Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
4d5db94d916f15b3613d8e15efd4098e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4d5db94d916f15b3613d8e15efd4098e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4d5db94d916f15b3613d8e15efd4098e_JaffaCakes118.html
-
Size
5KB
-
MD5
4d5db94d916f15b3613d8e15efd4098e
-
SHA1
8a185bfac9a90c64cc77b3a5b8e9a4f809ec7060
-
SHA256
aa5febc82e76f9e759b20b9744d8454851e729b522584aa7ef55b4072763df89
-
SHA512
c08a83f9be956510278024b469c21f95f59a74064de554fee8d91286a9a59fb83d7286d054fa9175c4b3f2de8d4a9054701e1107ed923fc1d3ef9d8073dd6139
-
SSDEEP
96:SINLnD2F/W6NM/JaKX529VU4IO6Ada8rsy:SINn2F/W+AEFIO6Ka3y
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422061135" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e72d7966bf6219fae0d7293809ff4cf0e2c0d25b7bd6faf6502714de9af9d321000000000e8000000002000020000000f7ff0c4d0c8c528cd7722380f25ec9b0f4b270802359c54ffe84d04f3a21d27420000000783583941bb6b63d0e7c45085f3a19b1667deeb749f7312e8793e5da8399aa734000000011a18b09e03597439b79cc4a6ed2f248aaa8fdeda16e0e88d970d6c488707409d181c7c2710fda74c2e05fd01baee951a4a2e253611cd68f202bce7b28746440 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008dc0768afaafa07b1a4d72233fd447f400928629d0d01494fbff8702138ef45e000000000e800000000200002000000076e4e00891709448278237ac2db121ff393b448fed0279c03156f8eebb5313e390000000a502d370f599663f15dcff57363ae8c7364e2e6f916e4b42fa77f7249fabdc6d0e3039843728e59fe1a9d4d912b8d7df5a072b966ca55a7d90d576a3b8f672e019d685d37ab76b7bcb93cd86521bd2d9916e5b03ce2b5c33e48e74f41a86d9796169671374ba8c3139aebac6b2a37747f4febc33b113319a0ff49b8c9cc56f6da5de62f830f7b8022e1d0308ee32016540000000f8ffb942bdc908e76ddca465703cb7dee1c88e26c1de8d053a10ce88272e81d6fd89f5384509febc0f779e9741b132d7c2bf58b77964a983d0dcac6ad25424b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809bcd37e2a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{631DAE11-13D5-11EF-A4F7-5A451966104F} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1252 iexplore.exe 1252 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2092 1252 iexplore.exe 28 PID 1252 wrote to memory of 2092 1252 iexplore.exe 28 PID 1252 wrote to memory of 2092 1252 iexplore.exe 28 PID 1252 wrote to memory of 2092 1252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d5db94d916f15b3613d8e15efd4098e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3851f4c54a14f38df1c025df52acabd
SHA1fe5e860a47fcc8f4041f4203783796d547616d1e
SHA256e8b5910b63d4ee764dee06ae217158b1ae37fb17ba450cca9d9fea05d29fea1b
SHA5128a3f7521897877e537bed73356a1bc4d400165d21061e8fc2f77f07ea99e026a3b6b6d6bfaffc40d0908b9067107ab0d1539c64097d85f793a3190febf8dd6fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e0564e35108c711f1e323c47132e3a6
SHA1c269df9d1b8d6278dd0cd8bf29da7850e7ca41a8
SHA25688b6009d2c3fdf990c85f888f2675d694f567a2695ba5c30e25ccaf27c0e63e8
