Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
424fb8dfbb7ab071206c50dc1c763783_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
424fb8dfbb7ab071206c50dc1c763783_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
424fb8dfbb7ab071206c50dc1c763783_JaffaCakes118.html
-
Size
70KB
-
MD5
424fb8dfbb7ab071206c50dc1c763783
-
SHA1
2afb807616b4dab18e3f1166e18e302e94c8892f
-
SHA256
0130a67ee894ef4077ff28882b4ed62250b7ee410cfd8a186a663f575e644f9b
-
SHA512
73e06dcba4c8ca7391d4aca1c69d272a5d14b010356960b1dedb2c8b46655f8675df8e99811bad98c40e3e17fefb32e4d8205fc8c657408cf4fb92e66264caf9
-
SSDEEP
768:JivgcMWR3sI2PDDnd0g6ZS1xzzq1RoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQv:JBzDumTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08c023b23a6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421869156" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{662F9E81-1216-11EF-8303-EAAAC4CFEF2E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e4802fec972ed3c3b7328384b31c9a1ec452136b54d0b8a75cded12c17e8e4b7000000000e80000000020000200000005c18c54e2689183ddce2223f48ec17955e47b5c18f6c7cb8c50dc7ad42c68375200000004dc27427568bcf71685af016d611c16ee339a2ddd84c1be2bf5be7b64e8a2c7640000000e904986cceed748561715359fd238fd604ba77dfa59a2c874510829303fad7c5df97b86e98580a8a2c8f1f45c19fd573ab9f3819882989f6db49b6962c018e0b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001fc74cb8ee165a77d5f7cb45c8ab35fa16879a6f7b2e7f52920cbcf40313019f000000000e8000000002000020000000cd28e5c30cf9ac354157f2ec449e2a4a486d77648497e40a70e06b91838c233290000000637a1db8198d111452b544710107d8140352a82f5b6f4a124fed445beaf0eda73cfddd520d0d8ceb06b5f9f3f240446806c77e0482365cf85f9289123b0ac0d046dab975864209f99999d5d6962d18cbf4edfaf326293317bbb5bc3ef06253aff07656afd71ffba018a8392ccd89f00b6e1a02dd1a53a5c1e28274999c5cc6f7e72cee944dae588083644b26beac9eac400000005372556cfee4b3e17c47b4af111414fdc89cfe7877ee70766991904a751977f444f2eebfdec0c7b153aaf36afcbc4be6aae6be0a14669eba9590b5013ea3994f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2816 iexplore.exe 2816 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2036 2816 iexplore.exe 28 PID 2816 wrote to memory of 2036 2816 iexplore.exe 28 PID 2816 wrote to memory of 2036 2816 iexplore.exe 28 PID 2816 wrote to memory of 2036 2816 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\424fb8dfbb7ab071206c50dc1c763783_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56065ca7a0d2eff6499c0c56fa720c6de
SHA12aa3cd4a2478f19caf4a3389c84fe0664930e655
SHA256d203b88f1ce41e7bf83f3f6ec6ae2615667d4ba680e372b8fec41f81657e4dff
SHA5125f0c01825aefb22107a157f398b6b78eef6270e75ab11a17135b84791179e6782c2f02c85d06482126e5f7c27153e335b7d9f194b27a4c404787d4be7ee1e916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588e7830543368b0b193687d18cd778be
SHA1a286d25b166babbbe0ec68d8d278eaa62b22c0b4
SHA256c67708900fc71f3a183e3a84342d2ddf42c75304a3624c6ee62e40979244f97f
SHA512f9349d6eed40054e2ef88032e230f9db309403bd3353de37e89b7ef6b357f6080faf08f47678e6effafe3d1494f622e5d1eafe7d389ab3bed40ea7fab7503db1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c6e2122d9144e5a7938b6a269aa7bfb
SHA1091dc89d5d5a2e637cae7af14dd73c4205cad984
SHA256cfc00d50bf5555243450370e17cd8366046948d7f3bf25cfc0fa5c5e723a6f1b
SHA5120ce6b4da91aa26c3be53f409a198f14125678e00dba38920feb52a828d9c8c6da24c46c466963f7dfe44b7edbcae85c5c08043461eb2078f8261becf1a358c9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d46a037983362f91d0a0f44d010a5d1
SHA1150bdb75d22d8171f5834c8571900185cc801936
SHA2569cab5de44528af83fd317efdb1868252d58c4c053dbe62604fefb53860b0516e
SHA51200523ca8a1233a141183b7b6187e5b831f2d760b83dc1872da2b94159e53ae7f0187912d6f22050201cd37987d83727d3985254558d4b2036453eb0d494f9e96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2b48736eb2710605cadf402a85c6759
SHA14d0b8b8f2774a9cef5abb96aeb5271dc71e04ca1
SHA25632c7489daf1a43eb74f33a1b12ccd03034a72103bfef7d86cf45a3fbdd638e01
SHA5129145254f405c59a621c4ee99aa1a4fe0e168b6aea71ec31ee986e32e1c678696891f64296957b14e27c3d3468d96a164e7af8fa4181250cfcf9aa03ea46c80e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a73398708290793f4b5e58d657c881e1
SHA1d5fea88ad637cfbf1b77a4d25d9085c74ffbb08f
SHA2567f49a9b2e1a4265cdd144c96147be912a04d9a1efb5c589d00bfd717ffcfe496
