760bb878dd527f
SHA1efa545abec3c73bbf35b1423d31aa1fcf56e0c0d
SHA2566028dd6f8a68e5af6216f9e129349e6bae1f854081efe6728ae9924ae8ba520c
SHA51222176630fda05ce71b6d4cf9b8d5ead3afda85f5164ec45372b3d6c4c63fb9b6103b561aa0e9dfb13cf80d857de01343b2ee377bdec9cae857861f87990d2327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504b66e59239f5a591a88a7c3439251eb
SHA1f52d333968a7559ccd9fee3c2bc1114ed8d1376c
SHA256bbf922cea61496599081a47c6078aa6fb49a179a2f91cf5e93069dd1a8d591bc
SHA51235e017fa32f71c2842d1738db6e51ab82741a23e7af7d6e455b8498a961deb88cd49e05300f8fb1ebf4bfe1cf7c6d03e43250d8d13cd38d47b1b1fd28fbe00d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db9b1779094e46fde80f2e879a5aaf0a
SHA179f5b40c965703f77cac2ce671db5a7c681e0ea6
SHA256863f8398a8f7bf1a4ab7020092b35bf5e74aa36640612129b6791ec312ffce78
SHA512acbf723e6dfcc8588cbcc7d901b861cffba3b302ce217189faf447411d8c6fe3a84a0290c392a9695a08842a1fc96ae5ad9837744a22da5ad1f437d03b076fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b4429a57345ed70f48430021d39cafb
SHA1f7759cb1a11e4f93d649c49966645845d0832cca
SHA256af123a03aac79175b462e70c4ab6389fbd077ada162610e63129926213b93101
SHA5125b7ba23d0b6089ef96ff5781fb7db32d72be40645317d79e9344a1654bf2854d83b778fd41d277679e52e29b62cefb846dc684bab84e178f5bfb640fd88d79a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5046b3af0b2781d9c98425e9f2140c62a
SHA121f9f8dbaf1013deb217238a9e7965b525482e4b
SHA2564f01d0698d4a1c078584293cae74b84b4e602418a9fed54af152155bff808e03
SHA5123559cd1764775437050dde8af253e74d45898cef05ce5540607c2ea1123050b01cf8b76f54194ebe65d055b2dbd899f2f626aa11f7ac55a835952f81b07d60cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea2e772f6706f6a4f838c64724d5e009
SHA1e1ec198aa4eb2eaec5f8d3e1f1d6867d689079eb
SHA256d91b14f011ebf09b2121c82559254671008fd8101a741c4f0da13ffd55dd6f76
SHA512e7309102f329e685562d10a06bd67237a4133cc45cd2efb7a86b8afed1172355ac6c94d9811cce8b419f15e3db4ee4c1f96977610e8721a5d08fe6fb8710625e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559c0b1c210a5137765052822cc267c79
SHA140d8ce336f97cd61da4139d43fc865ac7805051d
SHA2560163ebd3dc122cbf355077896f85dc4a1a6644793b984833ae4eab0a5ab7c151
SHA51202bc9476715d922ba237556be79a900727fa00afd2e9a13c78ce53066c35547afbdf3c3b161792a6cd5a7e7cdb9b93551ee00752ea7998b0fb23a51f6ab28036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570faff824b633d1d5c23aa47e4677f77
SHA13a7c983b970ca692bafe2027a984f18ec9d823d2
SHA2562f112f9d6fffd3c8898f6add3d849393cb90d2452e72be45f666201d99d0de26
SHA5124de610df179e67b39ec11a585bb2463a5763e695d95e793756e31c526ed11506c5459900dbf77c6ea31f2c89e493b793704581f52f7447053f46c8636ce06270
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5760d883be0497ed08d30b0ee5f7945ad
SHA1e7877144b4a2433e5b82217c7396654a280f22a2
SHA2565721f7a7640338f1a9fa4385432d722a7a57958ad230432a8c967c52a9ec8485
SHA5125bd05c7b6cc2651d87b420dfc52f91c3cd47d9e5df9a7f1b0735f57667b0626e67b2ca907208f3034c90b98a9b2bb7c134003c392f034dbdc873a3e74b9bb3f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522c8625d3e42c700beda937933802c96
SHA198c4f50cfbb1c1d42a53f671782579211337dfd5
SHA256bdf68749271ecaa52cc6a19fd356e4d23126ae60c7b5d51d2f8a601f052b9ea5
SHA51269ee2905070b0a8890b05487ba6de989890d477b7497263d9efc069ecbcf44745121f10326552e1aa6306b96d7f666eac7ff71a99b2fb1dd9738718f4dd92486
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a