Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 23:56
Static task
static1
Behavioral task
behavioral1
Sample
4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
-
Size
140KB
-
MD5
4da3bdc51118fe1145a27261c26d5551
-
SHA1
db445d7c09cd7d12993427814f6ffceb4cefe162
-
SHA256
d0c195e826675880db03ebfe18532fb9f9b5f5813479a9b5ba846306bf42b3d9
-
SHA512
e315257ee2c8c13b8fdb55cb886dc8077c1d952a63d932bf9a48ad3b22d3d66f855b47894de31fd61c820fdcd11f426c2f23d543179425da6d97525624a3dab3
-
SSDEEP
1536:Smb9pFOcc3lOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SmbjTyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c5490ceda7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005a3309d121b05a834912ede30f6e938b007d6119886bf75258975eafbb749d3e000000000e80000000020000200000006222218e9ea19de103669fabd84555331b81863beef4c8c285964df08046c40a90000000904373b0b15239e231de5433fc1738bc6760432ef27fe5cea8230599a3a9e6b468db43c8949f166dde6b98e63f648a6422659a099c844bcb6e9344d23fbd205558e777354cb0b21e5b55bc79f6a3163d260c906dc7132ab0ce4764515eab197d36de4cc4447c7414a5a21911714aae26772c50ab40a3432d28af385ae7572e23daed2424b9d501cdf84fc0b33cd674c640000000d4c7bf85316955b2c3f0f8ffd1f9ab10946d17ad0cf8abcc95def61ee402b9846f2cfaac6fca8dea08a6d04ab8445e37316a0f239c90ab3a1491b33dbb7cc42b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8AF1FE1-13DF-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422065682" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008a2b942396e2f41e53c83c71fdca29206796eb274a0a124571e406df27a6fb09000000000e800000000200002000000008cb1377d1ed033b5b09a7aaf6b2535d0d3fe74f0def36fbba94c7d8d4dd743020000000f364548910a40a2194ad0db568cf2eec3377c92e0e7d915880d693d897e15e6d40000000a5874efe187416c251353f2865a3a3408337924f0fc4c96c1c00456078e89cffdd430a232a1ece6e69a9dc120c9632654084f3a876748eeaadfa0df608dfb0b2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2132 2956 iexplore.exe 28 PID 2956 wrote to memory of 2132 2956 iexplore.exe 28 PID 2956 wrote to memory of 2132 2956 iexplore.exe 28 PID 2956 wrote to memory of 2132 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df181b2bfbc9920b4181a916d07108bd
SHA1de54387e828f04fb8cdc561363790de8c7d75061
SHA2565bb888afc17acb9f06de0fc51f00c8c1e3c4a2fcc8fab5f15addc89e58e2f1f4
SHA512ebc1a141b39d8b3c18ab0600cc594fdb13274aae63d89c872e0b0f6dbb3f1a185199085a3d2ed6d5cb37e2b32856a355bb477f993d1e1fcff070409f60473c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5571ce30fc40a76dc3996f397afb1111e
SHA10a5cabdcabd24a099a0ce78f931af2695b771eb9
SHA25612f6e9621e0bc76761171a27896f19a1e5854926b0b82bc6ab400fb7d9025c2e
SHA51285cab4d4c3c1b8f99cb620cda82cd24610ab2af8af46b3518eba34f6036b61f03dc5fcff382d1187509f56d66d91bcd0dbf9a276afd255ce1dc9ffa3c6dc0139
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b1bafae01a3bf2d011927d3ba951b30
SHA119f4fe7cdd250fb18a16a3d1378a23eef77207c0
SHA2564f0a877a2081e7e47331d81a14df1dcec3f06bb45d108aac1ba27a27b88b465a
SHA512179c5343dc1e760412b9e1916def166d0db44e8118c2dd830efde1660ab5a983ee712565aa90077839dfab068c19052b68df8e8ae8c730ff194cd1298f2085f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5546548673d5f076bfe8cdadfdc6c253d
SHA1018fcc0a22838148f0e4351860ca1b109d51a6d6
SHA2567a8141cab78d173a3c4bc55cb061ad14f39533d8ed5bb22e0d1a847a1889ba6a
SHA512630e6d9e7b9f5391b96305eaaad6abd1a1429c475dcd124deb01aa3cf6b7224fe55dae3a48ee3bd364e808c26017a8c33a93cc2cd0d42a7ebca5991a85ab983a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c13cc9048dced616f82acde93fbfbf6b