SHA512815746a3a14beab15195796d1c504a88a24029db4f7d7eb722d87073453bca52a8b7042386fde97ca7a68d3cf630dfde34203e0f4c07c8421842b747a1d216c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c01363ac2ff82609336be3dbdac86fba
SHA1cae7573325cb4d173a45bf3210b92ecfe00126ce
SHA256db169cfea06c7e6cdb29fc98ea1bbf16834b98d9e8489dbc78e829d6337d4a76
SHA5127ac87cb1cc8813895d267cb4a71344d079ddd8f2c5e238a028a0eab0abc7db19a5a24f2d2c5f93a857a593ed96883ce2c9266f73a842897a2d313a0cbb751119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5620384b2ae94946cd87abdbd07f9349a
SHA1aacd23d650fee1a2b5f7d9c748a100781489a770
SHA2560a27b137031ef30dae77374c33890dcdaa5e2769945090039e563e4c49260209
SHA512a76d81bca8279a17d6ff4fc90634a83f6fa05531b495d26c4bb18b2e69e07c1fcd03748df9531e512f1c302142b7f2bfab3e65c63e452a673b496823b0959575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd08c64395daad6eb90977f1041027a7
SHA1d996207147d31d05d6be84440b58c942976e3e5d
SHA256c91312127278a53c409d9535e9ec8d1103e498d060c7486be0d17cde59f92501
SHA51259a2dc807bab327a75eb4a360352a490e8ff1912611d9a015613b31fd31568ef61d2cc97257303d8ca068fac1595f842280660a97e0b7b6257f289a7980be105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534a957055f6d3345e58607244233458b
SHA1b3bc311033c2c256c718943d07d6f0d8a853f5b1
SHA25614ad7d436716f3bb9bda860928a796776b33226de4a3fb7a562d4d478d4f3fc4
SHA512ed931dad3cfc3d5a2a2a9e0b04a22b5d175bad1b6de2d1042b3c30a23b47f8aa49c61181100ae338482e452fb070b103ace3eadba28513cb97a53e92e9f79661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a68aadec6b54a34c9593c469eb68237a
SHA137ca479f1910cfa78e51a9fb4fcb2891f91d851c
SHA256170e6da61cc5989ce8374934e03b20c036d60d5d9195f3693b5d9ad0776ed767
SHA5120a72dd5672eada4a5ed3325d511d6ef7d6b69f4fd7bf82d5510b3f7aa7b11d632d734662559545bdeb83299532c290efc9bea1efc5c2c3727835d1b808d1fc69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dec81b02f9530b20496661a87b313beb
SHA14cab54013c124112aa439f23d3c47df5f646a7c1
SHA256409749c67a5d9ec45dfd02e95004fabcaedeb687d324b4772dfdfe1fecc40284
SHA512ddb7d89828113a2be37230a46132f0b3afde079a67c3b06a1beb0792f978e740ded953d7a9058130568b932234fb66faa7a4f1ae047ac067bec6f098e356c9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cbaf7fcb7461df2875c894f5b961959
SHA114c957beecd7f96c43d11f414099069ff8c102a3
SHA256f911aa246e011b52911ed4ef32b262fe85466dddd26027a2a0911056ece18389
SHA512ff4723fe09c19f053f5b2560587d12375bb2e72ae687ca9155ce0717c19720a58aeb9f875a0385267f0952b9485f5c8846b5b74b2c063a38f5e7d6a1cff7f6d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5442e7cd21ee036b3afcdd5002cba72
SHA1114d30c50945f1a0e872363d7a8dfe3eaecd20dd
SHA256f21f07355e1bd312fd8461ab26546e10dcb3e3c32b1b83c46f8661f1abc78cc0
SHA5121eefefe8b211d2cbdcc7d3421ca56de5e444f0b0b6f58ff4a25864f93c4f12e46e867ef62e2bd60d36ff317869bb933203e7073602d58411896a3047e1d36a37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d249083a4ee9e5c25dbc74eddafdcbdf
SHA17c1f963b793ec41fa6e003045d09c07d16b45b96