SHA512629eca4ccf25a03a5f15719e111989a6862b778b57be711ed7b809d18d91344eca29126c2173420f7a9309bf490ed77e2ba51e44ed7d2f6a5f117b490a5f693a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f07aa8899b52b9f4a8fa5face2f4e04
SHA16479fe41ef75518542af53469a70cafaeaabbee5
SHA256a84e3f2fad30eeb02c72719b30b20c07ee03f7af260bfa9a8c6a020da8aa2319
SHA5121aef1d97b20fad85ce1c2d3463f691ad21b5523034b9ce01252e2fe0be010287173f22d34c42daea5e07eb89319db8b669e946696959e965818f81c29f1b76c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531ef4332a5b4643d7843e4db0a79c551
SHA16889b1303e61ced3aae1728a2e913f772ff9aaf9
SHA256dc9b7dcdf269af43cf09f3458a4a26b7321beb747490170cd039e250a8aed87d
SHA512d964d4878ed3f474daacc73c4cd7ab3a13894054e616e2078491fb1a421566a7ae43ea3bf474054da99b1378f9b5be023638f5cdc55296d8b1a4eebca0cc3d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8934c0203c09da8ab512a4f9179f3ca
SHA17ec6bd010d080e04c6892e076b75d1d11b60281d
SHA256abbf454946d1534db70a5e19bb362dd958d6a66be80e7c8520132de1fda19274
SHA5122401e4ec129c8f844bf107e5197222c38b4dcd255fe0de3525c93d8e20b42098fb37aa4058df29cdbda6b4b43b8200e317dc28eddf77512613059f58503bd116
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3e5d94b2ee584faf8dca61f625c85f0
SHA1e2d1648af59147191891e61ab3d663215264b93b
SHA256134f8cddd219d480af1d2f6b31f8d7f8ec028a9506e72b7275934529d433d98c
SHA512fb9e68e2c7580465a7711e2fe062ce626aae789f02e7f305c1eeb7a38e781912a2f872a2b2fb1004e951ace4ca0b32dde31fa060eacb9f125e706b6b95a2a7f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5044637ca44454cd761bf5d5df8cae3fa
SHA121b0c79a29d4ea32fbe77af5dde55798affbede3
SHA25619aa7fe8cc128d6a9a2a27bd7870c7b29c3508567c149677bb7165fa5ae27035
SHA512e90cc109511a66f251f12f6c173c3ca3308b940193486ae4172b8fab2a43bc147941fd58b5809fabff8e649d75fcd04a313c7abe5b0f74a30b18ed66f1246182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55230646ff4093a9659f41f1a4cb04b23
SHA1c820c78578daf2b96614ac715f328de0087e096d
SHA25630a28bff9fc2af973d5a85112c6a93cd18c0d500cc3375e34e7bd28c51753a68
SHA512587f829d58c5b9b48538d0a80249615062df4ef552236e98327770438a8d7f4437b05e689b8b272e4483ea4eb2dbd5af6b04a7399bb0b5d07e57e523ff9e75c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52813fbcf59f318f199e237126adddbe1
SHA118ce0a6beed559a6bb0ba884824583cb9b3b22c2
SHA256c3e80a9bb356836c2b00bb5e453d4c4c3f2bdd613ace94e88215cdef4dde0e3d
SHA512c48a7936743b3ac669179a19530771efd222f77ce5fb4661737e169a7eaba9a6e5af36306a817ae21bb14555d4d8e136cd3509c5cc8cd37997bd143230d72762
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7d076a2c247deca930ba1c8b47221e4
SHA13bb49f27c0f55c6d5abcd40df7568054f34cd4b9
SHA256ee7f1607b27618c2771c2ccecbd91109cacdf3efb4e72526c646857ee27a3c5c
SHA5123cbcb46db9af59da656915b1940dc5f0917c628f81e1ac634f283d406aa1b8dd92ae0dffcccaf8bed024fd4c3803d03ed6e553617aefcc5e48a8f00ab88c290a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f06c957f1753c62751b831bcf4a9b97
SHA1cb067d26c4eead339a8584ad5dd706c8bbeb8c25
SHA256da9562bd26f28e46effe8fae25b07b77a80800b4f677a52e218be933e2f72b0f
SHA512befda7e57d676b60ba5b0eb0443251b424c2747d8dc39aee8be8c101ac0865b0e57864afab68875fe56119cb620dea3b21eebf1cc8713e57bf37399263ea9f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f171e070bde538cc59a65057a8d58e39
SHA1250c5ebdd1516860033542bd7d96d1c575fd8e4a
SHA25612fe78a0bf218e2c2db25f6059661ffd44c0f08bd52c59691cf616963d096e26
SHA5124df1380b127fd7558d7a9716c5f3c8f50cac421d6250b525b05009d96fbaa6da4a2eaad01dd15a0cc5225110bec66c0ada828742baf56fbc5dd19df2a4d54011
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56351d5f35cb73c7d59c640809b0985c0
SHA1ab7a22de4f4865b5106baa8e2551cd84b7083c68
SHA256de8f780f44d72016f11d46428ddb83d01a44fe9684c6f522e44418bf7ea01ac2
SHA51210af9ff50ad1c59cedd3448b6ab8f551bed6d85f65c7436e124a7ac1b2c6dd811c72708a9ea2fbc38a1eca3a4dae38ad954235af3402ad8abedd24b9cf13f299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbefb117eba691643c80379600892896
SHA1c21d88eb0ac4f8f101164ac1b9a954d1ab149787
SHA25686c7346d248b0e08aa8d803146ad0ebc77ce9259b96b3f75aa0d039884d3c16a
SHA51278258ed6c36a4e510cf77ded03d763a85659879432bbb13f1771a809940e228b446e3cf40cc72468125ab485ce1415227895e22d0809be63c6058ba54c250c7c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a