Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
3db0b7c776b821e0ca7c8a951b6be1ac_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3db0b7c776b821e0ca7c8a951b6be1ac_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3db0b7c776b821e0ca7c8a951b6be1ac_JaffaCakes118.html
-
Size
197KB
-
MD5
3db0b7c776b821e0ca7c8a951b6be1ac
-
SHA1
56e0d191c5c1e6069e286b7364414009bdf7f5e2
-
SHA256
c708d7dcb8d05b28647666b385aa455adadc0e26b63421c0e3f1654bd2f0aaac
-
SHA512
9a3224fa599b8cf72d44425da00432c5c013f2ef6af7bcfd626ab66588ead1e3ac7dded43447f282a8aed425db02271b7a049037128109f854fc7eee75ec22fe
-
SSDEEP
3072:AVk3uGqXzKqLGTfq+L1y8rl+KxJxKbk5U+KxeC5C:sulrQSnfSeiC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421818543" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E5ABEB1-11A0-11EF-85B9-4A8427BA3DB8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2172 2356 iexplore.exe 28 PID 2356 wrote to memory of 2172 2356 iexplore.exe 28 PID 2356 wrote to memory of 2172 2356 iexplore.exe 28 PID 2356 wrote to memory of 2172 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3db0b7c776b821e0ca7c8a951b6be1ac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD53e2eaeb8a5405ed1e68847f5fd85aa93
SHA18357152139dbd9461450b8a57b50b04b0777c1ea
SHA25691d69b00a13ab750321fb5f57e9975e5e4425848fee60acca753fe6ff6502b70
SHA5128bf093b4c3981d93f7612c3979a91566419569f86094d11bc9fcdd9d82f79b6618e92528e58135f7a860aec59c4283a63a4364dfc01b50b4ca709caafc1d4889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6c4651ef413e2d8af86b337102b0a49
SHA18d8693024740ad33a62194b5a205c03fe4d930ff
SHA25625dd42e9cd6c6f8063b5a62cec5c2747cfedd9da3a2ccf264332292d0c9a121a
SHA512f810532b761f4d164ede43dd53eded8630aa3aaccbf8c7a6b4ab7e390fc181123ab6a346b5998ff748b064cdbd444108b73ad06c0674bbd75fa10aeab14c5405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdf71fc9c9b460eba207fa0e889716b0
SHA1f0c125890af5434b53fef38735e85f7ba6b7ab10
SHA25617f1ddfa9c06d197492b5e39038a8af8f01e781878900b74f56af2c7d0439799
SHA512b12a14602724d491ce29e048e3e8fc6b24f43ebdb3a17982dac044d0a0631cd8b37496f00830d65a7a7aabf37a828373974b8162dd522f2b06b7533a2ea02a68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5069a9762d5470c728e07f0bcd853b100
SHA1865e0a8b251685ec620c2fc2b4045c1fa950feb4
SHA256bfbdf277f8d22a1690416907830649d3174bd56d6e9a69eca78879a2e8b4569c
SHA512ce5907514b9919b651953f47e95f37926e17f2997cca1092984d4bf1f16b15211e41368316090e4d26b8e5369ef0190703a89b5f53ec94c9a5d7bf77502f8e05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f6c1af817580e1d1332942b5473faaf
SHA133b14ecae8c42a61da8ff3d8435c2d0fe3090cf5
SHA2566a7e86caf153b14a4c3d54617a01eac0b8aa908f0920f8d4f86955004d0160fb
SHA51271994b57f1a555478e8ad6105ac768db516fa216088215fdf04321768c02e19996ffc16f60d367cb17b3adbf36b62ed3e49f843742769e57836eb189b7298cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baccd3930e46f505eea00112d4c7eaf7
SHA1b87448015041a208dae57d5b26840f7d7d1968ba
SHA256d265b876f6506441a6b781c75f1eff2a7443d0d80e091153ffa11e964c2254b7
SHA5121370289fdb573ce90b5f61250273f5293c12d60b4223a9739e25d2c4bbf0bc8244c0b893015287d7d3c6f095b09a81c38486eeeab912689faefc011da5b6a0a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6ad0853225fcee1b495ca7dbf05b13