SHA1ee15e0b9955cd1c21a82b5a3759a2e492c65deab
SHA25652ad0083d74da09684cf457c6d0ed13df3a7e8dc199dd124da03442064261039
SHA512030f7988ff44f0c05917a48ae4cce6ecde4083cb019e898eb9d6aa2c3caf87c2d377b159d899ecbec7174656547d11eee02875d61275c0a83d623cf05f30b0be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566d6c077095984f4529c9046f11c5790
SHA1123797466ce0e8b967ee1328ef81c2532c62b950
SHA256f715bb1c71d8085c8e2810ee1e37d3d2a55b49be14f430a9472580eaffd43d14
SHA51253adce6b450b6508a4b45772e2b9b7182f59abf6d4de499b844e22393863641a15ed2a99150525d463979c8f1d09c3d265bfb7aa1bef11d8cb8d46fc95d7cb7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d20f2f791e2654463a625c0e5d4fab5d
SHA175c15e0507aa514c2d794548d50af7aecd9fc75e
SHA25669e0b0e07a8e027ff87200b62b99ef7de9a14147e253a641546d703344ed58ea
SHA512bd68828bcb9dec885b0dc1e4eab67c73ce0002ee7c0a5bf4392f7fdfe3b8eca6743ffa4f1512b5548d228c69b941e049d3f16bfb040bcb6becf47374df6da7ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531abe5e7917dee7eb885a13854b0bb17
SHA11b4424fd46586c7f94694462031732c4ee841e66
SHA256d0e5a3fcc87a8b656e8d983d15e313f4da36ad21fb7c1fd0e425b17344f5827a
SHA512c2a29ce1fa1830464ad4a8e19eb126dbef8ed81e7d0acb82a4c4b5719af2993c3578ec51ebd33358ae854f6d5bd0c4ed664bec49cb4e2d18bb8721a9e278a237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f292ae69051a208eedf78c763cd7c5ca
SHA1a503cd4cb09a1087e4fe7a31797a9865b807c340
SHA2567ef668397be7910a9b778e469003254fd0df8679ac8447f4c5a3688b3a036df2
SHA5129a730dcca81feb981c729dcbc4902fdb28c3b32064934e3b4a3aff3c303b592e6d02607af41dcbac21f701955556c0d2472fd4ac92902e1cd556d0bde984a40e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dfa7e81e5893fc0e80183cdcfa382d9
SHA107d3b380c2a117b2fb787fbd043feba45ad826ca
SHA256771a422fa4d79eb5cf6aecf2ef9e3f09edb1b9392dc35736f99c852560cb7644
SHA5124c9e3dabb933a194bc93ac65fd70ba32fce266c54bd48a1434c08acf56576e858e72868ef096cc3e972dc255d91fa1f67d09b6608cac83708f4f5fbd7bce7b94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592f7b6d49b85f1a385058b2a869cc317
SHA1fc97f6e39bce075a752d80d89a48ecb949696fd1
SHA256b692ccb5202f736f4fcaa8596c68a902c6911d693d72e305d8562c21a74fb527
SHA512a5b0a26e2c68dc4ec5fb523f3ef88c8e3f7ba7fc30dae201af36fe028487e508a6852ef33ce3809bf4b24e6f253acd461143f4177d915f6d4f8a7dd4d0b7cfd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58275879f0d65c7b167a78160636904b3
SHA1953d7a97713bc60f0278796e4fdcd57c7f733051
SHA256812a5e34a1ad33f9529cc0c1c9f6759b5ccdc1ec05eaeef5210b757288681f86
SHA512b1b2474d930336367166f3aac8e1aec183727d88a1a1cb8fe12ab65474cba981ce783c89d75fd6bb7d007ad2a1af7a38456a886294701332fb578c6095df8123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557854fa5e8c8f64be3da19252b89ea2c
SHA134362664dc97e9914627f5761057eacea3ded12e
SHA256d939561884099eb08e47b86537830362ad8ed31888646a79d9e409412e7ff892
SHA512dbc2c349f2a2a48cee7e3841b63e51a7e42be00eb4b5498c8743367da07d9371b848191f977e26db855e460d8d97d927e028dff95d56c6234a758cf20705badc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7a186c80b95eb6a9ca7cbd5098a8ace
SHA129968c186fc26e76b95e868f700c0208db2658b2
SHA2562db57a04e9f3d0313f2bcbff114dec99a618be85d7d29b12bd88e7561f9f5fa6
SHA5129a47c06dc8ec55abe45f449062746c9fd04dc6219a96418723d6190b3b919ee03f48e018fecdc0a4051cae4225d1d9b7a9fe84ffa06d8d186dfcf597fc4cfcf9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a