SHA2569b314b89a4a6bff32485edb6a4d11aa6486a468c7501028f089fc796efe5fa75
SHA512b2ab4dc2eec3c627b5a980c1077fd20020b12a9e6a75119b8909d3075c68aad3ec46255f51c14c221f028088f424a28fc986ccb1d98ee737b8772e494e533b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d85ac5175f3011c592ec6467e4894ce1
SHA1e8f70300d721411a3f97dea452dc85a116ea194c
SHA256a65dfd4e13aafaf3385788539edd5fea1e4bb46f80fb9ffb5520c917526f058d
SHA512c918d4080e7b49882b9da8e41d4daafc1761bc744fe858fddbb4cf74355e4fb0e559b99797fb0a385ef4c9d1b5bf5359ee0dbb5a52835bdf8a64cef40261f3d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5277acdeb15bbfe9a9a523496fbff3d4b
SHA15deaa69ec0440dd1dcad7ffec902dfc289a45dae
SHA256dffdf89e68d92a5e57367c62b2ce12fe85e67fb7c05a49aa427f8e3a9a243454
SHA512c3f8612a3d4336f04b04bf0ed37408ef19b45a2861b015b0bf66204de1f5816081bbe2a8637954c66e040076442470f36a2cf57fa9a79d80c0c84f6e2692613f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584cde98d66fab46e1b000d19b1df9543
SHA167cad33d892c9f8b712d9e4e7c74f622db7c8bf3
SHA256487ac53a8e8f27f4bcd596bfca6ee7fa5565b9f97d9158d4298a69a34b682305
SHA512aab88da511e3b70e4ebe6fc58ce496d65ff0632c290bb9fa3fe7d74d3726c51803d8dca4547673ecfe5340366818247600fa90770280f7fd73210fbd86018c4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5455211a4b1daba189e5b8ddd651c271b
SHA1d3f3542e8b3fa6d8b3729900ae80add6933d76e8
SHA256d89dc0cda9da33431b2ba845f9a7ecb75ad14eafe69dc9695d786305971b0800
SHA5125b5229f072c0dfb0997811bfceb28ce7c91d9eb3c218b4141ae99d19886064377f5560cfaec678610d831771f08e915cf42e57df6c6ac40492f4b851e7505886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543b2b0f371ce42c9acd3638f0903b538
SHA1509b813cee52de5a6e4e7cc80a2a37606a9bf461
SHA256a57a9f075b7530bb97540cc6fec1318ed0c9493cad2543220f499240507fb6f9
SHA5126c5115dc2e5e4f763e12492a1776435f712b496838f7c7505af4a9c90a08d657640dae4a32bcfc2d64c7f12e203771e917767d371da89888f9368535cebb365b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500b1e0e6eb869876e2f3b2381b48c0ea
SHA1038e5f4a5d210e7a0708be1361cec15729bc8380
SHA256e445689e88dd433add42e0f2914f208f34238bc26bd79410cced449a6149f1fd
SHA5120f05de7bd7920cf40383ab468e5a381c1aa6a2dc6904f4b725e89ddbaf455ab7f933855a0e9fa09d4c9fc55ecd6f9a01792a7ada54b08319a5952142be1342eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e55abb3804cc6786a0425757ed9969e6
SHA1ff885d483db0b71cd5c857920f0e5de07609f714
SHA2563e5ec22eaf507d7b07abe627b5c25209446517d8dc11b79b63b89eaca401cf1b
SHA512e6a1c3b73d06b96664d68c8210ec40ed5d164ed1e4cdf6a4f77843993b6e1b0a4c440879fcc91591252b81e79d123f161e9a573fe7d3fd61d81fe188e6f0992c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5130694567a93247d00fa612d419867e3
SHA199948ea3b180da8158e00a6a00b2e8a4f2bceb6a
SHA256b57ed0bcb68e305b8d48a205df11a79afdb9b488f6c344434e5b63a70e6793a5
SHA512284e6a140df7526422d7faa057010d22185f6a1fd3c4d27b0128bf25a327405e1a9add50ec2bd8581f5b32fed5db0d5bee993e98745529415b090130401dca1a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a