SHA1d4e65b010dcfc956e2284842ac449093d532f17a
SHA256c273010fccd555f4815056f82437e8c9189f240a7f7c993d6e3fb8d2641375fe
SHA512e2ec1af3b8597af952970fc949787326b1b8033c554a5fce4cae0302c850987bed923c60ee8e5af52114871c4c2640e236e745ca2c4cf767aadae8c7c33a0a5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550325d2e9acad7ba48db4cd896d9191d
SHA184b73e2bef4275f1ddf38a87ae75fbf70d2feff8
SHA2563103d92c003b3f86c60fa112389b4815f7079a3ff6817868f295ed2b9dd392a9
SHA512ec1ceeeb1299680c71beb1a81fcd4396bbff598879fd6a037835fbe37793af5777f0c182545c7a5b1d2a681b79ba4e55c9121e79dadb84b5109e7095ecb96d3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad08c12725f383c472bd8703cba28a45
SHA138baa3841014ae5625e8e6c98263bcab4eb04779
SHA256c03ca32daa15f8c0ebacd448e8dddca1f44ebcbc7b271f13a42dd7f94927f666
SHA512e032437cabd0c8502403aa37087000a9405fd447e3644b4f8150c92a44a56a467f9b2f2755042fee59e620f8434c89e16fb67184c64123749e5bdb7b595ab0bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8090ef14ba3472d3c73dac72fd0548b
SHA1b3c6fc2c3b25c3a7381d1b5e821c5e1e14d8dec5
SHA2568c3dddb9dd664b556936d84d8b730807292d60c379e4e826151992bf573e7ec6
SHA51259fda4144447c6883a5b9aaffa5b49ca43485932a27b84fd9d703e93a1e049a7ce698b1f4acf77eecdd45a2720ea8bf3120c92ddd2475df4c9416191ad79a366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6183da0f591184ab90a0130e4f785ef
SHA1d670645980638b9c51e2a7f8438ca28a4aaff5b5
SHA256a6c0fa54909093101e774d3b3f702661ff0b36f61f20198d932f2ca5736a69db
SHA512287c894dd8c3e53ff0626d2753c3ec6ece471ad7e6c785b9a81e5aad4cbde0e1903e3a06f7e0a41ef55e8dc1977e3cef907d99bd1fd781bed3472c8f710783a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad8bef007cb69885dd3ae0a9d469b958
SHA122d98b10ab4cc68285edaf1f39254ca75687433d
SHA25657b870eb3ae3eacbb010c3c8d0a7ef8a363e4ef6aba0b7d639bdf0ee79789fc8
SHA512b5afdbf468cb087b03861a738dfa67f0883e27aca3565ddd80b6ea60b8afc00e7702d09640656e48ceb2010404505771be30028409e7f0a879659d5f238b4f4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59768ae4ee6b9a1a1b669f0e2fd3e8de9
SHA1daf3f77cf793ee43aeb06f1723e5631007a946dc
SHA2566338b6958c7705fd2ffc1aaba5e25d5833110c937f0f063d4a1ad01f6797ff5c
SHA5125ae4554ce9fa9044c60fa87ec4765a284030899d5e16d290e38f7ca2fa37ea70ce4dbb2f2745276c3606cc17543148cd5d6bc1fc9cb30a8c895fad942f6be5a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d906e956be910fd7f88ad659cb4df677
SHA178a4dfc315113dfc33b1ae48c1dfbd6f5197aaaf
SHA256be7e17a0b06c96c0374a93842889eed0cf9135d2da6358dfb991e8555a713c0d
SHA512837ea89a13ccce752f66cf038c7f37d5c4dd162b17b94590f24a1916d6b2d9aadd6cfb8b5483cd42ed739f1dc8b754ad909877dd38fb946bca70de85991bc873
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\f[1].txt
Filesize35KB
MD556a32ade9b710c01dee62192314f40aa
SHA16840ec4392f8639c288393e284092566c5d4a6da
SHA256972ce0b3121e3d7ef52e4e4ca467877c70420c5cc61b6c1f186fc098754c69b0
SHA512c865fd589f06dab12a5dba7c56dec8c0a7b582b2a078f42dd47f81897557b874d6970dee7c52836cb4c8ebe79d4c48585bb7701001ee1394c57ea17dd198cdf9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a